What you are actually buying
Website maintenance means two different things: keeping the site working as its dependencies change, and making small changes on request. They are priced together and worth separating in your mind.
The first is non-optional for any site running software that receives security updates. The second is convenience.
What a plan should include
- Core, theme and plugin updates applied on a schedule, with a check afterwards that nothing broke
- Backups taken automatically, held off the server, with a restore tested at least annually
- Uptime monitoring that alerts a human, not a dashboard
- Certificate expiry monitoring, because it is entirely predictable and still takes sites down
- Security patching and a response commitment if something is exploited
- A defined allowance of small changes, with what counts as small written down
- A monthly report of what was done
Typical costs
| Site type | Monthly | What it covers |
|---|---|---|
| Small brochure site | £50–£150 | Updates, backups, monitoring |
| Business site with CMS | £150–£400 | The above plus a small change allowance |
| eCommerce | £300–£800 | The above plus payment and integration checks |
| Web application | 15–25% of build annually | Dependencies, security, defect fixes |
Signs you are paying for nothing
Ask for the last three monthly reports and the date of the last tested restore. If neither exists, you have a retainer for availability rather than a maintenance service — which may still be worth something, but you should know which you are buying.
- No report of what was done, ever
- Updates applied without any check that the site still works
- Backups that exist and have never been restored
- “Included changes” that always turn out to be extra
What is reasonable to expect included
Text and image changes, adding a page from an existing template, updating contact details, publishing a post. Not: new page templates, new functionality, redesigns or integration work.
Get the boundary written down with examples. Almost every maintenance dispute is about which side of that line a request sits on.
If you have no plan at all
The realistic risk is not that the site breaks tomorrow. It is that eighteen months of missed updates turn a routine task into a project, or that an exploited vulnerability turns it into an incident.
At minimum, arrange updates and verified backups. Everything else is refinement.