Website Maintenance Services for Small Business

We have a maintenance department looking after sites from single-page brochures to large multi-page builds. The plan scales; the monitoring and backup discipline does not change.

Updated September 2026 · Written and maintained by the Progression Agency strategy team

Hosting keeps your site online. Maintenance keeps it working, secure and current. Website management services do both and add the content changes and reporting that stop a site quietly decaying. Most disputes in this category come from buying one and expecting another. This page separates the three, publishes the price bands, sets out exactly what belongs in a plan, and explains the four expensive failures maintenance actually prevents — plus the ownership terms that decide whether leaving is simple or painful.

The short answerWebsite maintenance typically costs $75 to $2,500 a month depending on scope, with most small business sites well served between $150 and $400. Choose the band by what a day of downtime costs you, not by how many pages you have. A plan is worth buying if it includes tested restores, uptime and error monitoring, security patching, a stated response time and a named human to reach. And whatever you pay, every account — hosting, domain, DNS, CMS admin, analytics — should be in your name, not your provider’s.

Website maintenance, in five facts — Most maintenance disputes come from one confusion: hosting keeps the site online, maintenance keeps it working, secure and current. They are different products and frequently different suppliers.

Hosting, website maintenance and website management services are three different products

Answer first: hosting is a server. Website maintenance is the ongoing work that keeps the software on that server updated, secure, backed up and monitored. Website management services are broader still — maintenance plus content changes, performance work and reporting, with someone taking a degree of ownership over how the site actually performs.

Hosting, maintenance and website management compared — Website management services is the broadest of the three: maintenance plus content changes plus reporting and a degree of ownership over how the site performs. Buying hosting and expecting the third column is the most common mismatch in this market.

Hosting — Keeps it online. A server, and little else.

Maintenance — Keeps it working. Updates, backups, security, monitoring.

Management — Keeps it improving. Maintenance plus content and reporting.

Support — Fixes what breaks. Reactive, not preventive.

Development — Builds new things. A separate budget entirely.

Confusing — Why buyers overpay. Or buy one and expect another.

What each product actually covers
Responsibility	Hosting	Website maintenance	Website management services
Server uptime and infrastructure	Yes	Sometimes	Sometimes
Core, theme and plugin updates	No	Yes	Yes
Off-site backups	Sometimes, untested	Yes, tested	Yes, tested
Uptime and error monitoring	Basic	Yes	Yes
Security patching and malware response	Limited	Yes	Yes
Fixing things that break	No	Yes	Yes
Content changes and new pages	No	Limited allowance	Yes
Speed and technical SEO upkeep	No	Sometimes	Yes
Monthly reporting	No	Sometimes	Yes
Recommending what to change next	No	No	Yes

The conclusion: if you have been paying for hosting and wondering why nobody updated anything, that is not a failure of service — it is a purchase of the wrong product. Read the columns against what you assumed you were buying.

What website maintenance and website management services cost

Answer first: $75 to $2,500 a month. Most small business sites are well served between $150 and $400. Website management services, being broader, typically start where maintenance-only plans top out — around $500 and up.

What website maintenance costs monthly — The band you need is set by what a day of downtime costs you, not by how many pages you have. That is the single most useful reframing in this whole category.

$95 — Essential plan. Updates and backups, small brochure site.

$275 — Standard plan. Plus monitoring and fixes; most small businesses.

$650 — Managed plan. Plus content changes and monthly reporting.

$1,400 — Business critical. Response-time commitment, revenue depends on uptime.

$2,500 — Ecommerce or enterprise. Transactions, integrations, compliance.

Ask — Is hosting included?. The most common source of a surprise bill.

Maintenance and management bands, and what each honestly buys
Band	Monthly	Includes	Fits	Does not fit
Essential maintenance	$75 – $150	Updates, backups, basic monitoring	Brochure site, rarely changes	Anything that takes payments
Standard maintenance	$150 – $400	Plus fixes, security, uptime alerts	Most small business sites	Frequent content change
Website management	$400 – $900	Plus content changes and reporting	Sites that change monthly	Complex integrations
Business critical	$900 – $1,800	Plus stated response times	Revenue depends on uptime	Enterprise compliance needs
Ecommerce or enterprise	$1,800 – $2,500+	Transactions, integrations, compliance	Stores and portals	Small brochure sites

Why price should follow downtime cost, not page count

A ten-page site that takes bookings all day is worth more maintenance than a fifty-page brochure site nobody transacts on. Work out roughly what a full day offline costs you in lost inquiries or orders. If it is more than a month of the higher plan, buy the higher plan. That single calculation settles most of these decisions in five minutes.

