Website maintenance cost: what you pay for, by site type, and what skipping it costs

By Ramin Moradi · Published 23 October 2026 · Prices checked 23 October 2026

Website maintenance cost runs from close to $0 if you do it yourself to a few hundred dollars a month for a managed plan, and more for an online shop or a custom web app. On the pricing pages we read this week, paid WordPress care plans start at $39 a month, and WP Buffs' top plan, built for custom-coded WordPress sites, is $359. Our own retainer starts from $350 per site or app, per month.

Most guides on this topic stop at WordPress plugins. This one also covers custom web apps and restore tests, because those are the parts that hurt when nobody has done them.

How much does website maintenance cost?

Paid WordPress care plans cost $39 to $359 a month (GoWP and WP Buffs, read 23 October 2026), and one UK agency we checked bills maintenance retainers at £90 an hour. Shops and custom web apps cost more, because there's more to update and more to lose.

Four things move the price. The first is how much software sits under the site: a brochure site has little to patch, while a custom app has a runtime, a framework, libraries and a database on separate release cycles. Then comes response time, since someone on call at 3 a.m. costs more than business hours. Human time for edits is the third. The last is proof: a backup job that runs is cheap, and a person restoring it on a schedule costs hours.

What website maintenance actually covers

Website maintenance is the work that keeps a live site patched, backed up and watched after launch. It splits into four jobs.

Security patches and CMS or plugin updates

Every piece of software under your site gets security fixes, and somebody has to apply them. WordPress installs minor and security core releases in the background on most sites, but major releases still need someone to click "Update Now" (WordPress documentation). Plugins, themes and the PHP version are separate jobs, and so is every library in a custom app's lock file.

The cheap version pushes updates straight to the live site and emails you a report. The better version tests them on a copy first, then checks the live site afterwards.

Backups and tested restores

Treat a backup as untested until someone has put it back on a server and logged in. Most plans include daily backups; fewer promise a restore. We searched the GoWP and WP Buffs pricing pages for the word "restore" on 23 October 2026 and found it on neither. They may restore sites when asked, but the plan page doesn't promise a test, so ask who runs one and how often.

GitLab found out the hard way, in public. In January 2017 an engineer wiped a production database directory by mistake, and the team discovered its daily pg_dump backups had been failing for some time: the backup job used PostgreSQL 9.2 tools against a 9.6 database, and the failure emails were being rejected.

GitLab estimated it lost data for roughly 5,000 projects, 5,000 comments and 700 new user accounts. Its postmortem asks why the backups weren't tested regularly, and answers: "Because there was no ownership, as a result nobody was responsible for testing this procedure" (GitLab postmortem, 10 February 2017).

Uptime and SSL monitoring

Monitoring tells you the site is down, or a certificate is about to expire, before your customers notice. The basics can be free: UptimeRobot's free plan checks every 5 minutes (UptimeRobot pricing), and Let's Encrypt certificates cost nothing.

Certificates are getting shorter-lived, which makes the watch more useful each year. Let's Encrypt's default certificates last 90 days today; the default moves to 64 days on 10 February 2027 and to 45 days on 16 February 2028. Let's Encrypt itself recommends monitoring that alerts "if certificates aren't renewed when expected" (Let's Encrypt, 2 December 2025). A broken renewal script will now catch you out within weeks.

The alert is free. What you pay a person for is reading it at 7 a.m. on a Sunday and fixing whatever tripped it.

Content edits and small fixes

Small changes are where plan prices split. GoWP's $99 Business plan includes 5 human edits a month, each a task of about 30 minutes or less, such as updating holiday hours; its $39 Pro plan has no human edits. WP Buffs adds unlimited edits from its $179 Protect plan. If you change prices, opening hours or team pages often, budget for a plan with human time or for hourly work.

Website maintenance packages: what the tiers look like

Website maintenance packages (WordPress providers call them care plans) usually have three or four tiers: automated updates and backups at the bottom, human edits and security work in the middle, and staging, ecommerce or custom code at the top. Here are the published prices we read on 23 October 2026, in each page's own currency:

Sources: GoWP pricing, WP Buffs plans, ALT Agency, our pricing page. Tax isn't included, and prices change, so check each page before you buy.

