Website maintenance cost, and what happens without it

Almost nobody in Australia searches for this.

Measured on 31 July 2026 and recorded in research/national-volume-au.json, “website maintenance cost” returned no measurable Google search volume at all. Not a low number. A null. AI assistants recorded seven prompts a month for it, from research/ai-vol-keywords.json. For comparison, the cost of building a website draws around 390 searches a month and 468 prompts a month on the plain-language question.

That gap is the most useful thing on this page. People research what a website costs to build with real energy, and effectively nobody researches what it costs to keep. Maintenance is not an unpopular topic. It is an invisible one. It becomes visible at a bad moment. That might be when the site is down, when a form has been silently failing for a month, when a renewal invoice arrives from a company nobody recognises, or when a business discovers its site has been serving somebody else’s content since March.

So this page exists despite the absence of demand, because the absence of demand is the problem it describes. It is here for the person who has been handed a maintenance retainer and has no idea what they are being asked to pay for. It is also here for the person who was handed nothing at all and does not yet know that this is now their job.

Website maintenance cost is usually quoted per month, not as a one-off. That single fact trips people up: a monthly figure looks small next to a build cost, so website maintenance costs get waved through without the same scrutiny a quote gets. This page sets out what a fair monthly maintenance cost buys, and what a low monthly cost is quietly leaving out.

What website maintenance actually is

Maintenance is a bundle of unrelated tasks sold under one word, which is part of why it is hard to evaluate. Underneath, it is usually these:

Software updates. Every site sits on a stack of software: the platform, its theme, its plugins or extensions, the server language. On a WordPress site that means plugin updates and core WordPress updates specifically — a typical WordPress build carries a dozen or more plugins, each shipping its own updates on its own schedule. All of it is updated regularly, often for security reasons, and updates occasionally conflict with each other. Someone has to apply them and check nothing broke. Doing this on a schedule is maintenance. Doing it once a year is an incident waiting to happen.

Backups. Regular copies of the files and the database, stored somewhere other than the server they came from, and tested. An untested backup is a belief, not a backup. The question worth asking is not “do you take backups” but “how long would it take to restore this site, and when did you last do it”.

Security. Firewalls, malware scanning, login protection, SSL certificate renewal, and patching known vulnerabilities promptly. This is the part of maintenance most worth paying for regularly rather than skipping: small business sites are not targeted personally. They are found by automated scanners that check the entire internet for known weaknesses, which means a gap in security monitoring is discovered by machines within days, not months.

Hosting. The server the site runs on, its bandwidth, its storage, and whatever performance and uptime it provides. Frequently bundled into a maintenance fee, which makes both harder to evaluate.

Uptime and error monitoring. Something watching the site and telling a human when it stops responding. Without this, the way you learn your site is down is a customer telling you, and by then it has been down for a while.

Support hours. A block of time each month for changes: new staff photograph, revised opening hours, a service added, a price list swapped. This is the part clients value most and the part quoted most vaguely.

Reporting. A record of what was done. Modest in cost, and the only thing that makes the rest verifiable.

Ongoing maintenance, per month Figures withheld. Each band must be drawn from at least 10 delivered projects and the dataset must be reviewed and released before any number is shown.

What it is	Typical	Range	Projects
Ongoing maintenance (per month)	Withheld — not yet reviewed

Figures not published. The pricing dataset has not been reviewed and released, so no figure is shown here. The site is built to refuse to render prices in this state rather than show a provisional number. What is published and what is not.

Why every figure on this page is withheld (6 reasons)

• dataset status is "PLACEHOLDER_UNREVIEWED", not "VERIFIED"
• dataset publishable is false, not true
• GST treatment has not been stated — ACL s48 requires it explicitly, at equal prominence
• the dataset has not been dated — undated figures are not citable
• the collection method has not been written down — an unsourced figure is an assertion
• no band passes the band-level audit

Why website maintenance costs are sold monthly, per month

Three reasons explain why website maintenance costs are billed per month rather than as a single upfront cost, and they are not all in your interest.

The genuine one is that the work is genuinely continuous. Updates ship weekly. Threats are constant. Backups are only useful if recent. This is not a task with an end, so a per-month cost fits the shape of the work.

The practical one is that a monthly cost converts an unpredictable expense into a predictable one, for both sides. You know your outgoing costs. The supplier can staff for it.

The commercial one is that recurring monthly revenue is worth more to an agency than one-off project revenue, which is why maintenance costs get sold with more enthusiasm than they are specified. That is not a reason to refuse a monthly maintenance cost. It is a reason to insist the inclusions are written down.

What “included hosting” hides: security, monitoring and regular updates

Hosting bundled into a website maintenance fee is where most of the ambiguity lives.

The immediate issue is that you can no longer see what either component costs. Website maintenance and hosting, sold as one line, hide two separate costs behind one number. That means you cannot compare it with anything, and you will not notice if the hosting underneath is being run on the least expensive shared plan available while the fee stays constant.