What is usually not included, and should be quoted separately

New pages and design work. A maintenance plan covers keeping what exists working, not building what does not.
Platform migrations. Moving hosts or rebuilding on a new CMS is a project.
Emergency recovery from a compromise that predates the engagement.
Third-party licenses. Premium plugins, themes and apps are usually billed at cost.
Content writing and photography. Loading content is maintenance; producing it is not.

What belongs in a maintenance plan, and what is filler

What belongs in a website maintenance plan — Four of these ten are the ones that actually matter in an emergency: tested restores, monitoring, a stated response time, and accounts you own. The rest is hygiene.

Restore — Test it, do not assume. An untested backup is a hope.

Off-site — Not the same server. A compromised server takes its backups with it.

Staging — Update there first. Production is not a test environment.

Monitor — Uptime and errors. And route the alert to a human.

Forms — Test monthly. Silent form failure is the classic invisible loss.

Report — One page a month. Evidence the work happened.

The five things that genuinely matter

Backups that have been restored. Not backups that exist — backups somebody has actually restored somewhere to prove they work. Ask when the last test restore was.
Off-site storage. A backup on the same server disappears with the server. This is not a hypothetical; it is the normal outcome of a serious compromise.
Monitoring with alerting to a human. A dashboard nobody watches is not monitoring.
A stated response time. Not a promise to respond quickly — a number, and the hours it applies in.
A named person. When the site is down you want a human, not a ticket queue and a four-hour first response.

The phrases that should make you ask a follow-up question

“Unlimited edits.” Unlimited by whose definition, at what turnaround, and what counts as an edit rather than a build? Undefined scope suits nobody in the long run.
“Daily backups.” Stored where, retained how long, and restored when last?
“24/7 monitoring.” Monitoring what, alerting whom, and what happens at 3am?
“Security included.” Meaning a firewall plugin, or meaning somebody responds when something is found?
“We handle everything.” Then it should be trivial to list what is excluded. Ask for that list.

The four expensive failures maintenance actually prevents

Answer first: a compromised site, data loss with no working backup, extended downtime, and silent failures such as a contact form that stopped sending. The last is the cheapest to prevent and the most commonly missed.

What maintenance actually prevents, by cost of the failure — The silent failures are the expensive ones. A form that stopped sending is invisible until somebody notices the phone stopped ringing, which is usually weeks.

$6,500 — Compromise and blacklisting. Cleanup, review request, lost traffic.

$4,200 — Data loss, no working backup. Rebuild from whatever survives.

$2,800 — Outage during a campaign. Wasted media plus lost inquiries.

$2,400 — Broken checkout unnoticed. Lost orders nobody counted.

$900 — Fatal error after an update. Emergency developer time.

$600 — Contact form silently failing. Inquiries that never arrived.

Compromise and blacklisting

An out-of-date plugin is the usual entry point. The direct cost is cleanup; the larger cost is being flagged in search results and browser warnings while you wait for a review. Sites that were current on updates are not immune, but they are dramatically less likely to be the easy target.

Data loss

The failure mode is almost never “we had no backups”. It is “the backups were on the same server”, or “nobody had ever restored one”. Both are discovered at the worst possible moment.

Downtime during a campaign

Paid media pointed at an unreachable site spends at full rate and returns nothing. If you run ads, a monitoring and response clause is not a luxury — it is the cheapest insurance on the media budget.

Silent failures

A contact form that stops delivering, a checkout step that errors on one browser, a booking widget that silently fails after a plugin update. Nobody reports these because the person affected simply leaves. A monthly form test costs minutes and catches the most expensive of them.

SEO — Maintenance protects it. Downtime and errors cost rankings.

Speed — Degrades quietly. Plugins accumulate; nobody notices.

Links — Break over time. Internal and outbound both.

Images — Bloat the page. Uncompressed uploads are the usual cause.

Schema — Breaks on updates. Validate after major changes.

Console — Watch it. Search Console reports what you cannot see.

New pages — Not maintenance. Building is a separate budget.

Migrations — Not maintenance. Moving host or CMS is a project.

Old hacks — Quoted separately. A compromise predating the engagement.

Licenses — Usually at cost. Premium plugins, themes and apps.

Content — Loading yes, writing no. Producing content is not maintenance.

Design — A separate engagement. Keeping what exists working is the plan.

Taking over a site nobody has maintained

Answer first: the first month on an inherited site is audit, secure, back up, stage, update and document — not routine maintenance. It should be quoted as onboarding, and an agency that offers to absorb it at the standard monthly rate is either underestimating it or planning not to do it.

