How much does website maintenance cost per year?

Website maintenance cost for a small business site runs about $230 to $5,800 a year as of October 2026. The low end is a builder site the owner keeps up. The high end is a WordPress site on an agency care plan with four hours of work a month. Stores and custom web apps cost more, because checkout and custom code need more developer hours.

Labor decides most of that range. Software, hosting and security for a WordPress site cost under $1,000 a year at list prices. The person who updates, tests and fixes it costs the rest. Every figure below comes from a vendor pricing page or a stated labor assumption, so you can swap in your own numbers.

On this page

• Website maintenance cost per year by site type
• What website maintenance includes
• Fixed costs you pay whoever maintains the site
• How many maintenance hours a site needs each month
• What a monthly maintenance plan should include
• A website maintenance schedule you can follow
• In-house, freelancer or agency: who should maintain it?
• What security costs, and what a hack costs instead
• Changes in 2026 that add maintenance work
• Accessibility upkeep belongs in the budget
• Website maintenance cost for online stores and web apps
• What happens when maintenance stops
• How to set a website maintenance budget
• Questions to ask before you sign a maintenance plan

Website maintenance cost per year by site type

Each row adds list prices as of October 2026 to an assumed labor rate of $100 an hour, a round number for illustration. Your own quotes will move the labor column far more than the software column.

A builder site is cheap to keep because the platform vendor patches the software, hosts the site and renews the certificate. A WordPress site hands those jobs to you or to whoever you pay. That is why the same 15-page site can cost $800 or $5,800 a year.

Owner time is not free either. Three hours a month at an owner's own billing rate of $150 is $5,400 a year of time not spent on clients.

What website maintenance includes

Maintenance is the work that keeps a live site safe, working and accurate after launch. A care plan or an in-house routine should cover these tasks:

• Software updates for core, theme, plugins or framework packages, tested before they reach the live site.
• Daily backups stored off the server, with a restore test at least twice a year.
• Security monitoring, a web application firewall and malware cleanup if something gets through.
• Uptime monitoring that alerts a named person.
• Certificate renewals, which now come around faster (see the 2026 changes below).
• Form, checkout and booking tests after every update.
• Speed checks against Core Web Vitals.
• Content edits: hours, prices, staff bios and new service pages.
• Accessibility checks on new pages and PDFs.
• Server software upgrades, such as a PHP version change.

Writing, SEO and ads are marketing costs, and a good plan prices them separately. If a quote bundles them into maintenance, ask for the hours split out. A $400 monthly fee can mean three hours of updates, or 30 minutes of updates and one blog post. For marketing budgets, see how much SEO costs per month.

Fixed costs you pay whoever maintains the site

Hosting is the first fixed line. WP Engine's entry managed WordPress plan costs $28 a month billed annually, or $336 a year, as of October 2026. Managed hosts handle the server, daily backups and WordPress core updates, which removes some labor from the plan.

Website builders bundle hosting into the plan price. Squarespace pricing runs from $19 a month for Basic to $99 for Advanced on annual billing, or $25 to $139 billed monthly. Shopify's plans run $29 a month for Basic, $79 for Grow and $299 for Advanced on annual billing.

Security comes next for any self-hosted site. Sucuri's security platform lists $229 a year for Basic, $339 for Pro and $549 for Business, with unlimited malware cleanups on every plan. Monitoring can cost nothing. UptimeRobot's free plan covers 50 monitors at five-minute intervals, and its Solo plan checks every 60 seconds for $12 a month on annual billing.

Premium plugin and theme licenses renew on their own dates, and a lapsed license usually means no more updates for that plugin. List every license with its renewal date and owner. DNS records need upkeep too: SPF, DKIM and DMARC entries have to change whenever you add an email or marketing tool that sends from your domain. The traps on domain renewals and introductory hosting prices are covered in the guide to what a small business website costs.

How many maintenance hours a site needs each month

Hours decide the bill, so estimate them before you compare plans. The ranges below are planning assumptions for a site with a sensible plugin count, not quotes.

