Website Maintenance: What It Costs and What Goes Wrong
Most website maintenance plans check the software and stop there. For a B2B company, the expensive failures are quieter: a quote form that stops reaching sales, a certificate nobody renewed, a backup nobody ever restored. What a plan should cover, what it costs, and a monthly checklist you can copy.
A website maintenance plan that only checks the software is insurance for the website, not for the business. Most plans keep WordPress updated, take backups and watch for downtime. Those things matter, and they are cheap to automate. The failures that cost a B2B company real money are quieter: a quote form that stops reaching sales, a CRM sync that breaks after an update, a certificate nobody renewed, a backup that turns out not to restore. Below is what a plan for a site that brings in leads should cover, what the published prices actually buy, what goes wrong when nobody is watching, and a monthly checklist you can copy.
What a website maintenance plan should cover
A website maintenance plan should cover three layers. Each one answers a different question, and each one costs more to do properly than the one before.
| Layer | The question it answers | What it includes | Who usually covers it |
|---|---|---|---|
| 1. Keep it running | Is the site up, current and safe? | Software updates tested before they go live, daily backups, a test restore, security monitoring, uptime alerts, certificate and domain renewals | Almost every plan, often by automated tools |
| 2. Keep it producing | Is the site still sending us leads? | Test submissions of every form and quote path, checks that leads reach the CRM and the right inbox, integration health, page speed on the pages that sell | Few plans, because it needs a person who knows your business |
| 3. Keep it improving | Is the site doing better or worse than last quarter? | A monthly report against business numbers, a quarterly review of what to fix next | Plans priced for companies whose site carries revenue |
Most of what ranks for "website maintenance plan" describes layer 1 well. Hostinger's guide, for example, covers seven areas (security, updates, backups, performance, user experience, content and SEO) and gives a schedule for most of them. It is a sensible list. What none of the common guides asks is the question an owner of a $10M manufacturer actually cares about: did any RFQs get lost this month?
That is the gap between a plan for a blog and a plan for a business. A blog that goes down for an afternoon loses readers. A B2B site whose quote form silently stops working can lose a month of inquiries before anyone notices, because the site still looks fine.
What website maintenance costs
Here is what the most visible cost guides say. We checked each page on October 13, 2026.
| Type of site | Monthly range | Source |
|---|---|---|
| Small business website | $30 to $250 | WebsiteSetup |
| Mid-size business or marketing site | $250 to $750 | WebsiteSetup |
| Ecommerce website | $500 to $2,500 | WebsiteSetup |
| Large corporate or enterprise site | $1,000 to $5,000+ | WebsiteSetup |
| Agency maintenance packages | $200 to $2,500 or more | WebsiteSetup |
| Most agency care plans | $100 to $150 | The Admin Bar |
Two more data points are useful for a company your size. Hyperping, an uptime monitoring company, suggests budgets by company revenue: $500 to $1,500 a month for a business with $1M to $10M in revenue, and $2,000 to $5,000 or more above $10M (Hyperping). It gives no source or method for those bands, so read them as one vendor's estimate. And WebFX, a large agency, lists its own WordPress maintenance plan at $350 a month (WebFX), although the ranges elsewhere on the same page contradict each other.
So why would anyone pay $1,000 a month when most plans cost $150? Because the two are usually not the same product. A $100 to $150 plan is almost always layer 1: automated updates, automated backups, an uptime monitor, and a person who steps in when something fails loudly. That is fine for a brochure site. It is priced so that one person can look after many sites, which means nobody has time to submit your RFQ form every month, read the CRM record it creates, or notice that inquiries fell by a third after an update.
What you pay for at the higher end is a person who knows your site, your integrations and your numbers, checking layers 2 and 3. If a plan costs more and does not include those, you are paying for the name.
What goes wrong when nobody is watching
Here are the failures that matter most for a site that brings in leads. None of them shows up as "the site is down," which is why an uptime monitor alone will not catch them.
A form stops reaching the people who sell. The form still loads and still says "thank you." But the notification goes to someone who left the company, lands in spam, or the connection to the CRM broke after an update. Nobody complains, because the buyer who sent it assumes you were not interested.
The spam check changes under you. Google moved its reCAPTCHA Classic keys into Google Cloud projects, with automated migration finished in the first quarter of 2026. Google's free allowance is 10,000 assessments a month, and above that, without billing set up, "reCAPTCHA returns an error for any new request" (Google Cloud documentation). Depending on how your form was built, that either switches the spam check off without telling you, or blocks real inquiries. Either way, the site looks normal.