Read the last column before the price. Two $99 plans can differ by hours of human work a month.

Website maintenance cost by site type

Brochure sites cost the least to maintain and custom web apps the most, because site type sets how many moving parts need looking after.

Brochure sites

A five-page site that rarely changes is the cheapest to keep. On static HTML or a hosted builder you have no plugins to patch, so the work is mostly the domain, the certificate and the odd text change.

WordPress sites

WordPress sits in the middle, and the plugin count decides how far up. The File Manager plugin is a good example of why updates are the core of the job. In September 2020, Wordfence reported attacks on a zero-day in the plugin, which was installed on over 700,000 sites, and estimated that 37.4% of them, about 261,800, were still running vulnerable versions when it published. Version 6.9 fixed it (Wordfence, 4 September 2020).

Ecommerce sites

A shop costs more because any update can break checkout, and downtime means lost orders. WP Buffs puts ecommerce plugin management in its $239 Perform tier. Updates should go through staging, and someone should place a test order after each round.

Custom web apps

Nobody else ships fixes for a custom web app's code, so that work lands on whoever maintains it. The maintainer upgrades the runtime (Node, PHP, Python, .NET), the framework, the libraries and the database engine, then runs the tests and redeploys. The only plan in the table above that mentions custom code is WP Buffs' $359 tier, and that's still for WordPress. Apps tend to need a retainer with developer hours, priced per app.

GitLab's backup failure, further up, came down to a version mismatch between the backup tool and the database. On a custom app, that drift builds up every time an upgrade gets pushed to next quarter.

DIY vs freelancer vs agency

Doing it yourself saves cash and spends your evenings. An agency charges more and covers you when you're away, and a freelancer sits in between.

• DIY fits a static or hosted-builder site whose owner will check it every week. Free monitoring and free certificates keep the cash cost near zero. Nobody is watching while you're on holiday, though.
• A freelancer fits a WordPress site with a steady trickle of small changes. Ask what happens when they're ill or fully booked.
• An agency or managed provider fits shops, custom apps and any site where an hour offline costs real money. You're paying for a team, response times in writing and a named owner for the restore test.

We'd like to give you a freelancer rate, and we can't. Rates vary by country and skill, and we found no primary source that publishes a fair range, so we've left it out rather than guess. If you're thinking of hiring in-house instead, the US Bureau of Labor Statistics puts the median annual wage for web developers at $92,650 in May 2025 (BLS), before employer costs and with nobody covering their holidays.

What happens when maintenance is skipped

Skipped maintenance comes back as a breach or as data you can't recover, and either costs far more than the plan you didn't buy.

Equifax is the best-documented missed patch. According to the US Federal Trade Commission, Equifax was alerted in March 2017 to a critical vulnerability affecting a database that handled consumer inquiries. Its security team ordered a patch within 48 hours, nobody followed up, and the system was still unpatched in July 2017, when the team spotted suspicious traffic.

The breach affected about 147 million people. Equifax agreed to pay at least $575 million, and potentially up to $700 million, in a settlement with the FTC, the CFPB and US states and territories (FTC, 22 July 2019).

Your site isn't Equifax, but small sites fail the same way. Someone decides to patch and nobody checks it happened. The 261,800 File Manager sites still on vulnerable versions are the same failure at scale, and GitLab is the backup version. We wrote about the checking half in The patch that broke the guard: patch, then prove the control still works.

How our website maintenance services compare

Our website and application maintenance retainer starts from $350 per site or app, per month, for custom applications, PHP sites and CMS sites. That's more than the entry WordPress plans and close to the top WordPress tier.

It covers security patches and dependency or plugin updates, runtime upgrades on a date we pick with you, backup checks with a restore test on a schedule, an uptime and certificate watch if you don't already buy monitoring, and small copy and layout fixes. Application work sits on the same retainer: bug fixes against a ticket, performance work, API and library upgrades, and features that fit in a day or two. When a change is too big for the retainer, we say so and it gets its own build ticket.