Plugin count moves the hours more than page count. Every plugin is one more update to test and one more vendor whose fixes you wait on. For example, take a WordPress site that needs three hours a month at $100 an hour. Its labor costs $3,600 a year, against $336 for hosting. Removing 15 unused plugins that cut one hour of monthly work saves $1,200 a year.

What a monthly maintenance plan should include

Plans are easiest to compare by the hours they include. The levels below price those hours at the same $100 rate and list what each level should cover.

For a WordPress site that brings in leads, Standard is the right default. Basic suits a brochure site that changes twice a year. Priority is for stores, membership sites and anything with a login.

Ask for the hours in writing. A plan sold as unlimited small edits with no stated hours can stall in the month you need it most. Unused hours should either roll over for one month or be listed as forfeited, so you know which before you sign.

A website maintenance schedule you can follow

Whoever does the work, the schedule is the same. Put each task on a calendar with a named owner.

A once-a-month plan cannot meet the same-day row. The Patchstack exploit timings in the security section below are why it sits at the top.

In-house, freelancer or agency: who should maintain it?

Match the maintainer to what the site does for revenue. A site that takes payments or books jobs daily needs someone with a response time in writing.

Move off do-it-yourself once the site earns money every day. Take a plumbing company in Florida that books 40 jobs a month through its site. One lost day of bookings costs more than a month of agency maintenance. A freelancer works well for a stable brochure site, provided the domain, hosting and every license sit in your own accounts.

Platform choice sets the baseline. A custom-coded site needs a developer on call for its whole life, which the comparison of WordPress vs a custom website covers in detail.

What security costs, and what a hack costs instead

Speed of patching matters more than the security plugin you choose. Patchstack's State of WordPress Security in 2026 found that 46 percent of new WordPress vulnerabilities had no fix by the time they went public. For heavily targeted flaws, the weighted median time to a first exploit was five hours. About half of high-impact vulnerabilities were exploited within 24 hours.

Those numbers make a once-a-month update plan a weak plan. A site updated on the first of the month can sit exposed for four weeks after a plugin flaw goes public. Ask for one of two things: same-day updates for security releases, or a firewall that blocks known exploits before the patch lands.

Cleanup response time is the other number to check. Sucuri lists a 30-hour malware removal response on Basic, 12 hours on Pro and 6 hours on Business. For a site that generates leads every day, the Pro tier at $339 a year is the sensible floor.

Compare that with the cost of an outage. Say a dental practice gets 30 booking requests a month through its site, and a hacked site stays offline for four days. That is about four lost bookings. At $400 of first-visit revenue each, the practice loses $1,600, more than four years of Sucuri Pro.

Changes in 2026 that add maintenance work

Three changes this year add hours to every maintenance plan. Certificate lifetimes are shrinking. Under CA/Browser Forum ballot SC-081v3, the maximum life of a public TLS certificate falls from 398 days to 47 days. The cuts arrive in steps from March 2026 to March 2029. DNSimple's summary of the schedule lists 200 days from March 15, 2026, 100 days from March 15, 2027 and 47 days from March 15, 2029.

A certificate renewed by hand once a year now needs two renewals a year, and about eight a year by 2029. Automate renewal through your host or an ACME client now, and make certificate expiry one of the monitored checks.

PHP 8.2 reaches end of life. The PHP supported versions page shows security support for PHP 8.2 ending on December 31, 2026, and for 8.3 a year later. Sites still on 8.2 need an upgrade on this year's budget. The steps are laid out in the PHP 8.2 to 8.4 upgrade guide.

WordPress is also releasing faster. It shipped 13 core releases between February 3 and October 6, 2026, including two major versions, and 7.2 entered beta on October 20. The routine for testing each one is set out in what changed in WordPress 7.1.

Accessibility upkeep belongs in the budget

Accessibility is a maintenance task, because every new page, PDF and form can introduce new errors. The Justice Department's guidance on web accessibility under the ADA says Title III applies to the goods and services businesses offer online. It points to the Web Content Accessibility Guidelines (WCAG) as helpful technical guidance, while noting there is no detailed federal regulation for businesses.