Audit — First step on any takeover. Versions, vulnerabilities, backups, accounts, DNS.

Rotate — Credentials on day one. And remove every stale user.

Prove — The backup restores. Somewhere other than production.

Stage — Before touching live. Production is not a test environment.

Batch — Updates in small groups. So a failure is traceable.

Write — It all down. What was found, fixed, and still outstanding.

What the audit should produce, in writing

Platform and version, including the server-side language version and whether it is still supported.
Every plugin, theme and app with its version, last-updated date and whether it is abandoned.
Known vulnerabilities present today.
Where backups currently live, how far back they go, and whether a restore has ever been tested.
Every account and who controls it: hosting, domain, DNS, CMS, email, analytics, payment.
Anything customized in a way that will break on update.
A prioritized list of what to fix, with what is urgent separated from what is merely overdue.

WordPress maintenance specifically

Answer first: WordPress needs core, theme and plugin updates on a regular cadence, applied on staging first, with the server-side language version kept current. The main risk surface is plugins, and the main risk within plugins is abandonment rather than age.

WordPress — Most common platform. Core, theme and plugin updates, monthly minimum.

Plugins — The main risk surface. Abandoned plugins are the usual vulnerability.

PHP — Version matters. An unsupported version stops receiving fixes.

Themes — Update carefully. A child theme protects your customizations.

Shopify — Hosted, still needs work. Apps, themes, checkout and speed.

Static — Lowest maintenance. But not zero: forms, DNS, certificates.

Audit plugins by last-updated date, not count. A plugin last touched three years ago is a liability whatever its rating.
Use a child theme. Customizations written into a parent theme are erased by its next update, which is how sites suddenly look wrong.
Keep the PHP version supported. An unsupported version stops receiving security fixes, and the hosting provider will eventually force the upgrade at a moment you did not choose.
Test on staging. Production is not a test environment, and “it usually works” is not a plan.
Watch what the page builder adds. Builders accumulate assets and slow sites over time; a periodic speed check catches it.

Shopify and hosted platforms

Hosted platforms handle server and core updates for you, which removes the largest category of risk. What remains is real: app updates and abandoned apps, theme updates that overwrite customizations, checkout testing, speed as apps accumulate, and keeping the content current. Maintenance on a hosted platform costs less and is not zero.

Uptime — Monitored and alerted. The baseline of any real plan.

Errors — Server errors matter. 5xx responses cost visibility.

SSL — Certificates expire. Renewal should be automatic and watched.

DNS — Rarely touched, critical. Know who can change it.

Email — Deliverability decays. SPF, DKIM and DMARC drift.

Forms — Test them monthly. The classic invisible loss.

Maintenance and your search rankings

Answer first: maintenance protects rankings rather than improving them, and the protection is worth more than most people expect. Downtime, server errors, broken links and gradual speed decay all cost visibility, and all of them are preventable.

Downtime and 5xx errors are visible to search engines and repeated outages affect crawling.
Speed degrades quietly. Plugins, uncompressed images and accumulated scripts add up until a site that felt fast at launch is slow two years later.
Links break. Internal links to deleted pages and outbound links to dead sites both accumulate.
Structured data breaks on updates. Validate after any significant platform change.
Search Console is the early warning system. It is free, and most maintained sites still do not have anyone reading it monthly.

More on the underlying work in when a redesign is justified and what SEO services cover.

What a maintained month actually looks like

Weekly — Update cadence for most. Monthly is acceptable on simple sites.

Daily — Backups for active sites. Weekly only if nothing changes.

Monthly — Security review. And a form test while you are there.

Quarterly — Speed and link check. Plus a plugin audit.

Annually — Full review. Platform, plan, and whether it still fits.

Always — Alerting on failure. Automated, routed to a person.

If you cannot tell what your provider did last month, that is the problem — not the price. A one-page monthly report listing what was updated, what broke, what was fixed and what is coming is the minimum evidence that the work happened.

Daily — Backups on active sites. Weekly only if nothing changes.

Weekly — Updates for most sites. Monthly at minimum for simple ones.

Monthly — Security review and form test. The cheapest catch available.

Quarterly — Speed, links and plugin audit. Where slow decay gets caught.

Annually — Full platform review. Does the plan still fit the site?.

On failure — Alert a human. Not a dashboard nobody opens.

Ownership: the part that decides whether leaving is simple

Answer first: every account should be in your name. Hosting, domain, DNS, CMS admin, analytics, and the backups themselves. An agency should have access to your accounts; it should not own them.

Own — Your hosting account. In your name, your card, your email.

Own — Your domain and DNS. The most common hostage in a bad exit.

Own — Your CMS admin. An admin account you control.