System size and the support hours you need decide where you land above $350:

• Standard: business hours, next-business-day response.
• Premium: longer hours, same-day response.
• Enterprise: 24/7, with a 1-hour target on critical outages.

If you only need someone watching, our managed security and website monitoring starts from $250 per monitored system, per month. It covers uptime checks, SSL/TLS and domain expiry, host resources, backup job success and a weekly written report. Both are US dollar starting prices on our pricing page.

For a five-page WordPress site with a handful of plugins, a $39 automated plan may be all you need. We'd rather you bought that than paid us for work your site doesn't have.

FAQ

How much does website maintenance cost per month?

From close to $0 for DIY to a few hundred dollars for a managed plan. Paid WordPress care plans ran from $39 to $359 a month on 23 October 2026; shops and custom apps sit at the top of that range or above it.

Is hosting the same as website maintenance?

No. Hosting keeps the server online. Maintenance looks after what runs on it: updates, backups and restore tests, monitoring and small fixes. Some hosts bundle parts of it, so read what the plan lists.

Does WordPress update itself?

Partly. Minor and security core releases install in the background on most sites, but major releases need a click, and plugins, themes and PHP need their own updates. Someone still has to check the site works afterwards.

How often should you test a backup restore?

On a written schedule, and again whenever the hosting, the database version or the backup tool changes. GitLab's 2017 backups broke on a database version change, and nobody noticed because nobody owned the test.

Do custom web apps cost more to maintain than WordPress sites?

Usually, yes. Nobody ships plugin-style fixes for a custom app, so a developer has to upgrade, test and redeploy it, and that's paid developer time every month.

Want a number for your site?

Send the details through our website maintenance services page, or book a free 30-minute assessment. Tell us the stack and how fast you need a response, and we'll tell you which tier fits, even when the answer is a cheaper automated plan somewhere else.

How this guide was made: Ramin Moradi researched and wrote it with AI assistance. Every price and quote was checked against its linked source on 23 October 2026. Prices change, so check each source for the current figure.

Sources

1. GoWP, "Pricing". https://gowp.com/pricing/ (read 23 Oct 2026)
2. WP Buffs, "WordPress Care Plans & Maintenance Packages". https://wpbuffs.com/plans/ (read 23 Oct 2026)
3. ALT Agency, "How Much Does Website Maintenance Cost?". https://www.altagency.co.uk/blog/website-maintenance-cost-what-businesses-should-expect-to-pay/ (read 23 Oct 2026)
4. WordPress.org Documentation, "Updating WordPress". https://wordpress.org/documentation/article/updating-wordpress/ (read 23 Oct 2026)
5. GitLab, "Postmortem of database outage of January 31", 10 Feb 2017. https://about.gitlab.com/blog/postmortem-of-database-outage-of-january-31/
6. UptimeRobot, "Pricing". https://uptimerobot.com/pricing/ (read 23 Oct 2026)
7. Let's Encrypt, home page. https://letsencrypt.org/ (read 23 Oct 2026)
8. Let's Encrypt, "Decreasing Certificate Lifetimes to 45 Days", 2 Dec 2025. https://letsencrypt.org/2025/12/02/from-90-to-45
9. Wordfence, "Millions of Sites Targeted in File Manager Vulnerability Attacks", 4 Sep 2020. https://www.wordfence.com/blog/2020/09/millions-of-sites-targeted-in-file-manager-vulnerability-attacks/
10. US Bureau of Labor Statistics, Occupational Outlook Handbook, "Web Developers and Digital Designers". https://www.bls.gov/ooh/computer-and-information-technology/web-developers.htm (read 23 Oct 2026)
11. US Federal Trade Commission, "Equifax to Pay $575 Million as Part of Settlement with FTC, CFPB, and States Related to 2017 Data Breach", 22 Jul 2019. https://www.ftc.gov/news-events/news/press-releases/2019/07/equifax-pay-575-million-part-settlement-ftc-cfpb-states-related-2017-data-breach