Website maintenance cost: what a care plan should cover

Read four recent pricing guides on website maintenance and the monthly figures run from $35 to $2,500. That does not mean anyone is lying. “Maintenance” has no standard definition: one quote covers hosting and automatic updates, another covers a person who checks the site weekly, fixes what breaks and makes your edits.

What does website maintenance cost?

Below are the four guides’ small-business figures. They are the publishers’ numbers, not ours, and each publisher sells hosting or web services.

Source	Small business figure	Same page also says
GoDaddy (April 2026)	$50 to $500 a month on average for small and mid-size business sites ($600 to $6,000 a year)	Developers $50 to $150+ an hour; retainers $100 to $1,500+ a month
Gravitate (January 2026)	$50 to $250 a month ($600 to $3,000 a year)	Professional maintenance usually $100 to $2,500 a month
WebFX (December 2025)	$3,600 to $12,000 a year	Its own table lists $35 to $100 a month for a “Small Business Website”
GreenGeeks (August 2026)	$200 to $600 a year for a self-managed WordPress site on free themes and plugins, before paid help	Agency care plans $75 to $500+ a month

The ranges are wide, they do not line up, and WebFX’s two small-business figures contradict each other. Without a written scope, a monthly price tells you very little. (For the build itself, see how much a US small business website costs in 2026.)

Before price: check who owns what

Before comparing quotes, confirm four things:

1. The domain’s registrant of record is your business, with an email you read.
2. The registrar and hosting logins are yours, not your developer’s.
3. You have your own admin user on the site.
4. You can download a full backup yourself.

The first matters most. Under ICANN’s Expired Registration Recovery Policy (checked October 2026), registrars send renewal reminders about one month and one week before expiry, and only to the registrant email on record. If someone else is the registrant, the warnings go to them. Before deleting an expired name, the registrar must disrupt its DNS, taking the website and email offline, and they stay down through the 30-day Redemption Grace Period a .com enters after deletion.

ICANN’s compliance FAQ (checked October 2026) warns that a developer you paid to register your domain may have used their own contact details, making them the official registrant. You may then need payment records to prove the name is yours. Check your registrar records now, while the relationship is friendly.

What a care plan should include

Domain, hosting and SSL

Auto-renew and two-factor login at the registrar are the baseline. The .com wholesale price is going up: Verisign is raising it from $10.26 to $10.97 a year from November 1, 2026, according to Domain Incite (April 2026). Registrars set their own retail prices, so how much reaches your bill depends on yours; the same report notes you can lock in current prices by renewing years ahead.

SSL certificates should renew themselves. Under an industry rule (CA/Browser Forum Ballot SC081v3), public certificates can now last at most 200 days, falling to 100 days in March 2027 and 47 days in March 2029, according to DigiCert (September 2026). Let’s Encrypt, the free certificate authority, is moving to 45-day certificates by 2028 and advises against renewing by hand (December 2025). A certificate issued today cannot last a year, so do not pay for a yearly manual install.

Backups you have actually restored

WordPress’s own backup handbook (October 2026) recommends three to five recent backups kept in different places (server, cloud, your own computer), weekly for small sites and daily for busy ones, plus an occasional manual backup to confirm the automatic ones work. CISA’s #StopRansomware Guide (September 2023) adds: keep offline, encrypted copies and regularly test that they restore.

Nor is your host a backup plan. Bluehost’s user agreement (August 2026), for example, makes the customer “solely” responsible for backups, says Bluehost has no obligation to make them, and says it will not attempt to back up accounts over 50,000 files or 30 GB.

GoDaddy’s guide prices automated backups at $0 to $20+ a month. Ask for a copy stored off the host that you can download, and the date of the last tested restore. A fair request: “Restore last Tuesday’s version to a staging copy and show me.”

Updates and security monitoring

On most sites, WordPress applies minor and security core updates on its own, but major releases still need someone to click “Update Now” (WordPress.org, September 2024). Since WordPress 5.5, plugin and theme auto-updates are switched on one at a time; once on, they run twice a day and email the site owner the result (WordPress.org, January 2023).