The larger issue is control. Ask these:

• Whose account is the hosting in. If the site sits inside a supplier’s reseller account under their billing, you do not have direct access to your own site’s server, and leaving means asking someone to help you leave.
• Whose name is the domain in. Domains are the sharp end of this. A domain registered in a supplier’s name, or with their contact details, is difficult to recover if the relationship ends badly or the supplier simply stops answering. Check your registrar record today. It takes two minutes and it is the highest-value check on this page.
• What kind of hosting is it. Shared, virtual private, or managed. The differences are real and affect how the site performs under load.
• What is the actual resource allocation, and what happens if you exceed it.
• Does it include a certificate, and is it renewed automatically.
• Where is the data hosted. If your site handles personal information, where that information is processed is a question with legal weight, and Australian privacy obligations for small businesses are under active change. Worth getting advice specific to your situation rather than assuming.
• Can you export everything, on request, in a form another supplier could use, without a fee.

A fair arrangement can absolutely include hosting. What it should not do is make hosting the thing that keeps you.

What is not usually included: WordPress plugins and maintenance services

Website maintenance retainers are for keeping the existing site working — on a WordPress site, that is largely plugin and theme updates plus security patching. They usually do not cover new pages beyond the support allowance, redesigns, new functionality, content writing, search or advertising work, or third-party subscriptions the site depends on. Anything outside the retainer is normally billed by the hour.

Hourly rate for ad-hoc work Figures withheld. Each band must be drawn from at least 10 delivered projects and the dataset must be reviewed and released before any number is shown.

What it is	Typical	Range	Projects
Hourly rate for ad-hoc work	Withheld — not yet reviewed

Figures not published. The pricing dataset has not been reviewed and released, so no figure is shown here. The site is built to refuse to render prices in this state rather than show a provisional number. What is published and what is not.

Why every figure on this page is withheld (6 reasons)

• dataset status is "PLACEHOLDER_UNREVIEWED", not "VERIFIED"
• dataset publishable is false, not true
• GST treatment has not been stated — ACL s48 requires it explicitly, at equal prominence
• the dataset has not been dated — undated figures are not citable
• the collection method has not been written down — an unsourced figure is an assertion
• no band passes the band-level audit

That is reasonable, provided the boundary is written down. Where it is not, every request becomes a negotiation, and the relationship sours over amounts too small to be worth arguing about.

What happens when nobody maintains a website

Not much, at first. That is the trap. A neglected site works fine for months, which reads as evidence that maintenance was unnecessary, right up until it is not.

The realistic sequence, roughly in the order it tends to arrive:

The contact form stops delivering. A mail setting changes, or a spam filter reclassifies the sender, and enquiries stop arriving. There is no error and no notification. The business concludes the market has gone quiet. This is the most common and most expensive failure on this list, and it is entirely invisible without monitoring.

The certificate expires. Browsers put a full-page security warning in front of your site. Most visitors leave immediately.

The site slows. Accumulated extensions, unoptimised images and an ageing platform gradually make pages slower, particularly on mobile data. Slow pages lose people before anything else has a chance to work.

Something breaks after a platform update applied automatically. A layout collapses, or checkout stops. Nobody notices until someone rings.

The site is compromised. Outdated software is found by an automated scan and exploited. Outcomes range from spam pages injected into your site, to redirects sending your visitors elsewhere, to your domain being flagged as unsafe in search results and browsers. Cleaning it up costs more than years of maintenance would have, and reputation with search engines recovers slowly.

Recovery is impossible because there is no backup. The point at which a business discovers the backup situation is almost always the point at which it needs one.

Nobody knows where anything is. The developer has moved on, the hosting is in a defunct company’s account, the domain contact is an email address nobody can access. This is not a technical problem, it is an administrative one, and it is the hardest of the lot to unwind.

Common questions about website maintenance cost

What is included in a website maintenance package? Usually software updates, backups, security patching and monitoring, hosting, uptime and error monitoring, a block of support hours, and a report. What is included varies enormously between suppliers, and a retainer that does not itemise those seven things is not specified.

Is my domain in my name? Check your registrar record today. A domain registered in a supplier’s name, or with their contact details, is difficult to recover if the relationship ends badly or the supplier stops answering. This takes two minutes and is the highest-value check on the page.

What happens if nobody maintains a website? Nothing, at first, which is the trap. Then the contact form silently stops delivering, the certificate expires, the site slows, an automatic platform update breaks something, and eventually outdated software is found by an automated scan and exploited. Cleaning that up costs more than years of maintenance would have.

What to ask before signing a maintenance agreement: maintenance cost, security updates and more

• What exactly is included, itemised, and what is explicitly excluded.
• How many support hours a month, whether they roll over, and the rate beyond them.
• How often are backups taken, where are they stored, and when was a restore last tested.
• How quickly are security updates applied.
• What is the response time when something is broken, and is there any cover outside business hours.
• Is hosting included, and if so, what would it cost separately.
• Is the domain in my name, with me holding the registrar account.
• Do I get a report, and how often.
• Is the figure inclusive or exclusive of GST.
• What is the notice period, and on exit, do I get a full export of files and database without a fee.

The last one matters most. A maintenance arrangement you can leave cleanly is one both sides have to keep earning.

Band figures are withheld while the dataset behind them is marked unreviewed, and the reasons are itemised in the pricing dataset. Everything above is answerable today, by the person currently maintaining your site, or by whoever would if anyone did.

If you are still at the quote stage, how a website quote is built up covers the build side. Packaged website work covers what a fixed bundle does and does not include after launch.

This is written by someone who also runs a web design agency that sells maintenance retainers, which is the section of this page where that is most worth remembering.