A website is not a thing you buy once. It sits on software that gets security patches, in browsers that change, pointed at a domain that expires, running code that depends on other people's code. Left alone for two years it does not stay the same — it degrades.
Maintenance plans are also where a lot of vague invoicing happens, so here is what should be in one and what should not.
What a real plan covers
- Security updatesCore, plugin and dependency patches applied promptly. On WordPress this is the single most important line: the overwhelming majority of hacked sites were running a known-vulnerable plugin with a fix already available.
- Backups that have been restoredOff-site, automated, and — this is the part that gets skipped — actually tested by restoring one. A backup nobody has ever restored is a hope, not a backup.
- Uptime and error monitoringSomething that tells your developer the site is down before your customer does. Cheap to set up, and the difference between ten minutes of downtime and a weekend of it.
- SSL, domain and DNSRenewals tracked and certificates auto-renewing. An expired certificate shows every visitor a full-page security warning, and it is always avoidable.
- A small change allowanceAn hour or two a month for copy edits, a new team photo, a price update. Without it every trivial change becomes a quote, and things stop getting done.
- A performance checkCore Web Vitals drift as content is added. A quarterly look keeps a fast site fast instead of discovering in a year that it is not.
What is usually padding
- "SEO included"Bundled into a maintenance fee with no deliverable attached, this is almost always nothing. Real SEO work has outputs you can look at. Ask what specifically was done last month.
- "24/7 support"Ask what the actual response time is at 2am on a Sunday, and what happens if it is missed. For most business sites, next-business-day is honest and sufficient — and you should not pay for a promise nobody intends to keep.
- Hosting marked up several times overManaged hosting with real value added is worth paying for. A reseller account resold at four times cost, with nothing added, is not. Ask what you would pay directly.
What it should cost
For a small business brochure site, a plan covering everything in the first list is a few thousand rupees a month. For an e-commerce store, more — there is more to break, and downtime costs money directly. For a custom platform, plan for roughly 15–20% of the original build cost per year, which sounds like a lot until the first time a dependency ships a breaking security patch.
The one thing that is never worth saving: going unmaintained. Recovering a hacked WordPress site costs more than three years of maintenance, and that is before the Google "this site may be hacked" label that follows it around for weeks.
If you maintain it yourself
Perfectly reasonable, and for a simple site it is not hard. Put four things in a calendar: check for updates monthly, verify a backup restores quarterly, renew the domain before it expires, and look at the site on a phone every so often. Those four cover most of what goes wrong.
Keep your own admin credentials and hosting access regardless of who maintains it. That is the difference between changing supplier and starting over.
Frequently asked questions
Do I need maintenance if my website never changes?
Yes, and arguably more. A site nobody looks at is a site where an expired certificate or a compromised plugin goes unnoticed for months. The content not changing does not stop the software underneath it changing.
What happens if I stop paying for maintenance?
Nothing, immediately — which is why it is easy to cancel. Over six to twelve months, updates stop being applied, the vulnerability window widens, and eventually something breaks or gets exploited. It is a slow risk, not a sudden one, which is exactly what makes it easy to underrate.
Can I move my maintenance to a different company?
Yes, provided you hold the accounts — domain registrar, hosting, and the code repository. If you do, a handover is straightforward. If your current provider holds them in their own name, sort that out first; it is the single most common way small businesses get stuck.
Want this applied to your project?
Send us what you have — even a rough note. You'll get a written scope, a fixed quote and a delivery date within one business day, with no obligation.