Maintenance is the line item clients cut first and regret last. It buys nothing visible, which makes it feel optional right up to the morning a contact form stops sending, a plugin update takes the site down, or a scanner finds an outdated component and someone else finds it first. This is what maintenance actually covers, what the market charges monthly, when handling it yourself is reasonable, and what it costs to skip.
Most US small businesses spend $50 to $500 a month on website maintenance. Simple brochure sites sit at the low end, ecommerce and lead generation sites at the high end. That covers hosting, updates, backups, security monitoring, uptime checks, form testing and a small allowance of content edits.
What does website maintenance actually include?
The phrase covers four different jobs that often get bundled into one invoice, which is why quotes vary so widely.
Keeping it running. Hosting, SSL renewal, uptime monitoring, backups that are actually tested by restoring them somewhere, and a plan for what happens at 2am when the site is down. Backups nobody has ever restored are a hope, not a safeguard.
Keeping it safe. Core, plugin and theme updates applied on a schedule and tested rather than auto applied blindly. Malware scanning, login hardening, spam filtering on forms, and removal of the plugins nobody uses anymore. Most small business compromises come through outdated third party code, not through a targeted attack.
Keeping it working. Forms tested monthly with a real submission, analytics and conversion tracking verified, broken links checked, checkout tested if you sell, and page speed watched so it does not drift as images accumulate.
Keeping it current. A small allowance of content edits: new team member, updated pricing, a seasonal banner, a new service page. This is the part clients value most day to day and the part that gets squeezed out of cheap plans.
A quote that lists only the first two is a hosting plan with a nicer name. That may be fine, as long as you know that is what you bought.
What does website maintenance cost per month?
Here are the ranges we see across the US small business market. Anything meaningfully below these bands is usually automated updates with no human looking at the result.
| Site type | Typical monthly cost | What is usually included |
|---|---|---|
| Static or small brochure site | $50 to $150 | Hosting, SSL, backups, uptime, occasional edits |
| WordPress business site, 10 to 25 pages | $150 to $400 | Plugin and core updates, security scanning, backups, monthly form checks, 1 to 2 hours of edits |
| Lead generation site with integrations | $300 to $700 | All of the above plus CRM and tracking checks, landing page edits, speed monitoring |
| Ecommerce store | $300 to $1,200 | Theme and app updates, checkout testing, product and promo updates, priority response |
| Custom application or high traffic site | $1,000 and up | Dedicated environments, staged releases, monitoring, defined response times |
Hourly rates outside a retainer typically run $75 to $200 across the US market, which is why an ad hoc arrangement often costs more than a plan once you count two or three small requests a month. Some agencies bill maintenance as a percentage of build cost, roughly one to two percent monthly. That is a rough guide rather than a rule, and it breaks down on very large or very simple sites.
We ask clients to separate two budgets: keeping the site healthy, and improving it. Blending them means the improvement work always gets eaten by maintenance tasks, and a year passes with no measurable gain. Health is a fixed monthly cost. Improvement, whether that is conversion optimization or new pages, is a separate decision with its own expected return.
Does DIY maintenance make sense?
Sometimes, genuinely. If you run a simple site on a managed platform, you are comfortable in the admin area, and nothing on the site is load bearing for revenue, handling it yourself is reasonable. Managed hosting handles a lot of the risk, and a monthly hour of your own time is cheap.
It stops making sense at three points. When the site generates leads or sales, because downtime and broken forms now cost money directly. When there is custom code or several plugins interacting, because updates start having consequences. And when nobody on the team wants the job, which is the most common failure: maintenance quietly becomes nobody's responsibility and the last update was fourteen months ago.
If you do go the DIY route, take these five steps seriously.
- Move to managed hosting with automatic daily backups stored off the server.
- Put a recurring monthly calendar block on one named person, not the whole team.
- Update on staging first where the platform allows it, and never update a stack of plugins at once without checking the site afterwards.
- Submit a real test entry through every form each month and confirm it arrives in the inbox and the CRM.
- Keep a written list of logins, hosting, registrar and DNS access, so that recovery does not depend on one person's memory.
The point of a retainer is not that agencies do these things better in principle. It is that a retainer makes them happen every month regardless of how busy you are.
What actually breaks when you skip it?
The failures are boringly consistent. Forms stop delivering after a plugin or email provider change, and because nothing looks broken, it goes unnoticed for weeks. That is the expensive one: you cannot see the leads you never received.
Then there is plugin rot. Abandoned plugins stop receiving updates, eventually conflict with a core release, and the site either breaks or becomes impossible to update without unpicking the whole stack. Fixing that after two years of neglect regularly costs more than two years of maintenance would have.
Security follows the same pattern. Most compromises on small business sites are automated, opportunistic and aimed at known vulnerabilities in outdated components. Cleanup, reputation recovery and reputational damage cost far more than patching would have. Add slow drift too: uncompressed images and accumulated scripts make pages heavier month by month until speed becomes a visible problem.
