What Does Website Maintenance Include and What Should It Cost

A website is not finished on launch day. The software it runs on keeps changing, new security holes are found every week, and forms or integrations can stop working without anyone noticing. Maintenance is the routine work that keeps all of that in check.

This guide lists what maintenance should include, how often each task needs to happen and what it should cost. It is based on the work we do every month in our website maintenance plans for small business sites.

What website maintenance includes

Why WordPress sites need it every month

WordPress itself is well maintained. The risk sits in the plugins and themes added on top. Patchstack's State of WordPress Security in 2026 counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, a 42% increase over 2024. Of those, 91% were in plugins and 9% in themes, while WordPress core had only 6 low-priority issues.

Two more findings explain why updates alone are not enough. 46% of vulnerabilities had no fix from the developer by the time they were made public. And for the most heavily attacked vulnerabilities, the weighted median time from disclosure to the first attack was 5 hours. A site that gets updated once a quarter is exposed for weeks at a time.

The official WordPress hardening guide gives the same advice we follow:

• Keep WordPress on the latest version, because older versions do not get security updates.
• Keep plugins updated, and delete any plugin you are not using.
• Only install plugins and themes from the WordPress.org repository or well-known companies.
• Back up your data regularly, including the database, and keep the backups in a trusted location.
• Monitor the site, because prevention is not always enough.

The server needs attention too. WordPress recommends PHP 8.3 or greater and MySQL 8.0 or greater, or MariaDB 10.11 or greater. Each PHP version gets two years of full support and two more years of security fixes, according to PHP.net. PHP 8.2 reaches the end of its security support on December 31, 2026, so sites still running it need to move to a newer version and be tested.

What happens when maintenance stops

When a site comes to us after a year or more without care, we usually find some of these problems:

• A contact or quote form that stopped sending. The site looks fine, but leads have been going nowhere for weeks.
• Dozens of pending plugin updates. Applying them all at once on a live site is risky, so they have to be tested in stages.
• Spam pages or hidden redirects. Patchstack's 2026 report describes malware that shows spam to search engines while sending human visitors to other sites, so the owner often sees nothing wrong.
• Slow pages. Large images and leftover plugins add weight over time.
• No usable backup. Backups were never set up, or the last one is too old to help.

Each of these costs more to fix than it would have cost to prevent. A hacked site, for example, needs a cleanup, a review of every user account, new passwords and often a request to Google to remove a security warning from search results.

What your hosting company already covers

Hosting and maintenance are often confused. A host keeps the server running, and many hosting plans add server backups and a free SSL certificate. What a host usually does not do is test your plugin updates, check that your forms still send, or fix the site when an update breaks the layout. Read your hosting plan to see what it includes, then make sure every other task in the table above has a clear owner.

Speed is part of maintenance

Speed slips slowly as content, images and scripts are added. We check it every month against Google's Core Web Vitals. According to web.dev, a good experience means the main content loads within 2.5 seconds, the page responds to a tap or click in 200 milliseconds or less, and layout shift stays at 0.1 or less, measured at the 75th percentile of visits. Caching, image compression and removing unused plugins usually bring a slow WordPress site back within range.

Maintenance for sites not built on WordPress

Sites built with a framework like Next.js, or on a hosted builder, need less maintenance, but not none. Framework and package updates still need to be applied and tested, forms and integrations still need checking, and domains and certificates still expire. Our comparison of Next.js and WordPress explains how the upkeep differs between the two.

What website maintenance should cost

There are three common ways to handle maintenance:

• Do it yourself. No fee, but it takes a few hours every month and some technical confidence, especially when an update breaks something.
• Hire a freelancer by the hour. Good for occasional fixes, but nobody is watching the site between jobs.
• A monthly plan. A fixed fee for scheduled updates, backups and monitoring, with someone responsible when something goes wrong.

Our plans are priced by the size of the site:

Every plan includes core, plugin and theme updates with compatibility checks, automated daily backups with integrity checks, malware scanning, a basic web application firewall, login protection, SSL monitoring, speed work such as caching and image optimization, and minor content updates. New features, new pages, big design changes and custom code are quoted separately. You can compare the plans on our website maintenance page.

If you are planning a new site, include maintenance in the budget from day one. Our guide to what a custom website costs lists the other running costs to plan for.

Questions to ask a maintenance provider

1. How often do you apply updates, and do you test them before they go live?
2. How often do backups run, where are they stored, and when did you last test a restore?
3. What happens if the site goes down or gets hacked, and how fast do you respond? On our plans, critical problems get a response within 2 to 4 hours during business hours.
4. Which content changes are included each month?
5. Will I get a report of the work done?
6. Do I keep full access to my hosting, domain and site admin?

A monthly checklist if you maintain it yourself

1. Take a fresh backup and confirm it finished.
2. Apply updates one at a time, starting with security fixes, and check the site after each.
3. Delete plugins and themes you no longer use.
4. Submit every form on the site and confirm the message arrives.
5. Test checkout or booking if you have them.
6. Check page speed on a phone for your three most visited pages.
7. Confirm the SSL certificate and domain renewal dates.

If that list sounds like more than you want to own, a monthly maintenance plan takes it off your plate.

Frequently Asked Questions

Do I need maintenance if my website rarely changes?

Yes. Your content may stay the same, but the software under it does not. New vulnerabilities are found in plugins every week, and PHP versions reach end of life on a fixed schedule.

How often should a business website be backed up?

Daily for most business sites, and before every update. Keep backups away from the server the site runs on, and test a restore from time to time.

What is not included in a maintenance plan?

In our plans, new features, new pages, big design changes and custom code edits are quoted separately. Maintenance keeps the site you have healthy; new work is a project.

Can I switch maintenance plans later?

Yes. Our plans are priced by the number of pages, and you can change plans at any time. If your site grows, we move you to the plan that fits its new size, and downgrades take effect at the next billing cycle.