Website maintenance cost depends on what the site does: typical market ranges run from about US$50-150 a month for a small brochure site, to US$150-500 for a business site with regular changes, and US$500-2,000 or more for online stores and web applications. Those figures vary widely by country, platform and what the plan actually includes.
What you are paying for is routine work that keeps the site secure, backed up, fast and accurate after launch. This guide lists that work, how often it happens, what moves the price and what to ask a provider.
What is website maintenance?
Website maintenance is everything needed after launch to keep a site working as well as it did on launch day. Nothing about a website stays still: plugins release security fixes, hosting providers retire old software versions, certificates expire and forms quietly stop sending.
| Task | Typical frequency | Why it matters |
|---|---|---|
| CMS, plugin and theme updates | Weekly, tested first | Outdated plugins are a common way into WordPress sites |
| Dependency updates on custom sites | Monthly, plus urgent patches | npm packages and frameworks publish security fixes |
| Off-site backups | Daily, more often for stores | Recovery from hacks, bad updates and human error |
| Test restore | Quarterly | Proves the backups actually work |
| Uptime monitoring | Every one to five minutes | You hear about outages before customers do |
| SSL/TLS certificate renewal | Automated, checked monthly | An expired certificate shows visitors a browser warning |
| Security scanning and login review | Weekly to monthly | Finds malware, unknown admin users and weak access |
| Form and checkout testing | Monthly | Broken forms lose leads silently |
| Speed and Core Web Vitals check | Monthly | New content and scripts slow sites down over time |
| PHP, Node.js or server upgrades | When versions reach end of life | Unsupported versions stop receiving security fixes |
| Domain renewal | Yearly, with auto-renew on | An expired domain takes the site and email offline |
| Content edits and small fixes | As needed, within included hours | Prices, staff and opening hours change |
Certificate renewal deserves a note: maximum TLS certificate lifetimes started shrinking in 2026 under CA/Browser Forum rules and will keep falling, so manual renewal is no longer realistic. Automate it.
How much does website maintenance cost?
The price follows risk and complexity: more plugins, transactions, integrations and faster response times all add cost. These are typical market ranges from freelancers and agencies; offshore providers are often lower and onshore agencies in the US, UK and Australia often higher.
| Site type | What a plan usually includes | Typical monthly range (USD) |
|---|---|---|
| Small brochure site on WordPress | Updates, daily backups, uptime monitoring, 30-60 minutes of edits | $50-150 |
| Business site with blog and integrations | The above, plus security scanning, form tests, a monthly report and 2-4 hours of changes | $150-500 |
| WooCommerce store | Tested updates, frequent backups, checkout testing, faster response and more hours | $300-1,500 |
| Shopify store | Theme and app updates, content and product changes; Shopify runs the hosting | $100-500 |
| Custom web application | Dependency and security patches, monitoring, incident response, developer days | $500-2,000+ |
Maintenance is usually separate from running costs you pay directly: hosting, the domain, premium plugin or app licences, email and any SaaS the site depends on. Ask any provider to list which of these their price includes.
What makes a maintenance plan cheaper or more expensive?
A handful of factors move the price more than the size of the site:
- Plugin and integration count. Every plugin is another thing to update and test together.
- Transactions. A store or booking system needs more frequent backups and tested checkouts after every update.
- Response time. "Within four business hours" costs more than "next business day", and 24/7 cover costs more again.
- Included hours. Some plans are pure upkeep; others include a set number of hours for changes each month.
- Hosting. Plans that include managed hosting cost more but remove a separate bill.
- Compliance. Sites handling health, payment or personal data need more logging, access control and review.
What should a WordPress maintenance plan include?
A good WordPress maintenance plan does the upkeep carefully, not just automatically. Look for:
- Plugin, theme and core updates applied on a staging copy first, then on live, with a rollback plan.
- Off-site backups kept for at least 30 days, stored somewhere other than the web server.
