Website Maintenance Cost: What You Should Pay in 2026

Ask five agencies what website maintenance costs and you get five numbers with no line items attached. That is the whole problem. Maintenance is not one thing. It is two very different jobs bundled under one invoice line, priced so you cannot tell which one you are buying.

Job one is keeping the site alive: hosting, SSL, backups, updates, uptime checks. It is largely automated and it is cheap. Job two is making the site better: new pages, speed work, conversion changes. That is human labor and it is worth real money.

Most padded maintenance plans charge job-two prices for job-one work. Here is how to tell the difference on your own invoice.

What should website maintenance cost per month?

The infrastructure floor is under $40 a month. WP Engine's entry managed-WordPress plan, Essential, lists at $30/mo for one site and 25,000 monthly visits. A TLS certificate from Let's Encrypt — a nonprofit certificate authority — costs $0. WordPress core security fixes ship free via auto-updates. Everything you pay above that floor is somebody's time.

So the real question is never “how much is maintenance.” It is: how many hours of human work am I buying, and what are those hours doing?

Verdict: a keep-alive-only plan that costs more than roughly $100-$150 a month is being marked up, not managed. A plan that costs $2,000 a month and never ships a new page is a growth retainer that quietly stopped growing. We publish our own numbers on the pricing page for exactly this reason — “call for a quote” is where padding hides.

What is your maintenance plan actually paying for?

Almost all of it is plugin babysitting. According to Patchstack's State of WordPress Security in 2026, 11,334 new vulnerabilities were found in the WordPress ecosystem in 2025 — a 42% increase over 2024 — and 91% of them were in plugins, 9% in themes, and only 6 in WordPress core.

Read that again. The core software that runs more than 43% of the web had six reported issues, all low priority. Your risk lives entirely in the 20-odd plugins somebody installed on your site three years ago.

That reframes what you are buying. You are not paying an agency to protect WordPress. You are paying them to manage the plugin stack they chose — and the honest fix is often to delete half of it, which takes an afternoon and then costs nothing forever. It is the same gap we describe in what WordPress SEO services can and cannot fix: the platform is rarely the problem, the pile on top of it is.

What is the difference between keeping the site alive and making it better?

Keep-alive stops the site from breaking. Make-it-better makes the site earn. Keep-alive is mostly a machine's job and should cost tens of dollars a month. Make-it-better is a senior human's job and starts in the hundreds. Conflating them is how a $60 hosting bill becomes a $600 invoice.

Verdict: if your monthly report lists only rows from the top half of that table, you are paying a retainer for a cron job. If it lists rows from the bottom half, you are paying for marketing — and it should be measured in booked calls, not in “updates applied.”

Which maintenance line items should be nearly free?

Four of them, and together they are most of what a cheap plan bills you for. SSL is $0 from Let's Encrypt. WordPress core security releases are free and auto-applied — WordPress.org states the security team backports fixes so older sites still receive critical updates automatically. Backups are bundled into essentially every managed host. Uptime monitoring is a script hitting your homepage.

But cheap does not mean safe, and this is where the argument cuts both ways. Patchstack's 2026 whitepaper reports that the weighted median time from disclosure to first observed exploit is 5 hours, and that in their pentest of popular hosting companies, only 26% of vulnerability attacks were blocked by the hosts' own defences.

Worse: Patchstack found that 46% of 2025's vulnerabilities did not receive a patch from the developer by the time of public disclosure. So “we keep your plugins updated” is not the security guarantee an agency implies it is — for nearly half of disclosed issues, there was nothing to update to.

The operator conclusion: pay for a small plugin surface, not a large maintenance plan. Every plugin you delete is a line item you never have to buy again.

What questions expose a padded maintenance invoice?

Five, and they take about ten minutes to send. Ask them in writing. The answers — or the silence — will tell you more than any proposal deck.

• Who is the host, and what is the plan name and list price? If they will not name it, they are reselling hosting at a markup and calling it maintenance.
• How many plugins are on the site, and can I have the list? More than 15 on a brochure site is a red flag. That list is your bill.
• How many human hours went into maintenance last month, and on what? “Routine updates” is not an answer. Ask for the ticket log.
• What did you ship last quarter that a visitor would notice? If nothing, you have a growth retainer that only does keep-alive.
• If I leave, do I keep the hosting account, the codebase, and the backups? The answer must be yes. Anything else is hostage-taking.

That last one matters more than people expect. Ownership of the site, the accounts, the backups, and the content is non-negotiable, and it is the same reason we work month-to-month with no minimum term. An agency that needs a 12-month lock-in to keep you is telling you what it thinks of its own work.

Do you need a maintenance plan if your site is not on WordPress?

Mostly no — a statically hosted site has near-zero keep-alive cost. Cloudflare Pages' free tier includes unlimited sites, unlimited bandwidth, unlimited static requests, and SSL that works out of the box, at $0. Its paid Pro tier is $20/mo billed annually. There is no database to back up, no PHP to patch, and no plugin stack to babysit.

That is not a small detail. It is an argument. If 91% of WordPress vulnerabilities live in plugins, a prebuilt site with no plugins removes almost the entire category of work you are currently being billed for. We cover the tradeoffs in Next.js vs WordPress for marketing sites.

The honest catch: the cost does not vanish, it moves. On WordPress, a non-technical owner can edit a page. On a static site, someone has to deploy. Budget for the person who ships changes, not for the person who applies patches. That is the trade, and for most HVAC, plumbing, dental, and law-firm sites we think it is the right one — the website design work is front-loaded, not rented forever.

When does a maintenance retainer become a growth retainer?

The moment the scope includes new pages, keyword targeting, speed work, or conversion changes, you are buying marketing — and it should be priced, scoped, and measured like marketing. That means a target, a report you can read in 60 seconds, and a number that ties back to booked calls.

This is the line most agencies blur on purpose. “Maintenance” is a comfortable word for a bill nobody audits. “Growth” invites the question you should be asking every month: what did this produce?

Our stance is blunt. If a channel produces no qualified leads in 90 days, kill it — that applies to a maintenance line item as much as to an ad campaign. And you should never sign a 12-month term to find out; long contracts protect the agency, not you. Cheap-and-vague is its own trap, which is the same pattern we break down in what you actually get from cheap SEO services.

If your maintenance invoice has no line items, start there: get the host name, get the plugin list, get the hours. Then decide how much of that money should be buying growth instead. Our pricing is published with no call required, and if you want a second opinion on what you are being charged for, Get my free audit.