Website Maintenance Cost: What You Pay For and What to Sign

Website maintenance cost is the monthly fee that keeps a site secure and operational. In 2027, retainers run €50 to €150 per month for headless static sites, €150 to €500 for active corporate websites, and €500 to €2,500+ for mission-critical web portals and e-commerce platforms with SLA guarantees.

The spread is wide because the phrase covers two very different things: automated monitoring that alerts when something breaks, and the engineering hours required to fix it. What follows is the money side and the contract side, which are the same conversation. Our website maintenance guide covers what the technical work itself involves, and maintenance packages compares how providers structure their monthly tiers.

A maintenance contract covers four things, and the difference between a good one and a cheap one is how many of the four it names explicitly rather than implying. Security updates and backups are the floor. Above that sit uptime monitoring, performance, and a defined amount of content or development work each month.

Security and updates. Core, plugin and dependency updates, applied on a stated cadence and tested rather than pushed blind. This is the part that most obviously goes wrong when nobody owns it.

Backups and restore. Not just that backups run, but how far back they go, where they live, and how long a restore takes. A backup nobody has ever restored is a hope.

Monitoring. Uptime, error rates and performance. According to Google's guidance on Core Web Vitals, these are field measurements of real visits, so they only tell you anything when someone watches them over time.

Included work. A number of hours or requests per month for content edits and small fixes. This is the line that decides whether the contract feels useful or feels like insurance you never claim.

Website maintenance costs €50 to €2,500+ per month depending on architecture, integrations, and how much engineering time comes included. The figures below reflect observed European agency proposals in 2027 rather than a single vendor price list. Our own published retainer tiers are on the website maintenance page.

A headless static or small brochure site of ten to twenty pages, with dependency updates, backups and monitoring but minimal monthly edits, generally runs €50 to €150 per month. An active mid-size corporate or B2B website with monthly content updates, staging tests, and a few hours of development runs €150 to €500 per month. A mission-critical web portal, e-commerce store, or platform with custom CRM and ERP integrations and a binding SLA starts around €500 and runs to €2,500+ per month.

Two hourly figures deserve as much attention as the base fee. Under a contracted retainer, additional engineering work typically bills at €90 to €120 per hour. Without a contract, calling an agency for an ad-hoc emergency incident costs €120 to €180 per hour, often with a three-hour minimum diagnostic block just to inspect unfamiliar deployment pipelines.

Price moves on four variables, and only one of them is the number of pages. Understanding which of the four applies to you is the difference between a quote that fits and a quote that looks cheap until the first incident.

Included work per month. The single biggest driver. A plan with two hours included and a plan with ten hours included are different products, whatever the tier names suggest.

Platform and dependencies: why monolithic plugin stacks cost 3x more. Architecture dictates baseline maintenance effort. A mid-market corporate website built on Headless Next.js with edge hosting averages around €900 per year in maintenance and infrastructure overhead because pages are compiled at build time, there is no live SQL database exposed to public traffic, and package upgrades are verified in automated CI/CD previews. By contrast, a managed WordPress site relying on 25 to 40 third-party plugins averages €3,000 per year, more than 3x the annual cost, because every plugin update can conflict with PHP versions, custom themes, or database schemas and requires manual visual regression testing on staging. Legacy custom PHP or monolithic e-commerce platforms average €6,600 per year once server patching, database tuning, and security audits are counted. When a legacy site's annual upkeep crosses €3,000 to €6,600, comparing that recurring spend against our website redesign cost analysis often shows that migrating to a modern static or headless stack pays back within 18 to 24 months.

Integrations. Every connected system, CRM, payments, booking, is a surface where an update on either side can break the other, and someone has to be responsible when it does.

Response commitment. A promise to respond within four hours costs more than a promise to respond within two business days, because it changes how the provider has to staff.

Two providers quoting the same site at €90 and €450 per month are usually not disagreeing about the site. They are quoting different products under the same word, and the brief did not force them to be explicit about which.

The €90 plan is typically automated updates, an automated backup and an uptime ping, with any human involvement billed separately. The €450 plan typically includes tested updates, a named contact, some hours of work and a stated response time. Both are legitimate offers. Only one of them answers the phone.

Ask each provider the same three questions and the gap explains itself: how many hours are included, what happens when the site is down at 9pm, and what the rate is for work beyond the plan. A provider who cannot answer those in writing has quoted a price, not a service.