Own — Your analytics. Property yours, agency granted access.

Own — Your backups. Downloadable, in a location you can reach.

Exit — Thirty days notice. With a stated handover obligation.

Who should hold what
Asset	Should be in	Why it matters	Common bad practice
Domain registration	Your name and billing	It is the single hardest thing to recover	Registered on the agency’s account
DNS control	Your registrar account	Everything routes through it	Managed somewhere you cannot see
Hosting account	Your name and card	You can move or renew without permission	Resold to you under their account
CMS admin	An admin account you control	You can grant and revoke access	Only the agency has admin
Analytics property	Your account	Historical data is not portable later	Created under the agency’s property
Backups	A location you can reach	A backup you cannot download is not yours	Held only in the agency’s tooling
Premium licenses	Your name where possible	They stop working when the relationship ends	Bundled invisibly into the retainer

The exit terms, in one paragraph

Thirty days notice after a defined initial term. On exit you receive a full site export including files and database, a copy of the most recent backup, documentation of the environment, and a list of every license and where it sits. Nothing should need to be requested twice, and no account should require a password reset argument.

Unlimited — Define it or refuse it. 'Unlimited edits' means undefined scope.

SLA — Ask for the number. What response time, in what hours?.

Hours — What counts as included?. And what triggers an extra invoice.

Escalation — Who do I call at 2am?. If the answer is a form, know that now.

Cancel — What do I get?. Files, database, documentation, in what format.

Lock — Watch for platform lock-in. Proprietary builders are hard to leave.

Which arrangement fits which site

Which maintenance arrangement fits which site — Move up the vertical axis and the response-time clause matters more than anything else in the contract. Move right and you need someone who can read the code, not only run the updates.

Choosing a maintenance arrangement
Your site	Suggested band	The clause that matters most	Cadence
Brochure, rarely changes	Essential	Backups and updates	Monthly updates, weekly backups
Small business with forms	Standard	Form testing and monitoring	Weekly updates, daily backups
Content-heavy marketing site	Website management	Content allowance and reporting	Weekly updates, daily backups
Booking or scheduling	Business critical	Response time	Weekly updates, daily backups
Ecommerce	Ecommerce plan	Checkout testing and response time	Weekly updates, daily backups
Membership or portal	Enterprise	Access control and data handling	Weekly updates, daily backups

Doing it yourself, and when that is reasonable

Answer first: a simple site with no transactions can reasonably be maintained in-house if somebody will genuinely do it every month. The failure mode is not incompetence; it is that maintenance is nobody’s actual job and it quietly stops happening.

Diarise a recurring monthly slot and treat it as an appointment.
Take a full backup, off-site, before touching anything.
Update on a staging copy where the platform allows it.
Apply updates in small batches so a failure is traceable.
Test the contact form, the phone link and one key page on a real phone afterwards.
Check Search Console for new errors.
Write down what you did. Future you will need it.

If two consecutive months get missed, that is the signal to buy a plan. It is not a failure of discipline; it is what happens to every task that has no owner.

Report — One page a month. What changed, broke, was fixed, is next.

Evidence — Not reassurance. 'All good' is not a report.

Restore — Ask for the date. When was a restore last tested?.

Exclusions — Ask for the list. If everything is included it is short.

Escalate — Who at 3am?. Know the answer before you need it.

Review — Annually, honestly. Right band, right provider, right platform.

Questions to ask any maintenance or website management provider

What exactly is included, and can I see the exclusions list?
Where are backups stored, how long are they retained, and when was a restore last tested?
What do you monitor, and who receives the alert?
What is your response time for an outage, and in what hours?
Who is my named contact, and what happens when they are away?
Is hosting included, or billed separately?
What counts as an included content change, and what triggers an extra invoice?
Which accounts will be in my name?
What do I receive if I cancel, and in what format?
Can you take over a site you did not build, and what does onboarding cost?

Domain and DNS — Own. The hardest thing to recover.

Hosting account — Own. Your name, your card.

CMS admin — Own. An admin account you control.

Analytics property — Own. Historical data is not portable later.

Your backups — Own. Downloadable, somewhere you can reach.

Your licenses — Own. They stop working when the relationship ends.

Hosting WordPress on AWS, and choosing a maintenance provider

Two questions arrive together: where the site should live, and who keeps it running.

WordPress on AWS

WordPress on AWS is a real option and a poor default. Hosting WordPress on AWS cost is genuinely low at the infrastructure layer — AWS WordPress hosting cost for a small site can be a few dollars a month — but WordPress AWS hosting cost and WordPress hosting AWS cost calculations routinely omit the part that matters: somebody has to patch, back up, monitor and restore it. Managed WordPress hosting costs more per month and less per year once that labor is counted. Choose AWS when you have the engineering capacity; choose managed hosting when you do not.

