Website maintenance is the routine work that keeps a finished site working: updates, tested backups, monitoring, security checks and small edits. For a small business site, a decent plan usually costs between $50 and $300 a month, and the price depends more on what the site does than on how it looks.
Why a finished website still needs attention
A website runs on software, and software ages. The platform releases security fixes every few weeks, plugins get updated or abandoned, and the server software eventually reaches end of life. A site nobody has touched in two years is still online, but on parts the rest of the world stopped patching.
Some things expire on a schedule. SSL certificates have a fixed lifespan, and if renewal fails, visitors see a browser warning instead of your home page.
Other things break silently. The most common is the contact form: a host changes its mail settings, a spam filter tightens, and the form keeps saying "Thanks, we'll be in touch" while nothing arrives. You find out weeks later, from a customer.
And providers change things on their end: payment processors retire old APIs, booking tools change their embed code, a map widget starts asking for a billing account.
What a real maintenance plan includes
Most honest plans come down to five jobs:
- Updates, and checking afterwards. Applying updates is the easy half. The harder half is looking at the site after each one: does the menu open, does the form send, does checkout work.
- Backups that have been restored at least once. A backup that has never been used to rebuild a site is a hope, not a backup. Backups should live somewhere other than the server they protect and be tested by actually restoring them.
- Uptime and certificate monitoring. An automated check that visits the site every few minutes and tells a person when it is down, plus a warning before the certificate expires.
- Security checks. Reviewing who has admin access, removing accounts that should not exist, and keeping the protections from website security basics in place.
- Small content changes. New hours, a price change, a fresh testimonial. Most plans include a set amount of this time, and the honest ones say what counts as "small."
What a plan usually does not include
Maintenance keeps the site you have in working order; it does not turn it into a different site. Redesigns, new features like online booking, writing new pages, running ads and SEO campaigns are separate projects with their own scope and quote.
This is not stinginess. A plan is priced on predictable work. The moment a request becomes "can it also do X," it stops being predictable, and folding it into a flat fee means either you overpay in quiet months or the provider cuts corners in busy ones. If a plan promises "unlimited changes," ask what happens when you request a new feature.
How to read a maintenance offer
Offers list what they include. The useful information is in what they leave out. Ask these before signing:
| Question | What a good answer sounds like |
|---|---|
| Where are backups stored? | Off the server, where you could be given access. |
| Has a restore ever been tested? | Yes, on a date they can name, and on a schedule. |
| Who gets the alert at 2 a.m.? | A named person, with a stated response window. |
| Is there a contract term? | Month to month, or a short term with a plain cancellation clause. |
| Who owns the accounts? | You. Domain, hosting and admin logins are in your name and your email. |
| What is the response time? | A number of business days for normal changes, faster for outages. |
| Is hosting marked up? | Billed separately at cost, or the markup is stated. |
A provider who hesitates on ownership or restores is telling you something.
Realistic cost bands and what moves them
Monthly maintenance for a small business generally falls into three bands:
- $50 to $100: automated updates and backups on a simple site, with little human review and no content changes.
- $100 to $250: updates with a check afterwards, tested backups, monitoring, a security review, and about an hour of changes. Most five-to-ten page business sites belong here. My own care plan is $125 a month and includes updates, weekly tested backups, daily uptime and certificate monitoring, and one hour of changes.
- $250 to $600 and up: e-commerce, membership sites, or anything with several integrations. More moving parts means more to check after every update.
Three things move a quote up. The platform: a plugin-heavy site has more updates than a custom-coded one. E-commerce: a store has payment, tax and shipping plugins that all update on their own schedules. Integrations: every booking tool, CRM sync or payment gateway is one more thing a third party can change without telling you.
Sites built by someone else
Most maintenance relationships start with a site someone else built, often someone no longer around. A responsible provider will not apply updates to an unfamiliar site blind. The first step is a review: platform and version, which plugins are installed and which are abandoned, who has admin access, where the domain and hosting live, whether backups exist, and whether the form delivers.
That review produces a list of things to fix before routine maintenance makes sense. Sometimes it is three items; sometimes it becomes its own project, which the guide on recovering a neglected website covers. Get the list in writing.
The cancel test
The simplest way to judge a plan: imagine cancelling it tomorrow. What are you left with?
The right answer is everything. The domain in your registrar account. Hosting in your name. Admin logins you control. A current backup you can download. Cancelling should feel like ending a cleaning service, not like moving out and leaving the furniture behind.
If the answer involves a transfer fee, a "release" process, or a site that only works on the provider's platform, you do not have a maintenance plan. You have a lease. That can be fair, if it is stated up front.
Maintaining it yourself
Not every site needs a paid plan. If yours is small and you will spend thirty minutes a month, this routine covers the common failures.
- Submit your own contact form from a different email and confirm the message arrives.
- Click the padlock in your browser and check the certificate expiry date. If it expires within a month, find out who renews it.
- Check that domain and hosting renewals are on a card that works.
- Log in, review the user list, and remove anyone who no longer needs access.
- If you are comfortable, apply pending plugin updates one at a time and look at the site after each. If not, note what is pending and leave it for someone who is.
- Confirm a backup exists and download one copy somewhere you control.
What you should not do yourself: major platform upgrades, PHP version changes at the host, editing theme or plugin code, or cleaning up a compromised site. These are the tasks where a small mistake takes the site offline and the fix costs more than the prevention would have.
When to do it yourself, and when to call someone
If your site is a few pages on a mainstream platform, with no store and no integrations, and you will honestly do the monthly routine above, you can reasonably skip a plan. The work is not hard; doing it every month when nothing seems broken is.
Call someone when the site takes orders or bookings, when more than one third-party tool is plugged into it, when a customer has already told you about an outage, or when you know you will not do the routine. Paying someone for the boring part is reasonable, as long as the plan passes the cancel test.
Javier NapolesJavier Napoles is the founder of Argus Digital Works in Stamford, Connecticut. He designs, builds, secures and maintains websites for small businesses in Fairfield County and remotely, and holds CompTIA Security+. About Javier