Website Maintenance Cost for Small Business: What's Fair?

Website maintenance is the line item business owners resent most, because it is the one they cannot see. A redesign produces something new to look at. Maintenance produces… the same website, still working. It feels like paying for nothing right up until the month you are not paying for it.

So let us make it concrete. This guide covers what maintenance genuinely includes, the pricing models you will be quoted, how to judge whether a number is fair, and what the do-it-yourself route actually costs once you account for your own hours.

What "website maintenance" actually covers

The phrase is used loosely enough to hide both excellent value and near-total emptiness. A real plan covers five areas:

1. Updates

Your site is a stack of software — a CMS core, a theme, plugins or apps, a server environment, a certificate — and each layer releases updates on its own schedule. Left alone, they drift out of sync until something breaks or a known vulnerability is left standing. Proper maintenance applies updates on a staging copy first, checks that nothing broke, then pushes to the live site. That staging step is the difference between maintenance and gambling.

2. Backups

Automated, off-site, versioned, and — the part almost everyone skips — tested. A backup nobody has ever restored is a belief, not a safety net. Ask any provider when they last performed a test restore. The answer tells you a lot.

3. Security

Firewall and malware scanning, login hardening, user access review, certificate renewal, and a defined response if something does get in. Small business sites are rarely targeted personally; they are found by automated scanners sweeping for known vulnerabilities. Most compromises are opportunistic and entirely preventable by being current.

4. Performance and uptime

Monitoring that alerts someone when the site goes down — ideally before a customer emails you — plus periodic speed checks, image and database housekeeping, and cleanup of the plugins and scripts that accumulate over a year.

5. Content and small changes

Many plans include an allowance of monthly change time: a new page, updated prices, a fresh team photo, a seasonal banner. This is the part you will actually feel, and it is worth checking how it is measured and whether unused time rolls over.

Anything that lists only "updates and backups" is the floor, not a plan. Our website maintenance service page sets out the full checklist for comparison against whatever you are quoted.

The pricing models you will be quoted

Flat monthly retainer

The most common model: a fixed fee covering a defined checklist, usually tiered by site complexity. Predictable, easy to budget, and easy to compare — provided you compare the checklists rather than the prices. A cheap plan that excludes staging, monitoring, and change time is not cheaper, it is smaller.

Hourly / ad hoc

You call when something is wrong and pay for the time. Lowest cost in a quiet year, and structurally reactive: nobody is watching, so problems are discovered by customers. Emergency work also carries emergency pricing, and recovery costs far more than prevention.

Bundled with hosting

Managed hosting often includes updates, backups, and security at the platform level. This can be excellent value, but read the boundary carefully: platform maintenance rarely covers your theme, your plugins, or your content changes. It keeps the building standing; it does not tidy your flat. If you are weighing this up, our web hosting page explains where the responsibility line usually sits.

Included in a build contract

Some agencies include a maintenance window after launch — typically covering the settling-in period. Useful, finite, and worth knowing the end date of, so cover does not lapse quietly.

What drives the price up or down

Two quotes for "maintenance" can differ several-fold for entirely legitimate reasons. The main drivers:

• Platform and complexity. A five-page brochure site is not a 2,000-product store with payment integrations, and should not be priced like one.
• Number of moving parts. Every plugin, app, and third-party integration is another thing that can break after an update, and another thing to test.
• Custom code. Bespoke functionality needs someone who understands it. Off-the-shelf sites can be maintained by process; custom sites need judgement.
• Response commitments. Business-hours response is cheaper than nights and weekends. Pay for the window you genuinely need.
• Included change time. Often the largest single variable between quotes, and the easiest to overlook when comparing.
• Traffic and revenue at stake. A site processing orders around the clock warrants monitoring that a portfolio site does not.

How to tell a fair quote from a padded one

Ask these five questions of any provider. The answers separate a real service from a subscription:

1. What exactly is on the monthly checklist, and do I get a report? "We look after it" is not a deliverable. A monthly summary of what was updated, backed up, and checked is.
2. Are updates tested on staging before going live? If updates are applied directly to production, you are paying someone to take risks with your site.
3. Where do backups live, how far back do they go, and when was a restore last tested?
4. What counts as included work versus billable? Get the boundary in writing. Ambiguity here is where relationships sour.
5. If I leave, what do I take with me? Full access, backups, and source files should be yours on request, immediately. At TRODAD you get instant access to all design and source files on approval, and that principle does not change when a relationship ends. Our FAQ covers ownership and handover in more detail.

A fair quote is legible: you can see what you are buying, at what frequency, with what evidence. A padded one is vague on scope and specific only about the price.

DIY versus managed: the honest maths

Doing it yourself is entirely viable for a simple site if you are disciplined. The monthly routine looks roughly like this: check and apply updates, verify the site still works on desktop and mobile, confirm a backup completed and is retrievable, review users and remove stale accounts, run a speed check, scan for broken links and form failures, and review any security alerts.

Call it one to three hours a month for a small site, more when an update breaks something. The real question is not whether you can do it — it is whether you will do it in the month you are busy, which is the month it matters. Maintenance fails through neglect, not incompetence.

A reasonable middle path: keep small content edits in-house — you know your business better than any agency does — and outsource the technical layer, where the consequences of skipping a month are asymmetric.

What neglect actually costs

The case for maintenance is not the monthly fee versus zero. It is the monthly fee versus the eventual bill, which arrives in one of four forms:

• A compromise. Cleanup, reputation damage, blocklist removal, and the possibility of restoring from a backup that turns out not to work. Usually costs several years of maintenance in one go.
• Downtime. Every hour offline is lost enquiries and lost trust, and nobody tells you — customers just assume you closed.
• Compounding rot. Skip updates for a year and they stop being routine. Versions diverge, a plugin gets abandoned, and the safe path becomes a rebuild.
• Slow decay. Speed drifts, broken forms go unnoticed, and enquiries quietly stop arriving. This one is the most expensive precisely because nothing looks wrong.

FAQ

Do I still need maintenance if my site rarely changes?

Yes — the software underneath changes even when your content does not. Vulnerabilities are announced publicly, and automated scanners find unpatched sites regardless of how quiet they are. A low-change site can run a lighter plan, but not no plan.

Is managed hosting enough on its own?

It covers the server layer well and often includes platform updates and backups. It usually does not cover your theme, your plugins, your integrations, or your content. Read the boundary in the plan description and fill the gap deliberately rather than assuming it is covered.

How often should updates actually be applied?

Security patches promptly; feature updates on a regular scheduled cycle after staging tests. Monthly is a sensible baseline for most small business sites, with out-of-cycle action when a critical vulnerability is announced.

Can I pause maintenance for a few months to save money?

You can, and the risk is not linear — a lapsed site is hardest to bring current precisely when it has been left longest. If budget is genuinely tight, drop to a lighter tier that still covers updates, backups, and security rather than stopping entirely.

What should I do first if I have not maintained my site in years?

Take a full backup before touching anything, then get an audit rather than starting to click Update. Long-neglected sites often need updates applied in a specific order on a staging copy, and sometimes the honest answer is that a rebuild costs less than the recovery.

The short version

A fair maintenance price is one you can explain: a defined checklist, tested updates on staging, verified backups, active monitoring, a monthly report, and a clear line between included and billable work. Judge quotes on that list rather than the number at the bottom — and remember you are not buying a service so much as insurance against the four bills that arrive when nobody is looking after the site.

Book a free consultation — let's talk about your project. trodad.com/appointment