Choosing among website maintenance companies

Best website maintenance companies are the ones that publish what is included and what is not. The questions that separate them: what the backup restore time actually is, whether plugin updates are tested before they are applied, who is on call, and what happens when the site is down at 2am. A plan that lists updates and uptime but names no response time is selling reassurance rather than maintenance.

Is website maintenance worth it?

Answer first: for any site that takes inquiries or payments, yes — the arithmetic is not close. For a static brochure site that produces nothing, a cheap plan or disciplined self-maintenance is defensible. The honest test is what a compromised or offline site would cost you, multiplied by how likely that is over three years.

The arithmetic, plainly
	Maintained	Unmaintained
Annual cost	$900 – $4,800	$0
Likelihood of a serious incident over 3 years	Low	Materially higher
Typical recovery cost of one compromise	Covered or reduced	$2,000 – $6,500
Silent form failure	Caught within weeks	Caught when revenue drops
Speed over three years	Monitored	Degrades unnoticed
Time you spend on it	Near zero	Unpredictable, at the worst moment

Updated August 2026. The price bands on this page are typical United States market ranges stated as ranges; specific quotes depend on platform, complexity and response-time commitments. The failure-cost figures are indicative recovery costs for a small business site and are labeled as estimates, not measurements.

Want an honest read on your current plan?

Send us what you are paying and what it includes. We will tell you whether it is the right band, what is missing, and whether the accounts are actually in your name — before any proposal.

Get in touch

Getting found in search

AI, AEO and what is changing

Paid media and lead generation

Websites and design

Choosing and working with an agency

Social, content and brand

By industry and by situation

The Google Workspace admin console

Where account-level settings actually live.

The Google apps administrator console, now the Google Workspace Admin console, is at admin.google.com and is where an organization manages users, groups, devices, security settings, domains and app access. It is a different place from any individual user’s settings, which is the source of most confusion when a business owner cannot find a control.

Admin Google for work access should be held by more than one person and by as few as possible — a super administrator can add and remove anyone, including other administrators. For agency access, create a named user with a delegated role scoped to what they need rather than sharing the super admin login, which removes the audit trail and breaks the moment two-step verification is enforced.

Choosing a maintenance provider

What separates the offers behind an identical-looking phrase.

Best website maintenance service and best website maintenance company searches return offers that look interchangeable and are not. The scope worth buying is specific: core, theme and plugin updates on a stated cadence; backups that are tested, with a stated restore time; uptime monitoring with a stated response; security scanning; and a monthly allowance of small changes with a defined turnaround.

The number that actually separates providers is the restore time, not the backup frequency. Hourly backups are meaningless if restoring one takes three days and requires a support ticket. Ask what happens at two in the morning on a Sunday, and ask for the answer in hours.

The second question is who does the work. A great deal of maintenance is resold, which is not a problem in itself and does mean the response time you are quoted is somebody else’s. A provider that will name its escalation path is worth more than one quoting a lower monthly fee.

Maintenance depends on the platform and the hosting underneath it. See WordPress maintenance services for WordPress-specific plans, website security services and website speed optimization for the two problems maintenance most often uncovers, and the WordPress hosting guide and hosting types compared for the hosting layer.

Website hosting for small business: the setup that makes maintenance easier.
Website migration services: moving off hosting that causes the problems.
DevOps services: maintenance for web applications rather than sites.
Website development cost: including ongoing costs.

Also on this site: Websites for Accountants.

Frequently asked questions

How much does website maintenance cost?

Typically $75 to $2,500 a month depending on scope. Most small business sites are well served between $150 and $400. Choose the band by what a day of downtime costs you rather than by how many pages you have — a ten-page booking site needs more than a fifty-page brochure site.

What are website management services?

Broader than maintenance. Website management services cover the maintenance work — updates, backups, security, monitoring — and add content changes, performance work, reporting and a degree of ownership over how the site performs. They typically start around $400 to $500 a month, where maintenance-only plans top out.

What is the difference between hosting and website maintenance?

Hosting is a server that keeps the site reachable. Maintenance is the ongoing work that keeps the software on it updated, secure, backed up and monitored. Buying hosting and expecting maintenance is the single most common mismatch in this category, and it is why sites go years without an update.

What should a website maintenance plan include?

Core, theme and plugin updates applied on staging and tested; off-site backups with a tested restore; uptime and error monitoring that alerts a human; security patching and malware scanning; a stated response time for outages; and a named person you can reach. Anything beyond that is useful; anything missing from that is a gap.