The contract is where a maintenance relationship either works or turns into an argument, and the arguments are always about the same omissions. Six things belong in writing, and their absence is the finding rather than their wording. None of the six are unusual requests, and a provider who resists putting them on paper is telling you something useful.

1. Scope of updates, including who decides when a major version upgrade happens and who pays for it.
2. Backup retention and restore time, as numbers rather than as a promise that backups exist.
3. Included hours, what counts against them, and whether unused hours roll over.
4. Response time, split by severity, so that a typo and a dead checkout are not the same ticket.
5. The rate beyond the plan, agreed in advance rather than negotiated during an incident.
6. Exit terms: who holds the credentials, how the handover works, and what you leave with. This is the clause people skip and later regret.

If you're comparing specialist partners for this scope, review our WordPress to Next.js migration cost and TCO guide for fixed-price deliverables and SLA benchmarks.

Response time and uptime are the two numbers providers advertise and the two that are easiest to state misleadingly. Reading them properly takes about a minute and changes which offer looks better.

Response time is not resolution time. A four-hour response means somebody acknowledges the ticket and begins triage, not that the site is back online. A serious SLA splits incidents into three severity tiers with distinct targets: Severity 1 (Critical outage, broken checkout, or active security breach) typically carries a 1 to 2 hour response and a 4-hour restoration target; Severity 2 (Degraded functionality, broken CRM webhook, or form failure) carries a 4-hour response within business hours and next-business-day resolution; Severity 3 (Minor styling issue or content edit) carries a 1 to 2 business day response.

Business hours matter more than the headline number. Four hours within weekday office hours (09:00 to 17:00) means an outage at 18:00 on Friday waits until Monday morning unless you have 24/7 P1 cover. Retainers with true 24/7 critical response start in the €500 to €2,500+ monthly bracket because on-call engineers must be compensated regardless of whether an alert fires. Without an SLA retainer, calling an agency for an emergency fix bills at €120 to €180 per hour on a best-effort basis, compared to €90 to €120 per hour for contracted clients with priority queue access.

Uptime percentages hide their measurement window. 99.9 % measured monthly allows about forty-three minutes of downtime; the same figure measured annually allows nearly nine hours. Ask over what window it is calculated, whether scheduled maintenance windows are excluded, and what service credit applies if the target is missed.

A cheap maintenance plan is not automatically a bad one, but there is a specific pattern where it reliably costs more, and it is worth recognising before signing rather than afterwards.

The pattern is automation without ownership. Updates are applied automatically, nothing is tested, and the first anyone hears about a broken page is when a visitor mentions it. According to Google Search Central, rendering is deferred and resource-dependent, so a script that breaks after an update can remove content from the index without producing any visible error on the page.

The second pattern is the plan with no included hours. Every request becomes a small invoice, so the team stops making them, and the site quietly stops being updated. The cheapest plan produces the most expensive outcome, which is a site nobody maintains at all.

The test is simple: ask what happened the last time a client's update broke something, and who noticed first. The answer tells you which product you are buying.

Some things are almost never in a maintenance contract, and they are the ones that cause the awkward conversations. None of these are unreasonable to exclude. They are only a problem when nobody said so up front.

• New pages and features. Maintenance keeps what exists working. Building something new is a project, and it should be priced as one.
• Content writing. Publishing text you supply is usually included; writing it usually is not.
• Design changes. Adjusting a component is maintenance; redesigning a template is not.
• Third-party licence fees. Plugins, themes and services renew on their own schedule and are commonly billed on to you.
• URL changes and redirects. If pages are removed or moved, someone has to handle the redirects. According to Google Search Central, those should resolve in a single hop, and that is real work.
• Recovery after a compromise. Cleaning a hacked site is usually billed separately, and the contract should say so plainly rather than leaving it to be discovered.

Comparing maintenance offers is straightforward once they describe the same product, and impossible before. Normalising three quotes takes about half an hour and removes most of the apparent difference between them.

Build one sheet with a row for each of these: included hours, hourly rate beyond the plan, update cadence, whether updates are tested, backup retention, restore time, response time by severity, hours of cover, monitoring scope, and exit terms. Fill every cell for every provider, including the blanks, because a blank is the finding.

Then price the gaps. If one plan includes two hours and another includes eight, add six hours at the first provider's rate before comparing the monthly figures. Most of the spread disappears at this step, and what remains is a genuine difference in what you are buying.

If you would rather not run that comparison yourself, our maintenance plans publish the same rows, and our pricing page shows where they start.