Two care plans can list the same four things (updates, backups, security, uptime monitoring) and differ several times over in price. Usually neither is a rip-off. Website maintenance cost is set less by the task list than by how carefully each task is done, and by what happens on the day something breaks.
This guide explains those cost drivers, what a care plan should and shouldn’t cover, and how to compare quotes on equal terms. It doesn’t quote market rates, which vary too much by country, platform and site to be useful. We sell care plans ourselves, and our starting price is on our pricing page if you want a reference point.
The short answer
Website maintenance cost depends on the level of care, not the list of tasks: whether updates are tested before they go live, how often backups run and whether restores are tested, whether hack clean-up is included, how fast someone responds, and how much change time comes with the plan. The size and build quality of the site set the baseline. A good care plan keeps the site secure, online and working. It usually excludes new features, redesigns, third-party licences and hosting.
Where maintenance sits in your website running costs
A care plan is one line in your website running costs, and quotes often blur the lines. Separate them before comparing prices:
| Cost | What it pays for | Typically billed |
|---|---|---|
| Domain | Your address on the web | Yearly, by the registrar |
| Hosting | The server your site runs on | Monthly or yearly, by the host |
| Licences | Premium plugins, themes, page builders, fonts | Mostly yearly, by each vendor |
| Care plan | Updates, backups, monitoring, fixes and support | Monthly, quarterly or yearly |
| Improvement | New pages, features, content, SEO and conversion work | Per project, or from a retainer |
A plan that looks expensive may bundle hosting or licences; a cheap one may assume you pay for them separately. If you’re unsure what each layer does, our plain-English guide to how websites are built explains them.
Seven things that set your website maintenance cost
1. The site being looked after
The biggest driver is the site itself. A dozen well-chosen plugins on a clean build need less care than forty plugins, a page builder, a booking system and a shop. Every plugin has its own update schedule and its own chance of clashing with the rest, and payments, extra languages, custom code and CRM connections all add things to test.
Build quality matters as much as size. A site built on maintained plugins updates cleanly; a fragile one turns every round of updates into repair work. How to tell a solid WordPress build from a fragile one covers the signs.
Check it yourself. In WordPress, open Plugins and count the active ones. Note any nobody recognises, and any whose WordPress.org page shows no update for years.
2. How updates are applied
On most sites, WordPress applies minor core releases, which mainly carry security and maintenance fixes, automatically. Plugins and themes generally don’t update themselves unless someone switches that on, and they are where most of the work and risk sit. There are three ways to handle them:
- Automatic updates on the live site. Cheapest. Nobody checks what changed until a visitor finds a broken page.
- Manual updates on the live site, with a backup first and key pages checked afterwards. A sensible middle ground for simple sites.
- Updates tested on a staging copy first, then applied live. Costs more, and is worth it where a broken form or failed order costs real money.
Ask. When an update breaks something, is fixing it part of the plan or a separate bill?
3. Backups, and tested restores
Backups are cheap to run and easy to get wrong. Check four things:
- Frequency. Daily suits most business sites; a busy shop may need more.
- Location. Backups on the same server can disappear with it. Off-site copies survive a server failure or a hack.
- Retention. A hack can go unnoticed for weeks, so you need a clean copy from before it started.
- Tested restores. A backup nobody has restored is a hope, not a plan. Test restores take time, which is one reason plans that include them cost more.
4. Security monitoring and clean-up
Monitoring is the routine part: malware scans, a firewall, login protection and alerts for suspicious changes. The expensive part comes after a breach: finding the entry point, removing malicious code, restoring a clean version, resetting passwords and, if Google has flagged the site, requesting a review in Search Console.
Some plans include clean-up. Others bill it as emergency work by the hour, exactly when hourly rates hurt most. Our WordPress security guide explains which protections matter, so you know what a plan’s “security” line should mean.
5. Uptime and speed monitoring
Uptime monitoring checks your site is reachable and alerts someone when it isn’t. What matters is who receives the alert, at what hours, and what they do next.
Fewer plans watch speed, though it often matters more, because sites slow down gradually: a new plugin, an oversized image, a campaign tag never removed. Google’s Core Web Vitals give a clear yardstick: a Largest Contentful Paint of 2.5 seconds or less, Interaction to Next Paint of 200 milliseconds or less and Cumulative Layout Shift of 0.1 or less, measured at the 75th percentile of real page loads. Core Web Vitals explained covers each one.
6. Response times
Plans with identical task lists differ most here, because fast response means someone must be available. Read the terms:
- Response or resolution? “Response within four hours” may mean an acknowledgement, not a fix.
- Business days or calendar days? A Friday-evening problem may wait until the next working day.
- What counts as urgent? A site that’s down and a typo are different problems. Good plans define priority levels.
Pay for the speed your site needs. A brochure site with a few enquiries a week doesn’t need the cover of a shop taking orders every hour.