What is the average cost of website maintenance for a small business?

Most small businesses land between $150 and $400 a month for a standard plan covering updates, backups, monitoring, security and small fixes. Below about $75 a month you are usually buying automated updates with nobody checking whether they broke anything.

Do I need maintenance if my site never changes?

Yes, because the site is not the only thing that changes. The platform, its plugins, the server language version and the security landscape all move whether you touch the site or not. A static site left alone for two years is typically the easiest target on a hosting server.

How often should a website be updated?

Weekly for most business sites, monthly at minimum for simple ones. Backups daily where content or orders change, weekly if nothing does. A security review monthly, a speed and link check quarterly, and a full platform review annually.

What happens if I cancel my maintenance plan?

You should receive a full export of files and database, a copy of the most recent backup, documentation of the environment and a list of every license and where it sits — with thirty days notice after a defined initial term. Ask for this in writing before you sign, not when you leave.

Can you maintain a site you did not build?

Usually yes, but the first month is not routine work. It is an audit, a security pass, a proven backup, a staging copy, batched updates and written documentation. That onboarding should be quoted separately; a provider absorbing it into the standard monthly rate is either underestimating it or planning not to do it.

Is website maintenance worth it, honestly?

For any site that takes inquiries or payments, the arithmetic is not close — one compromise typically costs several years of a standard plan. For a static brochure site producing nothing, a cheap plan or genuinely disciplined self-maintenance is defensible. The failure mode of self-maintenance is not incompetence; it is that the task has no owner and quietly stops happening.

What is the most common maintenance failure?

Backups that exist but have never been restored, and backups stored on the same server as the site. Both are discovered at the worst possible moment. Ask your provider when a test restore was last performed; if the answer is vague, that is your answer.

What is a silent failure and why does it matter?

A failure nobody reports: a contact form that stops delivering, a booking widget that errors after a plugin update, a checkout step that breaks in one browser. The affected person simply leaves, so the first symptom is revenue dropping weeks later. A monthly form test catches most of them in minutes.

Does maintenance help my SEO?

It protects rankings rather than improving them, and the protection is worth more than most people expect. Downtime, server errors, broken links, degraded speed and structured data breaking after updates all cost visibility, and all are preventable. Reading Search Console monthly is the cheapest early warning available.

What does WordPress maintenance involve specifically?

Core, theme and plugin updates on a regular cadence, applied on staging first; keeping the PHP version supported; auditing plugins by last-updated date rather than count; using a child theme so customizations survive updates; and watching what the page builder accumulates over time.

Do Shopify or other hosted platforms need maintenance?

Less, and not none. The platform handles server and core updates, which removes the largest risk. What remains is app updates and abandoned apps, theme updates that overwrite customizations, checkout testing, speed as apps accumulate, and keeping content current.

Should hosting be included in the maintenance plan?

Either is fine, but know which. Bundled hosting is simpler and can make leaving harder; separate hosting in your own name is more portable and one more thing to manage. The important part is that the account is in your name whichever way it is billed.

What response time should I expect for an outage?

It depends on the band you bought, which is exactly why it should be a number in the contract rather than a promise to respond quickly. Standard plans commonly commit to same-business-day; business critical plans commit to a stated number of hours including out of hours. If no number is offered, assume there is no commitment.

Who should own my domain and hosting accounts?

You. Domain and DNS in your own registrar account is the single most important line in any arrangement — it is the hardest thing to recover in a bad separation. Hosting, CMS admin, analytics and backups should equally be in your name with the provider granted access.

Can I do website maintenance myself?

For a simple site with no transactions, yes, if someone will genuinely do it monthly: full off-site backup first, updates in small batches on staging where possible, test the forms and a key page on a real phone afterwards, check Search Console, write down what you did. If two consecutive months get missed, buy a plan.

What is not included in a typical maintenance plan?

New pages and design work, platform migrations, recovery from a compromise that predates the engagement, third-party premium licenses, and content writing or photography. Loading content is maintenance; producing it is not.

How do I know my provider is actually doing the work?

Ask for a one-page monthly report: what was updated, what broke, what was fixed and what is coming. If you cannot tell what happened last month, that is the problem rather than the price. Also ask when the last test restore was — the answer is diagnostic.

What does ‘unlimited edits’ actually mean?

Usually that the scope was never defined. Ask what counts as an edit rather than a build, what the turnaround is, and what happens in a busy month. Undefined scope suits nobody: it ends either in an exhausted supplier or in a conversation about extra fees.

How much does it cost to fix a hacked website?

