Website maintenance is easy to skip because nothing visible happens when it is done well. The site looks the same on Tuesday as it did on Monday. What changed is underneath: software patched before an exploit circulated, a backup verified before it was needed, a failing form caught before a month of leads vanished. This article covers what a real maintenance plan includes, what fair pricing looks like, and what the skip-it strategy tends to cost.
Quick answer: Website maintenance covers software updates, offsite backups, security and uptime monitoring, and a set amount of fix or change time each month. Plans for a business WordPress site typically run $100 to $500 per month, more with e-commerce. The alternative is paying for emergencies at hourly rates, plus the downtime while you find someone.
What does maintenance include?
A real plan covers five things:
- Updates on a schedule: WordPress core, plugins, and the theme, applied with a check afterward rather than blind auto-updating, because updates sometimes break layouts and checkouts.
- Backups stored offsite, on a schedule matched to how often the site changes, with restores tested occasionally. An untested backup is a hope.
- Security: malware scanning, login protection, and monitoring for file changes, plus a response process when something fires.
- Uptime and function monitoring, ideally including the things that matter commercially, like whether the contact form still delivers.
- A block of time each month for small fixes and changes, so minor requests get handled instead of queued into a project.
What should it cost?
Market ranges for 2026, to adjust against your own pricing:
- A brochure site (pages, a form, a blog): $75 to $200 per month.
- A business site with more moving parts, integrations, or frequent content changes: $150 to $400.
- A WooCommerce or other e-commerce site, where updates can break checkout and downtime costs revenue: $300 to $800 and up.
The spread within each tier is mostly response time and included hours. A plan with same-day emergency response and three included hours costs more than quarterly updates with none, and should.
What happens without maintenance?
The failure is rarely gradual. Sites run fine on outdated software right up until they do not. The malware campaign we cleaned up this spring, documented in our mu-plugins malware guide, spread through exactly the gap maintenance closes: outdated software and unrotated credentials, on sites nobody was watching. The other common endings are a PHP upgrade at the host that breaks an old theme overnight, and the discovery, mid-crisis, that the backups everyone assumed existed were never running.
What should the monthly report show?
Plain evidence, briefly: updates applied and anything held back with a reason, backup status with the latest restore point, uptime percentage, security scan results, and the hours used against your included time with what they went to. If your current provider cannot produce this, you are buying a subscription, and possibly a service.
How do you evaluate a provider?
- Response terms in writing: how fast for an emergency, how fast for a normal request.
- Proof they test restores, since the backup is the whole safety net.
- Credentials held in your accounts, with you as owner. Our guide on outgrowing a web developer covers why this matters more than any other term.
- Clear scope boundaries: what counts as maintenance, what becomes a quoted project.
- Month-to-month billing. Confidence in the service beats a lock-in clause.
Is doing it yourself realistic?
Yes, with discipline. The checklist is learnable: weekly updates with a post-update check, a verified offsite backup, a security scanner someone reviews, and a calendar reminder honored even in busy months. The honest cost is attention and judgment, particularly the judgment call when an update breaks something at 4pm. Most owners who start DIY stop within a year, and the stopping is silent, which is the risk. If you want it handled instead, ask about a plan through the contact form.
Frequently asked questions
Is maintenance the same thing as hosting?
No. Hosting keeps the server running. Maintenance keeps the software on it current, backed up, and secure. Managed WordPress hosts cover a slice (core updates, server backups), and leave plugins, the theme, monitoring, and fixes to you.
Can automatic updates handle this for free?
Partially. Auto-updates apply patches, and they also apply the update that breaks your checkout at 2am with nobody checking. They do not back up, monitor, test, or fix. Reasonable for a low-stakes site, thin coverage for one that produces revenue or leads.
What about sites built with page builders?
They need maintenance more, since the builder and its addons update on their own cycles and visual regressions are common. A plan for a builder-based site should include an after-update visual check of key pages.
Does a small brochure site need this?
A lighter plan, yes. It runs the same software with the same vulnerabilities as a big site, and an out-of-date small site gets hacked by the same automated campaigns. Monthly updates, a backup, and a scanner is a modest cost for not being an easy target.
What is an SLA and do I need one?
A service level agreement defines response and resolution targets, like emergencies acknowledged within two hours. For a site that makes money, you want at least the emergency response time in writing, whatever the document is called.
My developer disappeared and nothing has been updated for a year. Now what?
Recover access first: hosting, then the domain registrar, then WordPress admin, in whatever order you can manage. Then have someone audit before mass-updating, since a year of pending updates can break things in a cascade. This is a common starting point for us, and it is recoverable.