A plugin with a known hole sits unpatched. Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, and 91% of them were in plugins (Patchstack, State of WordPress Security in 2026). The speed is the worrying part: 46% of vulnerabilities had no fix from the developer when they were made public, and Patchstack puts the weighted median time to first exploit at 5 hours. WordPress runs 40.1% of all websites (W3Techs, October 2026), so this applies to a lot of B2B sites.
A certificate expires. The certificate that puts the padlock in the browser has to be renewed, and it is about to need renewing much more often. The CA/Browser Forum, the body that sets the rules for these certificates, is cutting the maximum lifetime in steps from 398 days to 47 days by March 2029 (DigiCert). Automated renewal handles most of this, until the automation fails on a subdomain nobody remembers, such as the one your quote portal runs on.
How long a website certificate can last
The software underneath runs out of support. Your site's code runs on a version of PHP (or another language) that gets security fixes for a fixed time. PHP 8.2 stops receiving security fixes on December 31, 2026, and PHP 8.3 a year later (PHP.net). A site that cannot move to a supported version because an old plugin or theme breaks on it is a site that is getting harder to keep safe every month.
The backup exists but does not restore. Most plans report that backups ran. Far fewer test that one can be restored. You find out which kind you have on the worst day to find out.
The site gets slower, a little at a time. A new tracking script, a chat widget, three large images on the home page. No single change is dramatic, and nobody measures until the site feels slow on a phone.
A renewal lapses. The domain, a premium plugin license or a form tool subscription sits on a card that expired, or under the login of someone who left. The first sign is a broken feature.
A maintenance plan that only checks the software is insurance for the website, not for the business.
If any of these sound familiar, the more useful question is not "do we have a plan," but "who would notice, and how soon?"
Hosting, maintenance, care plan or retainer?
These four words get used as if they mean the same thing. They do not, and mixing them up is how a company ends up paying for hosting it thinks includes maintenance.
- Hosting is the server your site lives on and the company that keeps that server online. It is rent.
- Maintenance is the work done on the site itself: updates, backups, security and fixes.
- A care plan is a fixed monthly package of maintenance, usually with monitoring and reporting. The terms "maintenance plan" and "care plan" mean the same thing in practice.
- A retainer is a monthly agreement for a team's time and judgement, which can include care, new work, strategy or all three.
Hosting choices still matter, because they decide how much of layer 1 you get for free. For a B2B company, the three common types work out like this:
| Hosting type | What it is | Fits | Watch for |
|---|---|---|---|
| Shared hosting | Your site shares one server with many others | Small brochure sites with modest traffic | Slowdowns and security exposure from neighbors on the same server |
| VPS (virtual private server) | A reserved slice of a server, with its own resources | Teams with a developer who wants control | You or your developer run the server, including its security |
| Managed WordPress hosting | Hosting built for WordPress, often with backups, staging and caching included | Most B2B marketing sites on WordPress | It covers the server and some updates, not your forms or integrations |
As Peter Krzyzek, our co-founder and CTO, has put it about the middle option: "VPS hosting is great for one, and only one, main reason: flexibility." If nobody on your team wants that flexibility, it is mostly extra work. For most WordPress sites we look after, we recommend managed hosting, then a care plan on top for the work no host does. Whatever you choose, compare the renewal price, not the first-year price, and check that the host's uptime guarantee is in writing.
How to run maintenance that protects your leads
This is the routine we would want any company to have, whether you do it in house, buy a plan, or both. The checklist after this section turns it into a list you can copy.
Make an inventory of every account and every date
Before you can maintain a site you need to know what it depends on. List the domain registrar, the DNS provider, the host, the platform, every plugin or app, every form tool, the CRM, email tools, analytics, the certificate, and any paid license. Next to each one, write who owns the login, which card pays for it, and when it renews.
Make sure every account is in your company's name, not your old agency's or a former employee's. Our docs guide on owning your website accounts explains why this matters before anything else does.
Test the paths that make money, every month
This is the step most plans leave out, and the one that protects your pipeline. Every month, submit every form on the site as if you were a buyer, and follow the inquiry all the way to the person who answers it.
How to do it
- List every form and quote path: contact, RFQ, quote request with file upload, product configurator, newsletter, careers. Note where each one should end up.
- Submit each one with a clearly marked test name, such as "TEST, October maintenance check."
- Confirm three things for each: the notification arrives in the right inbox, the record appears in the CRM with the right source, and analytics records a conversion.
- For any form that accepts files, upload the formats your buyers actually send, such as a PDF drawing and a STEP file, and check that they arrive intact.
- Delete or tag the test records so they do not pollute your numbers.
