What Does Website Maintenance Actually Cost? An Honest Range
Ask an agency what website maintenance costs and you will usually hear "it depends" — which is true, and which is also how the conversation ends, leaving you no better off than before you asked. This article is the rest of that conversation. The honest answer has three parts: a realistic monthly range for the kind of site a small business actually runs, the five cost drivers that move a site up or down within that range, and the specific things cheap plans quietly skip — because the cheapest maintenance is usually the most expensive version, deferred. One caveat before the numbers: ranges here describe the market as it generally behaves, not a specific quote; your site's platform, age, and risk profile decide where you land. What a retainer should include once you are paying for one is covered in our guide to what a maintenance retainer includes; the periodic capital expense that sits alongside monthly maintenance is the Drupal upgrade planning checklist; and the point where maintenance stops being the right question at any price is mapping work before a rebuild.
One principle to hold through every number below: maintenance is insurance plus upkeep. You are paying to keep a working asset working, and to make the bad day — the hack, the crash, the broken checkout — somebody else's problem at a predictable price.
The Five Cost Drivers That Actually Decide The Price
Maintenance quotes vary by an order of magnitude, and the variation is not random — five drivers explain most of it, and knowing them lets you predict your own position before anyone quotes you anything. Platform complexity is the first: a straightforward marketing site on a mainstream CMS sits at the bottom of the range; a site with custom plugins, a membership system, an integration with your booking or stock system, or anything requiring a developer rather than an administrator to touch, sits higher. Update cadence is the second: platforms and plugins ship security and compatibility updates continuously, and a plan that actually applies them weekly — testing each one so a broken update does not take the site down — costs more than one that applies them when someone remembers. Support responsiveness is the third: a plan that guarantees a human looks at your problem within hours on a business day is priced differently from one that queues you with everyone else. Backups and restore testing are the fourth — and the most quietly divergent, because many cheap plans back up but have never restored, which means the backup is a hypothesis; a plan that periodically restores a backup to prove it works charges for that time. And the fifth is risk exposure: sites that store customer data, process payments, or simply earn significant revenue per hour of downtime carry more expensive failure, and honest pricing reflects it. Run your site through the five drivers and you can usually predict your band before the first sales call.
Honest Monthly Ranges By Site Type
With the drivers in mind, here is how the market generally prices the three site profiles a small business runs. The table gives ranges, not quotes, and the notes column carries the fine print that separates the top of the range from the bottom.
Notice the pattern in the fine print. The bottom of every range is essentially hosting plus good intentions: updates applied eventually, backups stored but never tested, support by ticket queue. That can be fine for a brochure site that loses nothing on a bad day — but know that is what you are buying. The middle of each range is where most healthy small businesses land: updates applied and tested on a schedule, restores actually exercised, a named human who knows the site, and a response-time promise. The top of each range buys speed and depth — faster response, more covered work, developer-level help for the weird integrations — and is worth it exactly when an hour of downtime costs more than the monthly difference. The classic budgeting error is buying the bottom of the range while running a site with the risk profile of the top; the second classic error is the reverse, paying enterprise retainers for a five-page brochure site that needs an hour of attention a month.
What Cheap Plans Quietly Skip
Low-cost maintenance can be legitimate — for the right site — but it earns its price by omitting things, and the omissions are rarely on the brochure. The four most common: untested backups, as above — the plan says "daily backups" and it may well take them, but if no one has ever performed a restore, the day you need one is the day you find out. Update roulette: updates are applied automatically without testing, which works until the Tuesday a plugin update formats your booking form, and the failure is discovered by a customer rather than a human. Usability research bodies like Nielsen Norman Group have documented for decades how silently degraded interfaces erode trust in ways owners rarely trace back to their cause. No change log: work is done on the site with no record, so when something breaks nobody can tell what changed — and debugging without a change log is billed hourly, if it is billed at all. And no ownership clarity: the cheapest plans sometimes leave DNS, hosting accounts, or admin credentials in the agency's hands, which converts a pricing decision into a hostage situation the day you want to leave. None of these are arguments against inexpensive maintenance; they are arguments for reading any plan against the question "what happens on my worst day, and who has tested that it works?" The vendors worth their rate answer that question in writing before you ask twice.
Budgeting Maintenance Against Rebuilds And Upgrades
The last piece of an honest budget is knowing which bucket an expense belongs to, because maintenance, upgrades, and rebuilds get conflated — sometimes accidentally, sometimes on an invoice. Maintenance is the subscription: predictable monthly cost that keeps the asset working and covers the ordinary bad day. Upgrades are periodic capital expenses — the CMS major version, the end-of-life framework, the hosting migration — planned events with a defined scope and a finish line, and the honest way to fund them is to see them coming two years out rather than discover them as emergencies; the planning checklist for the most common one is the Drupal upgrade planning checklist. A rebuild is a different decision entirely: it means the asset no longer serves the business, and no maintenance tier fixes that. The practical rule: budget maintenance as a steady percent of what the site earns — the common band for small business sites is the cost of one modest customer transaction per month — and treat every rebuild conversation as a strategic decision, not a maintenance upsell. If an agency pitches a rebuild inside a maintenance review, the right response is not yes or no but "show me the work," which is exactly the frame of mapping work before a rebuild. Sites where the rebuild conversation keeps recurring are usually telling you something the budget already knows.
A Worked Example: The Studio Site Budget
Watch the framework price a real-shaped site. The business: a twelve-person architecture studio, website is a portfolio plus a contact pipeline, roughly a quarter of new clients mention finding them online. Site profile: mainstream CMS, a handful of plugins, a form-to-CRM integration, no payments, no member data beyond contact details. Driver one, platform: mostly standard, but the CRM integration nudges it up a band — call it middle complexity. Driver two, cadence: weekly update application with testing. Driver three, response: next-business-day is acceptable; the site earns inquiries, not per-hour revenue. Driver four, backups: nightly, with a quarterly test restore, because the portfolio is years of work. Driver five, risk: moderate — reputational rather than transactional. The result: a mid-range monthly plan, not the cheapest available and nowhere near enterprise. Budget check: the monthly cost equals roughly one small project engagement per year — against a pipeline where the site touches a quarter of inquiries, that is cheap insurance by any arithmetic. Upgrade reserve: the CMS version has about eighteen months of support left, so a slice of this year's budget is earmarked for the planned upgrade, on the checklist, two quarters out. Rebuild: not on the table — the portfolio structure still fits, and the maintenance conversation has never reached for it. That is the whole exercise: twenty minutes of driver analysis producing a defensible number, instead of a shrug and a prayer.
Run the five drivers against your own site, land in a band deliberately, and read any quote against the worst-day question before signing it.