7. Included changes and developer time
Many plans include some content changes or developer hours each month. Check what counts as a “small change” (a photo, a price, a paragraph), whether unused time rolls over or expires, and whether extra work is quoted first or simply invoiced. If your team edits the site confidently, you may not need included changes. If every edit waits on someone else, included time is usually cheaper than paying per job.
What a care plan should cover, and what it usually doesn’t
Normally covered
A plan worth paying for sets out, in writing:
For the routine behind these, by week, month and year, see the website maintenance checklist.
Usually outside the plan
- New features and pages. Development work, normally quoted separately.
- Redesign work. Care keeps the current site healthy; it doesn’t replace one that no longer fits the business.
- Third-party licence fees. Premium plugins, page builders and fonts renew with their vendors, ideally in your company’s name.
- Hosting and domain. Separate bills, unless the plan explicitly bundles them.
- Content and marketing. Copywriting and SEO campaigns, though higher-level plans may include improvement time.
Grey areas to settle before you sign
- Server upgrades. Hosts retire old versions of PHP, the programming language WordPress is written in, and older plugins and themes can break when they do.
- Your own mistakes. If your team deletes a page, is restoring it included?
- Third-party changes. When a payment gateway or CRM changes how it connects, who repairs the integration?
Monthly plan vs hourly support vs in-house
Each option puts the risk in a different place.
| At a glance | Monthly care plan | Pay-as-you-go support | In-house |
|---|---|---|---|
| How you pay | A fixed, predictable fee | Hourly or per job | Staff time plus tools |
| Who notices problems | The provider’s monitoring | Usually a customer | Whoever watches the alerts |
| When something breaks | A response time in writing | When the provider has space | Depends who is away |
| Best for | Sites that bring in business | Very simple sites | Organisations with developers on staff |
| Watch out for | Lock-ins, vague task lists | Paying someone to relearn your site | Knowledge held by one person |
Pay-as-you-go looks cheapest in a quiet year. But nobody watches between jobs, and emergencies are exactly when you have least room to negotiate. In-house works if you already employ someone with WordPress experience and time to spare, plus tools for off-site backups and monitoring, and cover for when they’re away.
A website support retainer is a variation: a reserved block of time each month, often spent on improvements rather than routine care. Website pricing models explained shows how fixed prices, hourly rates and retainers add up over several years.
Questions that expose a weak plan
Ask these of any provider, including us.
| Question | Why it matters | Warning sign |
|---|---|---|
| When did you last test a restore? | Backups only matter if they restore | “Backups run automatically” |
| Are updates checked before or after going live? | Untested updates quietly break forms | No check at all |
| Is hack clean-up included? | It’s often the costliest single job a site needs | “We’ll quote at the time” |
| Does response time mean a reply or a fix? | The two can be days apart | Nothing in writing |
| What is the minimum term? | Lock-ins remove your leverage if service slips | A long term that renews automatically |
| Whose name are the accounts in? | You need them if you change provider | Domain, hosting or licences in the provider’s name |
Ownership matters most. Your company should be the domain registrant and the hosting account holder, with its own administrator login, so changing provider never becomes a negotiation.
Frequently asked questions
How much should a business budget each year to keep a website running?
Add up five lines for the next twelve months: care plan, hosting, domain renewal, premium licences and planned improvements. Ask each provider for a total on that basis, and size the care line by what a day offline or a hack would cost the business.
Is WordPress maintenance cost higher than a hosted builder like Wix?
There is usually more to pay for separately, because a hosted builder folds hosting, updates and security into its subscription. The trade-off is less control and a harder exit: WordPress needs someone to apply updates, but you own the site and can move it. WordPress vs Wix vs Shopify compares the platforms in more depth.
Does a website that rarely changes still need maintenance?
Yes. The software under the site keeps receiving security fixes whether or not anyone edits a page. A quiet site may suit a lighter plan, but it still needs updates, backups and monitoring.
Are my hosting company’s backups enough?
They are a useful safety net, but rarely enough alone. They may sit on the same infrastructure as the site, be kept only briefly or cost extra to restore, so keep an independent off-site copy you can reach yourself.
What to do next
Match the care to what the site does for the business. A quiet site needs the essentials done reliably. One that brings in leads every week justifies faster response and someone watching speed. One that should get better every month needs a continuous-improvement plan built on top of good care.
If you’d rather hand that care over, our website care plans come in three levels, from Essential, for sites that simply need to stay safe and online, to Growth, which adds monthly improvements and speed work. Every plan includes regular backups, security and uptime monitoring and hack clean-up, with response times in writing. Plans run month to month with no lock-in, from THB 1,500 a month, billed quarterly.
Taking over a site nobody has looked after for a while? Start with a free website audit. It shows how much catching up the site needs before you compare care-plan quotes.