Website maintenance costs (what to pay for and what to skip)
What website maintenance really costs, line by line. Hosting, domains, updates, backups, security and edits, plus the add-ons you can safely skip.
On this page10 sections
Short answer
The unavoidable costs are a domain, hosting and someone keeping the software updated and backed up. On a hosted builder like Squarespace or Webflow most of that is bundled into one subscription. On WordPress it's split across hosting, plugins and maintenance time. Content edits and improvements are the variable part, and that's where retainers either earn their keep or quietly waste money.
Website maintenance cost is one of the least transparent line items a business pays for. Some owners pay nothing beyond hosting and are fine. Others pay a few hundred dollars a month for a "care plan" and couldn't say what it covers. The right number depends almost entirely on what your site is built on and how often it changes.
Here's what each part of maintenance actually is, what it typically costs, and what we'd skip.
What website maintenance cost actually covers
Maintenance breaks into four buckets:
- Keeping it online: domain, hosting, SSL certificate.
- Keeping it safe: software updates, security monitoring, backups.
- Keeping it working: forms, integrations, broken links, speed.
- Keeping it current: content edits, new pages, seasonal updates.
The first three are maintenance in the strict sense. The fourth is ongoing work, and it's where most of the money goes once the basics are covered.
Typical costs, line by line
These are typical ranges, not quotes. Your numbers depend on your platform, your traffic and how much you change.
| Item | Typical cost | What drives it |
|---|---|---|
| Domain name | Roughly $10 to $30 a year for a .com | Registrar and extension; renewals often cost more than year one |
| SSL certificate | Usually $0 | Free from Let's Encrypt or included by most hosts and builders |
| Website builder plan | About $15 to $99 a month | Plan tier, ecommerce, seats; hosting and security included |
| WordPress hosting | A few dollars to $100+ a month | Shared vs managed, traffic, staging, support |
| Premium plugins and themes | Often tens to a few hundred dollars a year each | How many you rely on |
| Updates, backups, monitoring | Your time, or a care plan from about $50 a month up | Site complexity and response time |
| Content edits and improvements | Hourly or retainer | How often your site changes |
For reference, Squarespace's plans run from $19 to $99 a month billed yearly after its July 2026 price increase. Webflow's site plans are $15 or $25 a month billed yearly, plus seats for anyone who edits.
The non-negotiables
Domain
Your domain is your address. Register it in an account your business owns, with auto-renew on and a current payment card. Losing a domain to an expired card or a former employee's email is one of the most painful and avoidable problems we see.
Hosting
On a builder, hosting is part of the plan. On WordPress, you choose. Cheap shared hosting is fine for a small, low-traffic site. Managed WordPress hosting costs more but usually includes daily backups, staging sites, server-level caching and faster support. If your site generates leads, a dependable host with backups is worth paying for.
SSL
Every site needs HTTPS. You should almost never pay extra for a basic certificate. Let's Encrypt issues them free, and most hosts and every major builder include one.
Backups
You want automatic backups, stored somewhere other than the server the site runs on, and a tested way to restore them. "Tested" is the important word. A backup you've never restored is a hope, not a plan.
Updates and security: where WordPress costs differ
On Squarespace, Webflow or Shopify, the platform updates the software for you. On WordPress, updates are your job, or the job of whoever you pay.
That job matters. Patchstack's 2026 report counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, with 91% in plugins. It also found that 46% didn't have a patch available when they were disclosed. Fewer plugins means fewer things to patch and fewer surprises.
There's also the server layer. WordPress runs on PHP, and each PHP version gets security fixes for a limited time. PHP 8.1 stopped receiving them at the end of 2025, and PHP 8.2's security support ends December 31, 2026. If your host is running an old version, plan the upgrade, because some older plugins break on newer PHP.
A sensible WordPress routine looks like this:
- Apply minor core and security updates promptly
- Update plugins weekly or every two weeks, after a backup
- Test major updates on a staging copy first
- Remove plugins you don't use, rather than just deactivating them
- Check forms and checkout after every update round
Content edits and small improvements
This is the part that varies most. A site that changes twice a year needs very little. A site with a weekly blog, seasonal promotions and new service pages needs regular hours from someone.
The cheapest edits are the ones your team can make safely themselves. That's a CMS question as much as a budget question. If every text change requires a developer, your maintenance cost is really a CMS problem. Our guide to choosing the best CMS for a small business covers what to look for.
Retainer vs ad hoc
| Monthly retainer | Ad hoc, as needed | |
|---|---|---|
| Best for | Sites that change often or carry real revenue | Stable sites that rarely change |
| Upside | Predictable cost, faster response, proactive fixes | Pay only for what you use |
| Downside | Paying for unused hours if you don't plan work | Slower turnaround, higher hourly rate, nobody watching |
| Ask for | A monthly log of what was done | A clear rate and response time in writing |
A retainer is worth it when it comes with a plan and a report. If you can't see what was done last month, you're paying for reassurance, not maintenance.
What to skip
- Paying separately for a basic SSL certificate. It's free or included.
- Directory submission bundles. Hundreds of low-value listings won't help. A short list of accurate ones will, which we explain in our local citations guide.
- "SEO maintenance" with no deliverables. If a monthly fee doesn't come with specific work and a report, it isn't SEO.
- Overlapping plugins and services. Two security plugins, three backup tools, a caching plugin on top of host-level caching. More isn't safer.
- Unused retainer hours. If your hours roll over or expire unused month after month, switch to ad hoc.
- Redesigning instead of maintaining. A well-kept site can go years between redesigns.
A simple maintenance calendar
- Weekly: confirm backups ran, apply updates (WordPress), glance at uptime alerts.
- Monthly: test every form and checkout, check Search Console for errors, review analytics for odd drops.
- Quarterly: review key pages for outdated info, check page speed on a phone, remove unused plugins and users.
- Yearly: renew the domain and licenses, review hosting, check accessibility basics, confirm who has admin access.
What we'd do
If you're trying to set a maintenance budget, we'd start here:
- List what you pay today: domain, hosting, plugins, services, retainers. You'll often find something redundant.
- Decide who does updates and backups, and get it in writing.
- Check who owns the domain and hosting accounts. It should be your business, not a person or a past vendor.
- Estimate how often your site actually changes, then choose retainer or ad hoc accordingly.
- If edits are expensive because your CMS is hard to use, fix that instead of paying for workarounds forever.
For a simple site on a builder, the bill can be little more than the subscription and the domain. For a WordPress site with real traffic, a care plan and regular edits, it commonly runs into the low thousands a year. Neither is wrong. What's wrong is paying without knowing what for.
Frequently asked questions
Does a Squarespace or Webflow site need a maintenance plan?
Not for software updates or security, since the platform handles those. You may still want help with content, forms, SEO and new pages.
What happens if I don't maintain a WordPress site?
Usually nothing, for a while. Then an outdated plugin gets exploited, a PHP upgrade breaks something, or a backup turns out to be missing when you need it. Small, regular upkeep is far cheaper than cleanup.
Can I do the maintenance myself?
Yes, if you're comfortable with updates, backups and testing. Set a recurring calendar reminder and keep a simple log. If your site brings in leads or sales, have a plan for what happens when an update breaks something.
If you'd rather hand it off, ongoing care is part of our web design and development service, and the full picture of what a new site costs is in how much a website costs.