Most new errors come from routine edits: images without alt text, skipped heading levels, untagged PDFs, form fields without labels and low-contrast text in a new banner. Budget a quarterly check of new content and an annual review of templates, forms and checkout. Four hours a year at $100 an hour adds $400. The full process is in the guide to making your website ADA compliant. This is general information, not legal advice.

Website maintenance cost for online stores and web apps

Stores cost more to maintain because checkout breaks quietly and costs money every hour it stays broken. On Shopify, the platform handles hosting and core security, and the hours go to apps, theme updates and checkout tests. On WooCommerce, the store owner also carries plugin and server updates.

Keep card fees out of the maintenance budget. Shopify's Basic plan charges 2.9 percent plus 30 cents per online card sale, which is a cost of selling, not of upkeep. Store build and running costs side by side are in the guide to what an ecommerce website costs.

Custom web apps carry the highest maintenance cost, because no vendor patches the code for you. Frameworks and packages ship security fixes several times a year, and each needs a developer to upgrade, test and redeploy. In December 2025, a React Server Components flaw rated CVSS 10.0 required every affected Next.js app to upgrade and redeploy. Budget at least eight hours a month for any app that handles logins or payments.

What happens when maintenance stops

Skipped maintenance fails quietly first. A plugin update breaks the contact form, and nobody notices because the site still loads. A certificate expires and browsers show a security warning. A server stays on an unsupported PHP version and stops getting security fixes.

Assume a roofing company in Texas averages 25 inquiries a month through its contact form. A form that breaks after an update and goes untested for 30 days loses close to a month of leads. At a 20 percent close rate and $9,000 per roof, five lost jobs cost $45,000. A five-minute form test after each update prevents that.

Automatic updates cover less than owners assume. WordPress has installed minor core releases in the background since version 3.7. Plugins and themes update on their own only if someone, or the host, switched auto-updates on for each one. A site with auto-updates on and no testing trades one risk for another.

Speed also decays without upkeep. New plugins, larger images and third-party scripts add weight every month, and slower pages start failing the Core Web Vitals report in Google Search Console.

How to set a website maintenance budget

Build the budget from line items, then compare plans against it.

1. List every fixed cost: hosting, security, monitoring, plugin and theme licenses.
2. Estimate monthly hours from the hours table above.
3. Multiply the hours by the rate each provider quotes.
4. Add the one-off jobs due this year, such as a PHP upgrade or an accessibility review.
5. Compare plans on hours included and response times, then on price.

Say a 10-person accounting firm in Arizona runs a 20-page WordPress site with a client login link and a monthly newsletter signup. Its budget at October 2026 list prices and the $100 rate looks like this:

Labor, meaning the care plan and the accessibility review, is 78 percent of that total. Fewer plugins and a stable design lower it faster than a cheaper host.

Questions to ask before you sign a maintenance plan

1. How many hours a month does the fee include, and what happens to unused hours?
2. How soon after a security release do you apply it?
3. Do you test updates on a staging copy before the live site?
4. Where are backups stored, how long are they kept, and when did you last test a restore?
5. What is the response time if the site goes down or gets hacked, and is cleanup included?
6. Whose accounts hold the hosting, domain and plugin licenses?
7. Can I cancel with 30 days of notice and receive every login?
8. Will you send a monthly report of updates applied, backups confirmed and hours used?

The monthly report in question eight is how you check the other seven without logging in. Clear answers to questions two, five and six matter most. A plan that patches monthly, has no cleanup clause or holds your accounts costs more in one bad week than it saves in a year.

Start with an inventory: list your plugins, licenses, hosting plan and the last date anyone tested your forms and backups. That list shows where your hours go. The website design and maintenance team at Techno Mantra handles WordPress, Shopify and custom-coded sites. Each plan states its hours and response times in writing. Send your inventory through the contact page or to info@technomantraa.com, and every inquiry gets a reply within one business day.