Websites
Website maintenance: what it includes and what it costs
Website maintenance is everything that keeps a site online, secure and current after launch: renewing the domain and hosting, the SSL certificate, backups, updates, uptime monitoring and content changes. For a small business, published maintenance plans run from about $50 a month for basic updates to $300 and up for plans with security response and development time; agencies such as WebFX start at $350 a month. What you need depends mostly on the technology: a WordPress site with many plugins needs frequent updates, while a site generated as static pages needs far fewer.
Contents
Key points
- Typical plans for small business sites start around $50 a month for updates and backups; WebFX's agency plans start at $350 a month.
- 11,334 new vulnerabilities were found in the WordPress ecosystem in 2025, up 42% on 2024; 91% were in plugins.
- SSL certificates issued from 15 March 2026 are valid for at most 200 days, and from 2029 for at most 47: renewal has to be automatic.
- A good maintenance plan states what's included, how fast the provider responds and where backups are kept.
A website isn't finished at launch. The domain and hosting expire, the security certificate renews, the software it runs on gets updates, and your prices and opening hours change. Here's what maintenance means, what it costs in 2026 and how to decide how much you need.
What website maintenance includes
| Item | Why it matters | How often |
|---|---|---|
| Domain | Without it, your site and email stop working | Yearly or every few years |
| Hosting | The server your site runs on | Monthly or yearly |
| SSL certificate | Without it, browsers show "not secure" | Automatically, several times a year |
| Backups | The site can be restored after a mistake or an attack | Daily or weekly |
| Updates | They close vulnerabilities in the theme, plugins and server | Weekly or monthly, depending on the technology |
| Uptime monitoring | You find out the site is down before customers do | Continuously, automatically |
| Speed and Google | Search Console errors, slow pages, broken forms | Monthly |
| Content changes | Prices, hours, menu, photos, new services | As needed |
| Legal pages | Privacy policy, cookies, terms, new rules | When the law or your data use changes |
What maintenance costs in 2026
| Cost | Typical price | Notes |
|---|---|---|
| .com domain | About $10–$23 a year | Compare renewal prices, not first-year deals |
| Hosting for a small business site | A few dollars to a few tens of dollars a month | More for online stores |
| SSL certificate | Usually free, included with hosting | Must renew automatically |
| Basic maintenance plan (updates, backups) | About $50–$100 a month | Belov Digital's 2026 guide |
| Standard plan (adds security response, small tasks) | About $150–$300 a month | Belov Digital's 2026 guide |
| Agency plan | From $350 a month for WordPress sites | WebFX, with extra work at $150 an hour |
These figures come from providers' guides and price lists, not a market survey, and plans with the same price can include very different things. A $50 plan that only runs updates doesn't compare with a $300 plan that includes content changes and someone on call when the site goes down.
Why WordPress sites need more care
WordPress powers a huge number of sites, and every theme and plugin is code written by different developers. Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 42% more than in 2024. 91% were in plugins, 9% in themes, and WordPress core had only six, all low risk. 46% of the vulnerabilities had no fix available when they were made public.
In practice, a WordPress site with many plugins has to be updated often and checked after each update, since a new version of one plugin can break another. A site generated ahead of time as static pages, with no public admin panel and no plugins, has far fewer parts that can be attacked or need updating. The trade-offs are covered in detail in WordPress vs a custom-built website. If a site gets hacked anyway: website hacked: what to do.
SSL certificates are renewing more often
The SSL certificate is what makes your address start with https and keeps browsers from showing a "not secure" warning. The CA/Browser Forum, which sets the requirements for these certificates, is shortening their validity in three steps:
- certificates issued from 15 March 2026 are valid for at most 200 days;
- from 15 March 2027, at most 100 days;
- from 15 March 2029, at most 47 days.
A certificate renewed by hand once a year is no longer an option. Most hosting providers renew automatically; just check that yours does.
What to check yourself, once a month
- The site opens on a phone and a computer, and contact forms actually deliver messages.
- Prices, hours and contact details are current.
- Search Console shows no new errors or pages dropped from the index.
- Backups exist and are recent.
- The domain and hosting don't expire in the next two months.
What to ask before signing a maintenance plan
- What exactly is included: updates, backups, monitoring, how many content changes?
- How fast do you respond when the site is down?
- Where are backups stored, and when was a restore last tested?
- Whose name are the domain and hosting in, and who has the passwords?
- What does work outside the plan cost?
- What happens to the site if I cancel?
What stays yours when you cancel a subscription is explained in website subscription or one-time payment.
The sites we build use Next.js, with pages generated ahead of time, so they have few parts that need updating. The domain, hosting and email on your domain are part of what we deliver, and when a price, your hours or a photo changes, you write to us and we make the change. The details are on our web design page.
Questions
What does website maintenance include?
All the work after launch that keeps a site online, secure and current: renewing the domain and hosting, the SSL certificate, backups, software updates, uptime monitoring, and changes to text, prices or photos.
How much does website maintenance cost?
For a small business site, published plans range from about $50 a month for updates and backups to $300 or more with security response and development hours. On top of that you pay for the domain (about $10 to $23 a year for a .com) and hosting.
Can I skip maintenance?
Yes, if you do the checks and updates yourself or the site has few parts that can break. The domain and hosting have to be paid regardless; without them, the site disappears.
Why does a WordPress site need more maintenance?
Because the theme and each plugin are separate code, updated by different developers, and most vulnerabilities appear in plugins. A site with many plugins has to be updated often and checked after each update.
What happens if my site gets hacked?
It's restored from the last clean backup, then the hole is closed: the vulnerable plugin is updated or removed and passwords are changed. That's why backups stored somewhere other than the site's server matter.
Sources
- Website maintenance pricing, WebFX
- WordPress maintenance plans explained: what's worth paying for, Belov Digital
- State of WordPress Security in 2026, Patchstack
- Ballot SC-081v3: Introduce schedule of reducing validity and data reuse periods, CA/Browser Forum
- Domain renewal prices, Findstack