Website Maintenance Cost in 2026: What a Live Site Really Costs Each Month

Website maintenance cost is the total you pay each month to keep a live site running, and most of it is labour rather than the hosting bill. A site that looks finished on launch day does not stay finished, because everything around it keeps moving: browsers update, security holes turn up in the packages it depends on, Google changes how it ranks pages, and the payment and form services you integrate retire old API versions. This guide breaks the maintenance budget into its line items, compares the three common maintenance models and lists what the contract has to say. If you are still planning the build, treat maintenance as its own line next to the website development pricing you were quoted.

What is website maintenance, and why does it continue after launch?

Website maintenance is the routine technical work that keeps a live site running without problems: updates, backups, monitoring and small fixes. Sites rarely break on their own; the world around them changes. A contact form that works today can stop one morning because the email service behind it shut down an API version, and a vulnerability published in one plugin can make your site a target without anyone touching it. Maintenance exists to catch those changes before your customers do. An unmaintained site does not collapse in a day. It slows down over months, starts throwing warnings, and eventually reaches the point where someone says it would be easier to rebuild it.

What does website maintenance cost break down into?

A maintenance budget has six lines: hosting, domain and SSL, security and backups, dependency and framework updates, performance and SEO monitoring, and content edits with small change requests. The first two arrive as invoices and are the ones people notice. The other four are people's time, and proposals often hide them inside a single monthly figure. A widely repeated rule of thumb says yearly maintenance costs about 15-20% of the original build. Read it as a starting estimate, not a measured average: Blue Acorn iCi, an e-commerce agency that publishes the 20% rule, also published five of its own client projects (launched in 2014 and 2015) where maintenance ranged from 6% to 40% of the build, averaging 19.6%, and warned that the average is a poor way to estimate. What decides your real number is the site's complexity and what an outage costs you.

How much do hosting, domain and SSL cost?

Hosting, domain and SSL are the most visible part of maintenance and usually the smallest; the risk is that they get forgotten, not that they are expensive. A domain renews every year, and a missed renewal takes down the site and every email address on that domain with it. Hosting prices vary widely between shared servers, a VPS and serverless platforms that scale with traffic; on usage-billed platforms, set a monthly spend cap and an alert. SSL changed in 2026. Under CA/Browser Forum ballot SC-081, adopted in April 2025, the maximum validity of a TLS certificate fell from 398 to 200 days on 15 March 2026, drops to 100 days on 15 March 2027 and to 47 days on 15 March 2029. For a site that renews certificates by hand, that means several chances a year to show visitors a 'not secure' warning. Automated renewal, with monitoring that tells you when it fails, is now the minimum.

Why are security and backups a separate line?

Security and backups are invisible while nothing goes wrong and become the most valuable part of the budget the day something does. Security maintenance covers applying patches, scanning for malware, watching for suspicious login attempts and regularly reviewing admin accounts: who has which permissions, and whether two-factor authentication is on. Backups are your ability to bring the site back after an incident. Two rules matter. Keep backups somewhere other than the server the site runs on, and actually test a restore at regular intervals. A backup that has never been restored is a hope, not a guarantee.

Why shouldn't you postpone dependency and framework updates?

Small updates done regularly are almost always cheaper than one large upgrade after years of postponing. A modern website depends on dozens of open-source packages; vulnerabilities are found in them from time to time, and every package left behind adds to your technical debt. A minor version bump takes minutes, while a framework upgrade that skips two major versions can be a project of its own. When we moved this site to Next.js 16, locale redirects disappeared without a single error and the lint setup had to be rewritten, which we documented in our Next.js 16 upgrade notes. Skipped versions tend to fail without an error message. A monthly or quarterly update routine splits that risk into small pieces.

Is performance and SEO monitoring part of maintenance?

Yes: speed and indexing are not preserved by a one-off optimisation, and without regular checks they slip within months. A new image, an ad or analytics tag, or a third-party chat widget can drag down your Core Web Vitals. Maintenance should include regular checks of crawl and indexing errors in Search Console, broken links and page speed. We explain which metrics move conversions in our Core Web Vitals guide. A short monthly performance report is the cheapest way to catch a problem before a customer does, and the same monitoring helps AI search engines read your site correctly.

How are content edits and small change requests priced?

Small requests look trivial one at a time but can consume most of the maintenance hours, so the cleanest setup is a monthly hour allowance plus an agreed rate for anything above it. A price update, a new campaign page, a banner swap, an extra form field: each one is a couple of hours. Writing down the hourly rate or the separate-quote rule for work beyond the allowance prevents surprise invoices. Collect requests through one channel, a ticket system or a dedicated email address, rather than scattered chat messages; it speeds up the work and keeps a record of who asked for what and when.

Monthly retainer, hourly billing or an SLA?

Choose the model by asking what one hour of downtime costs you. A fixed monthly retainer gives a predictable budget and puts routine work (updates, backups, monitoring) on a schedule. Hourly billing is flexible for small brochure sites because you pay only when you need something, but it gives no priority guarantee: an urgent problem may wait behind the provider's other work that week. An SLA commits the provider to written response and resolution times, and it is the model that makes sense for e-commerce, booking or payment sites, where downtime is lost revenue.

How does the maintenance load differ on WordPress, Wix and Next.js?

The platform decides what kind of maintenance you buy: plugin and theme updates on WordPress, a subscription and its limits on Wix, engineering time on a custom Next.js site. WordPress core, themes and plugins update often, and the most common failure is plugins that conflict with each other or with a new release. On a closed platform such as Wix, the platform handles technical maintenance; in return you pay a monthly subscription and cannot go beyond what it allows. A custom Next.js site has no plugin risk, but it needs an engineer to apply and test updates. We put the total cost of ownership of all three side by side in our Wix, WordPress and Next.js comparison.

What does an unmaintained site end up costing?

An unmaintained site accumulates risk, and paying for that risk almost always costs more than regular maintenance would have. An exploited vulnerability can take the site offline, leak customer data and get the site flagged as dangerous by browsers. A broken form or payment step can lose enquiries for weeks before anyone notices, usually when someone asks why no leads came in this month. Upgrades postponed for years end in a decision to rebuild from scratch. That is why maintenance is better understood as insurance on the money you spent building the site than as a running expense.

What should a maintenance contract include?

A maintenance contract should put five things in writing: scope, hour allowance, backup frequency, response and resolution times, and ownership of code and accounts. Spell out which updates are included and how out-of-scope work is priced. Define response time and resolution time separately, because 'response within 24 hours' and 'fixed within 24 hours' are different promises. Confirm that the source code, the hosting account and the domain stay in your name; it is the only way to switch maintenance providers without being locked in, and our source code ownership guide covers who legally owns the code. Ask for a monthly report. If maintenance sits inside a larger software budget, our custom software development cost guide shows the full picture.