Typically a few thousand dollars for cleanup on a small business site, plus the harder-to-price cost of being flagged in search results and browser warnings while a review is pending. That is why the backup and update disciplines matter more than any single feature in a plan.

Should a business-critical site have a service level agreement?

If revenue depends on uptime, yes. What matters is that it names a response time, the hours it applies in, an escalation path with a human at the end of it, and what happens if the commitment is missed. An SLA without a consequence is a statement of intent.

The short answerA website maintenance service keeps a live site secure, updated, backed up and working: core and plugin updates, security patching, off-site backups, uptime monitoring, broken-link and form checks, and a person who fixes things when they break. Most small-business sites need a few hours a month; most plans that cost nothing deliver nothing.

What does a website maintenance service actually include?

A website maintenance service covers five things: keeping software current, keeping the site secure, keeping a restorable backup, watching that it stays up, and fixing what breaks. Everything else sold under the name is an add-on.

The reason to separate those five from the add-ons is that the five are the ones that cost you money when they are missing. A site that has not been updated in a year is not slightly out of date; it is running known vulnerabilities that are published and scanned for. A site without a tested backup is one bad plugin update away from being gone. Content edits, design tweaks and SEO work are all legitimate services, but they are not maintenance, and bundling them together is how a plan ends up costing a lot while covering little.

Updates

Core, theme and plugin updates applied on a schedule, on a staging copy first where the site is complex enough to justify it, with a rollback path if an update breaks something.

Security

Patching, hardening, login protection and malware scanning. The point is not to make a site unhackable; it is to stay off the list of sites that are trivially exploitable.

Backups

Off-site, automated, and restored at least once to prove they work. A backup nobody has restored is a hypothesis, not a backup.

Monitoring

Uptime checks, so you learn the site is down from your provider rather than from a customer, plus checks that forms still submit and links still resolve.

Fixes

A named route to a person when something breaks, with a stated response time. This is the part people are actually buying.

How much does website maintenance cost?

For a small business site, expect a monthly plan in the low hundreds; for a large or ecommerce site, more, driven by how much custom code and how many integrations have to be kept working. The cost of website maintenance tracks complexity, not page count.

Two things move the number more than anything else. The first is how much of the site is custom: a stock theme with six well-known plugins is cheap to maintain, and a heavily customised build with bespoke integrations is not, because every update carries a real chance of breaking something specific to you. The second is what happens when it breaks. A plan with a same-day response costs more than one with a five-day queue, and that difference is worth paying for on a site that takes orders.

Be wary of the very cheap end. A plan that costs less than an hour of developer time per month cannot include an hour of developer time per month, which means updates are applied unattended and nobody looks at the result.

What is in a website maintenance package, and how do plans differ?

Website maintenance packages usually tier on three axes: how often updates are applied, how fast someone responds when something breaks, and how many hours of actual work are included. Compare those three and most plans stop looking alike.

Do you need a website maintenance company, or can you do it yourself?

You can do it yourself if someone on your team will reliably log in every month, apply updates, check the site afterwards, and keep a tested off-site backup. The reason most businesses hire a website maintenance agency is not capability; it is that the task is easy to postpone and expensive to have postponed.

The honest test is whether you can say when the last update was applied and when the last backup was restored. If either answer is an estimate, the work is not happening on a schedule, and unscheduled maintenance is the kind that gets done after the incident.

What separates maintenance tiers

	Basic	Standard	Ecommerce or critical
Update frequency	Monthly	Fortnightly	Weekly, staged first
Backups	Weekly, off-site	Daily, off-site	Daily plus pre-update snapshots
Restore testing	On request	Quarterly	Monthly
Uptime monitoring	Hourly checks	Five-minute checks	One-minute checks plus form checks
Response when broken	Next business day	Same business day	Same day, defined escalation
Included work	Updates only	Updates plus small fixes	Updates, fixes and a monthly review

Frequently asked questions

What is a website maintenance service?

A recurring service that keeps a live website secure, updated, backed up and monitored, and provides a route to someone who fixes it when it breaks.

How much does website maintenance cost per month?

Low hundreds per month for a typical small-business site, more for ecommerce or heavily customised builds. Cost tracks complexity and response time, not the number of pages.

What is included in a website maintenance package?

Core, theme and plugin updates; security patching and scanning; off-site backups; uptime monitoring; and a defined response when something breaks. Content and design changes are usually separate.

Is website maintenance really necessary?

Yes for any site running a CMS. Unpatched plugins are published vulnerabilities, and they are scanned for automatically rather than targeted at you specifically.

How often should a website be updated?