See a worked example
A filled-in log line reads like this: "October 7. RFQ form, file upload (PDF, 2 MB): notification received by sales@ within a minute, HubSpot contact created with source 'Website RFQ', analytics conversion recorded. Contact form: notification received, but the HubSpot record shows source 'Offline'. Ticket opened." That second line is the kind of problem that skews every lead report for months if nobody looks.
Tools and guides to use
Our docs guide on testing your contact and order forms walks through each check. If you are not sure which pages and forms your buyers rely on most, our article on what manufacturing buyers check before they send an RFQ maps the path from first search to quote.
Steal our AI prompt
I maintain the website for a B2B company. Below is a list of every form on our site, where each one is supposed to send its submissions (email address, CRM, other tools), and the notes from this month's test submissions. Build me a pass or fail table for each form against three checks: notification received, CRM record created with the correct source, analytics conversion recorded. Flag anything that looks like a silent failure, suggest the most likely cause for each fail, and list what I should check first. Forms and notes: [paste]
Update on a copy, back up first, and prove the backup restores
Updates should go to a staging copy of the site first, then live once the key pages and forms still work. Take a backup before every batch of updates, so one bad update is one step to undo. On WordPress, a single broken plugin can usually be rolled back on its own with a tool like WP Rollback, without restoring the whole site.
Once a quarter, restore a backup to a staging site and click through it. A backup you have never restored is a hope, not a plan.
How to do it
- Check that the last backup finished in the past day and that you keep at least 30 days of them.
- Confirm at least one copy is stored somewhere other than your host's server.
- Each quarter, restore the newest backup to staging, then load the home page, a product page and the RFQ form.
- Write down how long the restore took. That is your real recovery time.
Guides to use
Our docs guides on verifying your backups and restoring from a backup, and Patchstack's public vulnerability database to check whether a plugin you run has a known issue.
Put every expiry date on a calendar
Most of the failures above are dates: a certificate, a domain, a license, a software version that stops getting fixes. Put each date from your inventory on a shared calendar with a reminder 30 days ahead. Check the certificate on every subdomain, not just the main site. Check the PHP version your host is running against the dates on PHP.net's supported versions page, and if you are on 8.2, plan the move before December 31, 2026. Our docs guide on end-of-life software explains what to do when a version ages out.
Ask for a report against business numbers
A monthly maintenance report that lists 14 plugin updates tells you work was done. It does not tell you whether the site is producing. Ask for a report that shows:
- What was updated, and whether anything broke.
- The date of the last successful backup and the last test restore.
- Uptime for the month and any security events.
- A pass or fail for every form and integration test.
- Page speed on your three to five most important pages, from PageSpeed Insights.
- Every date that expires in the next 90 days.
- Your main number for the month, such as qualified inquiries or RFQs, next to last month and the same month last year.
That last line is the one that changes the conversation. If inquiries fall and every technical check passed, the problem is not maintenance, and the report has just told you so. Our free Conversion Leak Scorecard is a quick way to get a first read on whether your key page is the problem.
The monthly website maintenance checklist
Copy this into your task tool or a shared doc. Each line is a pass or fail. The lines marked monthly are the minimum for a site that brings in leads.
Monthly website maintenance checklist
Every month
- Software, plugin and theme updates applied on staging first, then live
- Backup taken before updates, and the last backup finished in the past 24 hours
- At least 30 days of backups kept, with one copy off the host's server
- Every form and quote path test-submitted, including file uploads
- Each test reached the right inbox, created a CRM record with the right source, and recorded a conversion in analytics
- Integrations checked: CRM, email marketing, chat, configurator or quote tools
- Uptime report reviewed, and any downtime explained
- Security scan clean, and no plugin on the site with an unpatched known vulnerability
- Page speed checked on the home page and the top three pages that lead to an inquiry
- Search Console checked for new errors and pages that dropped out of the index
- Prices, products, contact details and team names still correct
- Inquiries or RFQs this month recorded next to last month and the same month last year
Every quarter
- A backup restored to staging and clicked through
- Certificates checked on every domain and subdomain
- Domain, license and subscription renewals for the next 90 days confirmed
- PHP or platform version checked against its end-of-support date
- Plugins and apps reviewed: remove anything unused or abandoned by its developer
- Users reviewed: remove anyone who no longer needs access, and require two-factor sign-in for admins
- Three things chosen to improve next quarter, based on the numbers
Every year
- Every account confirmed in the company's name, with at least two people who can sign in
- Hosting plan, renewal price and uptime guarantee reviewed
- Accessibility and privacy notices reviewed
- Decide whether the site needs maintenance, a refresh, or a rebuild
If you only manage the monthly lines, you will catch most silent failures within a few weeks instead of a few months. For a longer list of checks, our docs guide on what to check monthly goes further.