The quiet one is content. A site listing last year's pricing, a departed team member and an expired promotion signals a business that is not paying attention. Visitors read that faster than any of the technical issues above.
What should a good retainer cover?
Use this as a checklist when comparing plans.
- Daily off server backups, with restores tested at least quarterly
- Core, plugin and theme updates applied on a schedule with a check afterwards
- Uptime monitoring with a defined response, not just an email alert
- Malware scanning and login hardening
- Monthly form and conversion tracking tests, including CRM delivery
- Broken link and error checks
- Page speed monitoring with a benchmark you can see
- A stated allowance of content edit time and what happens when you exceed it
- A named response time for urgent issues, in hours rather than vague promises
- A monthly or quarterly report that a non technical person can read
- Clear ownership: you own the hosting account, domain and code, not the agency
That last point matters more than it appears. If leaving your provider means rebuilding the site, you are not on a maintenance plan, you are locked in.
Ask any prospective provider to show a sample monthly report and describe what happened the last time a client site went down. The specifics of that story tell you more than any feature list. Vague answers there usually mean the plan is automated updates with nobody watching. For sites we build through design and development, maintenance is scoped before launch rather than sold afterwards as a rescue.
Who should own maintenance internally?
Even with an agency on retainer, someone on your side needs to be the counterpart. Not to do the work, but to answer questions, approve anything that affects the business, and read the monthly report. Without that, plans drift into invisibility: the invoice goes out, nobody reads the summary, and after a year neither side can say what the money bought.
Give that person three standing responsibilities. Keep a current list of every account tied to the site, including hosting, domain registrar, DNS, email sending service and any third party apps, with billing owners recorded. Domains expiring because the card on file belonged to a former employee is a genuinely common and entirely avoidable outage. Second, own the content queue: collect the pricing changes, staff updates and seasonal edits from around the business and send them in batches rather than one at a time. Third, review the report and ask one question about it. Even a light challenge each month keeps a plan honest.
If nobody can take that on, say so when you buy the plan and pay for a provider who will chase you rather than wait quietly.
How do you judge a maintenance quote?
Compare on three things: what is monitored, who responds and how fast, and how much human time is included. Two plans at the same price can differ by an order of magnitude on those. A $99 plan with automated updates and no testing is not competing with a $350 plan that includes two hours of work and a person who answers.
Then weigh it against the site's job. If your website produces a meaningful share of your pipeline, treat maintenance the way you treat insurance on a delivery vehicle: unglamorous, non optional, and cheap relative to the week it is out of service. If the site is a digital business card, the low band is genuinely enough. Match the spend to what the site earns, and revisit it whenever that changes.
Frequently asked questions
How much should website maintenance cost per month?
Most US small businesses pay between $50 and $500 a month. Simple brochure sites sit near the bottom of that band, WordPress business sites around $150 to $400, and ecommerce stores $300 to $1,200. Price differences usually come down to two things: how much human working time is included each month, and how fast someone is contractually expected to respond when the site breaks.
Is website maintenance really necessary?
For any site that generates leads or sales, yes. The risks are not dramatic, which is the problem. Forms stop delivering after a plugin change and nobody notices for weeks. Outdated components attract automated attacks. Pages get slower as images pile up. None of that announces itself, and each is far cheaper to prevent than to repair once it has been running unattended for a year.
What is included in a website maintenance plan?
A proper plan covers four areas: keeping the site running (hosting, SSL, tested backups, uptime monitoring), keeping it safe (updates, scanning, login hardening), keeping it working (monthly form tests, tracking verification, link and speed checks), and keeping it current (an allowance of content edits). Add a defined response time and a readable monthly report. Plans missing the last two areas are hosting with a nicer name.
Can I maintain my own website?
Yes, if the site is simple, runs on managed hosting, and nothing on it is critical to revenue. Assign one named person rather than the team, block recurring monthly time, keep daily backups off the server, update in small batches and check the site afterwards, and submit a real test entry through every form. The approach stops being sensible once the site drives meaningful pipeline.
What happens if I stop paying for maintenance?
Nothing at all, for a while. That is what makes it tempting. Then updates lapse, abandoned plugins conflict with a core release, and small breakages start appearing. The most expensive outcome is usually invisible: a contact form that quietly stops delivering, so you never learn about the leads you lost. Recovering a neglected site frequently costs more than the skipped maintenance would have.
Does maintenance include SEO or new content?
Usually not, and mixing them is a common mistake. Standard maintenance keeps the site healthy and handles small edits such as pricing changes or a new team member. Ranking work, new service pages and campaign landing pages are growth activity with different goals and different measurement. Keep them in a separate scope, otherwise the growth budget quietly gets consumed by upkeep every month.
The takeaway
Maintenance is priced as a monthly cost but is really a risk decision. Ask what the site is worth in leads or orders per month, then compare that to the plan. For most small businesses the honest answer sits between $150 and $400 for a business site, and the plans worth paying for are the ones that include a person testing forms, checking tracking and answering the phone rather than a script applying updates unattended.