Monthly at minimum for a brochure site, and at least fortnightly for anything taking payments or handling customer data. Security releases should be applied as they land.

What is the difference between website maintenance and website support?

Maintenance is scheduled preventive work. Support is what happens when something goes wrong. Most website maintenance and support services bundle the two, and it is worth checking how many hours of each you are actually buying.

Do I need a website maintenance company for a WordPress site?

WordPress sites need it more than most, because the plugin ecosystem is where most vulnerabilities enter. A WordPress website maintenance service should be staging updates before applying them.

Can I do website maintenance myself?

Yes, if you will reliably do it monthly and keep a tested off-site backup. The task is not difficult; it is easy to postpone, and postponed maintenance is the expensive kind.

What happens if I stop paying for website maintenance?

Nothing immediately, which is the trap. The site keeps working while updates stop being applied, and the risk accumulates quietly until something exploits it.

How do I find website maintenance services near me?

Proximity matters less than response time and what is actually included. Ask for the response window in writing and ask when a backup was last restored rather than last taken.

Does website maintenance include content updates?

Usually not by default. Some plans include a small monthly allowance of content edits; treat that as a separate line rather than assuming it.

Does maintenance cover hosting?

Not normally. Hosting and maintenance are separate costs, though some agencies bundle them. Check which one is responsible for uptime when the server is the problem.

Website maintenance — questions answered straight

What does website maintenance include?

Core and plugin updates, backups, security monitoring, uptime checks, and fixing things when they break. On WordPress these are not optional — sites degrade or get compromised without them.

Can I maintain my WordPress site myself?

Yes, if you are technical and disciplined. It takes under an hour a month. The people who get hurt are those who intend to and then do not for two years.

What happens if I skip updates?

Eventually a security vulnerability gets exploited or a plugin conflict breaks the site. Both are far more expensive to fix than to prevent.

How often should backups run?

At least daily for a site that changes, stored somewhere separate from the hosting. A backup on the same server as the site is not a backup.

Does maintenance include content changes?

Depends on the plan. Ask explicitly — content edits and technical upkeep are commonly confused and priced differently.

My site was hacked. Can you fix it?

Usually, though cleaning a compromised site costs more than maintaining it. The first step is establishing how it got in, or it happens again.

Do I need maintenance on Squarespace or Wix?

No — those platforms handle updates and security. That is a genuine advantage of hosted platforms.

What does maintenance cost?

It scales with site complexity rather than page count. We quote your scope in writing the same business day.

Get a free marketing proposal

Tell us what you are trying to grow and we will come back with a plan, not a pitch deck. Same-day reply on weekdays.

Website Maintenance and Website Management Services

Hosting, website maintenance and website management services are three different products

What website maintenance and website management services cost

Why price should follow downtime cost, not page count

What is usually not included, and should be quoted separately

What belongs in a maintenance plan, and what is filler

The five things that genuinely matter

The phrases that should make you ask a follow-up question

The four expensive failures maintenance actually prevents

Compromise and blacklisting

Data loss

Downtime during a campaign

Silent failures

Taking over a site nobody has maintained

What the audit should produce, in writing

WordPress maintenance specifically

Shopify and hosted platforms

Maintenance and your search rankings

What a maintained month actually looks like

Ownership: the part that decides whether leaving is simple

The exit terms, in one paragraph

Which arrangement fits which site

Doing it yourself, and when that is reasonable

Questions to ask any maintenance or website management provider

Hosting WordPress on AWS, and choosing a maintenance provider

WordPress on AWS

Choosing among website maintenance companies

Is website maintenance worth it?

Want an honest read on your current plan?

Getting found in search

AI, AEO and what is changing

Paid media and lead generation

Websites and design

Choosing and working with an agency

Social, content and brand

By industry and by situation

The Google Workspace admin console

Choosing a maintenance provider

Related guides on platforms, frameworks and hosting

Frequently asked questions

What does a website maintenance service actually include?

Updates

Security

Backups

Monitoring

Fixes

How much does website maintenance cost?

What is in a website maintenance package, and how do plans differ?

Do you need a website maintenance company, or can you do it yourself?

What separates maintenance tiers

Frequently asked questions

What is a website maintenance service?

How much does website maintenance cost per month?

What is included in a website maintenance package?

Is website maintenance really necessary?

How often should a website be updated?

What is the difference between website maintenance and website support?

Do I need a website maintenance company for a WordPress site?

Can I do website maintenance myself?

What happens if I stop paying for website maintenance?

How do I find website maintenance services near me?

Does website maintenance include content updates?

Does maintenance cover hosting?

Related

Website maintenance — questions answered straight

Get a free marketing proposal