- A firewall and malware scanning, from a security plugin such as Wordfence or Sucuri or at the host level.
- Two-factor authentication for every administrator, and removal of old user accounts.
- Removal of unused plugins and themes, which can still be exploited while deactivated.
- A supported PHP version; PHP 8.1 stopped receiving security fixes at the end of 2025, so older sites need upgrading.
- A short monthly report: what was updated, backup status, uptime, any incidents and what is coming up.
WordPress applies minor core security releases automatically by default, but major versions and plugins need a person to decide and test. That testing is most of what you are paying for.
What happens if you skip maintenance?
Nothing, for a while, and then several things at once. The common failures are unglamorous:
- An outdated plugin with a known vulnerability is exploited, and the site starts redirecting visitors to spam.
- The host forces a PHP upgrade and an old theme breaks.
- The contact form stops delivering because it relies on the server's mail function rather than a proper email service with SPF, DKIM and DMARC.
- The domain expires because the renewal card was cancelled, taking email down with it.
Maintenance is not always worth buying, though. A static site with no CMS and no plugins, on hosting that handles certificates and backups, needs a check-up every few months rather than a monthly plan. If that describes your site, say so and pay for occasional work instead.
Website maintenance services or do it yourself?
Doing it yourself works when the site is simple, someone in the team is comfortable with the admin, and the host provides backups. Paying for website maintenance services makes sense when the site takes payments, feeds your sales pipeline, or when nobody internally would notice a problem for a week.
Before signing with any provider, ask:
- Are updates tested on staging before they reach the live site?
- Where are backups stored, how long are they kept, and when was a restore last tested?
- What response time is written into the agreement, and what counts as urgent?
- How many hours of changes are included, and what is the rate beyond that?
- Do I keep administrator access, and are hosting, domain and licences in my name?
- What notice do I need to give to cancel, and what do I receive when I leave?
- What goes in the monthly report?
For the security side of that conversation, our website security checklist goes deeper.
How Meritbyte handles maintenance
Meritbyte Technologies is a Nepal-based web and software development company that maintains WordPress, WooCommerce, Shopify and custom sites for clients in Nepal and, remotely, in countries such as New Zealand, Australia and the UK. Ongoing work usually runs as a retainer: a set number of days each month, used for upkeep first and improvements with whatever is left.
Hosting, the domain, licences and admin access stay in your name, with documentation of what we maintain and how. If you move to another provider, nothing breaks and there is nothing to hand back. See our managed IT and website maintenance services, WordPress development and cybersecurity pages, or read how we work with businesses in New Zealand.
Frequently asked questions
What is included in website maintenance?
Typically software updates for the CMS, plugins and themes or code dependencies, daily off-site backups with periodic test restores, uptime and security monitoring, certificate and domain renewal checks, form and checkout testing, performance checks and a set amount of time for small content changes. Good plans also include a monthly report showing what was done and flagging anything that needs a decision.
How often should a website be updated?
Security updates for WordPress plugins and themes should be applied within days of release, after a quick test on staging; critical patches sooner. A weekly update cycle suits most business sites. Custom sites should review dependency updates monthly and patch urgent vulnerabilities immediately. Content should be reviewed at least quarterly so prices, staff details and service descriptions stay accurate.
Does a Shopify store need maintenance?
Less than a self-hosted store, because Shopify handles hosting, security patches and platform updates. You still need to keep the theme updated, review apps you no longer use and their monthly charges, test checkout after changes, keep product data accurate and watch site speed as apps and scripts accumulate. Many Shopify merchants handle this in-house with occasional developer help.
Can I cancel a maintenance plan and keep my website?
You should be able to, provided hosting, the domain and administrator access are in your name. Check the notice period and ask what you receive on exit: backups, credentials and documentation. Be cautious with plans where the provider owns the hosting account or the theme licence, because leaving can then mean rebuilding or migrating the site.