Auto-updates are not the whole job; what you pay a person for is everything around them. Patchstack’s State of WordPress Security in 2026 (February 2026) counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, up 42% from 2024. Plugins accounted for 91%; core had only six, all low priority. Nearly half (46%) had no fix from the developer by the time they were made public, and the most heavily exploited flaws saw their first attack within about five hours of disclosure (a weighted median). So a plan should cover:

• Vulnerable or abandoned plugins: spot ones with no fix or no maintainer, then replace or remove them.
• Premium licenses: a lapsed license keeps the plugin running but stops its updates, leaving unpatched code, according to GreenGeeks (August 2026), which puts a premium theme-and-plugin stack at $300 to $900 a year.
• Failed updates: notice when one did not apply or broke a page.
• PHP upgrades: PHP 8.2 stops getting security fixes on December 31, 2026, per PHP.net’s supported versions table (checked October 2026), so sites still on it need an upgrade, then a check that the theme and plugins still work.

GoDaddy’s guide prices uptime monitoring at $0 to $30+ a month and security tools and firewalls at $5 to $50+ a month.

Small edits, speed and accessibility

Edits. Get the monthly minutes or number of edits in writing, and the rate past that. Outside a plan, expect hourly rates like those in the table.

Speed. Google’s “good” Core Web Vitals targets are loading (LCP) within 2.5 seconds, responsiveness (INP) under 200 milliseconds and layout shift (CLS) under 0.1, according to Google Search Central (December 2025), and Search Console’s free Core Web Vitals report tracks them. A plan promising “performance monitoring” should report against those. If yours fail, see how to fix a slow website.

Accessibility. The Justice Department says businesses open to the public must make the goods and services they offer, including online, accessible to people with disabilities, and that a “clean” report from an automated checker or overlay does not necessarily mean everything is accessible (ADA.gov, March 2022). Federal website accessibility lawsuits rose to 3,117 in 2025, up 27% from 2024, according to Seyfarth Shaw (March 2026). The WebAIM Million (February 2026 data) found automatically detectable WCAG 2 failures on 95.9% of the top million home pages. Low-contrast text was the most common, on 83.9%, followed by missing image alt text and missing form labels.

New content can bring those back, so a sensible plan checks contrast, alt text and form labels whenever it publishes an edit. Background: why US businesses care about WCAG.

The scope to get in writing

Ask every provider to answer these nine:

1. How often updates run (core, plugins, themes), and who checks the site afterward.
2. How often backups run, how long they are kept, and where they are stored.
3. How often restores are tested, and when the last one was.
4. How often uptime is checked, and who gets the alert.
5. How many minutes of content edits are included each month.
6. Response time, in clock hours and your time zone.
7. Whether hack cleanup is included.
8. Whether fixing what an update broke is included or billed hourly. WebFX, for example, bills fixes needed after security-patch updates at $150 an hour, in half-hour increments.
9. What you receive when you leave: a full backup, every credential and your DNS records.

Once two plans answer all nine, any price gap left is a real difference.

What you can do yourself

On a simple site, most of the routine work costs little or nothing:

• Turn on registrar auto-renew and two-factor login, with your business as registrant.
• Use a free, auto-renewing SSL certificate, such as Let’s Encrypt, if your host supports it.
• Turn on plugin and theme auto-updates; WordPress applies minor core updates itself.
• Set up a free uptime monitor.
• Check Search Console’s Core Web Vitals and Security Issues reports once a month.
• Download a backup each quarter and test that it restores to a staging copy.
• Make your own text and photo edits in the CMS.

Hand off plugin conflicts, PHP upgrades, malware cleanup and performance work. If nobody will do even this list, a hosted builder may suit you better; see website builder or WordPress.

Red flags in a maintenance contract

• Terms longer than 12 months with exit fees.
• A “rental” site where you never receive the files or the database.
• Domain, hosting or backups held only in the agency’s accounts, or no admin login for you.
• “ADA compliance” sold as an overlay. The FTC finalized an order requiring accessiBe to pay $1 million over claims its overlay could make any website WCAG-compliant (FTC, April 2025).
• No written offboarding package.
• Renewal scares. Unsolicited “domain renewal” invoices or calls. Check the expiry date in your own registrar account before paying anyone.

How Maxverse Lab can help

We are a remote software studio with no US office. On every site we build, the client owns the domain, hosting and code, and gets every login. Send us a maintenance quote and your site’s address, and we will tell you which items above it covers and which you could do yourself. We reply within 24 hours. Get in touch.