What a maintenance plan does not include
Most disputes about maintenance plans come from assumptions about what is included. These are usually outside a plan, priced as separate projects or paid directly by you:
| Usually not included | Why |
|---|---|
| Redesigns and new page designs | A project with its own scope and price |
| New features, such as ecommerce, booking or a configurator | Build work, not upkeep |
| Writing or editing content | Your team's knowledge, or a copywriting project |
| SEO campaigns, ads, social media and email marketing | Marketing services, not maintenance |
| Hosting, domain, premium plugin licenses and other third-party fees | Paid to the vendor, often passed through at cost |
Before you sign any plan, ask these questions:
- Who actually does the work, and will it be the same person each month?
- What do you test, beyond updates? Ask specifically about forms, the CRM and integrations.
- When did you last restore a client's backup, and how long did it take?
- What do you do if something breaks outside business hours? The honest answer matters more than the impressive one.
- What does "unlimited" mean? Unlimited small requests usually means a queue.
- What is the minimum term, and how do I leave? Confirm you keep every login, file and account if you do.
- Can I see a sample monthly report? If it has no business numbers, it is a log, not a report.
What we sell, and when it is the wrong fit
We sell care plans, so read this section knowing that.
Our entry plan is The Boring Stuff, at $997 a month. It covers senior oversight of security, speed, uptime and integrations, proactive hardening and automated monitoring, all updates, patches and tested backups, and integration health checks across your stack, with monthly reporting. We support WordPress, WooCommerce, Webflow, Shopify, BigCommerce and Elementor sites. It starts with a foundation audit in the first week and a stabilization sprint in weeks two and three, before the monthly routine begins. The Interesting Stuff, at $1,997 a month, adds a quarterly Positioning Gap audit, technical governance and a scheduled monthly strategy sync. The Whole Damn Thing, from $5,000 a month, is our fractional growth and technology team.
The terms, plainly. Every care plan has a 3-month minimum. There is no month-to-month option. Support comes through email, support tickets and scheduled meetings, not Slack or a direct line. Uptime is monitored automatically, but we do not offer after-hours or weekend support; requests are handled in business hours. The Boring Stuff carries a 30-day guarantee: if the first month does not give you your time back and a site you stop worrying about, you do not pay for it.
It is the wrong fit if your site is a brochure that does not bring in leads, if you are still before launch, or if someone on your team already works through the checklist above every month and enjoys it. In those cases a $100 to $150 plan or your own routine is the better buy.
It is also the wrong fit when the site itself is the problem. A care plan keeps a site healthy. It will not make a site that never converted start converting. If your inquiries were low before anything broke, read our breakdown of what a B2B website redesign really costs, and if a rebuild is coming, our website redesign checklist starts with the baseline you will want to measure against.
Website maintenance plan questions owners ask
What does a website maintenance plan include?
Three layers. Keeping the site running: software updates tested before they go live, daily backups with a test restore, security monitoring, uptime alerts and certificate renewals. Keeping it producing: testing every form and quote path end to end, checking that leads reach the CRM, and watching integrations and page speed. Keeping it improving: a monthly report against business numbers and a quarterly review. Most low-cost plans cover only the first layer.
How much does website maintenance cost per month?
Published ranges vary widely. WebsiteSetup puts a small business site at $30 to $250 a month, a mid-size business or marketing site at $250 to $750, an ecommerce site at $500 to $2,500, and a large corporate site at $1,000 to $5,000 or more. The Admin Bar found that most agency care plans cost $100 to $150 a month. What moves the price is how much of the work is done by a person who checks your forms, integrations and numbers, rather than by an automated tool. Our own care plans start at $997 a month, with a 3-month minimum.
How often does a website need maintenance?
Some of it constantly, through automated uptime and security monitoring. Updates, backups checks and a test submission of every form belong in a monthly routine at the least. A test restore of a backup, a speed review and a look at the dates that expire (certificates, domain, software versions, licenses) belong in a quarterly routine. A full review of accounts, access and the platform's support status belongs once a year.
Is a website care plan the same as hosting?
No. Hosting is the server your site runs on and the company that keeps that server online. A care plan, or maintenance plan, is the work done on your site: updates, backups you can restore, security, testing forms and integrations, and reporting. Managed WordPress hosting includes some of this, such as server backups and core updates, but no host will tell you that your quote form stopped reaching your CRM.
Can I maintain my website myself?
Yes, if someone on your team has a set time each month, admin access to every account, and a staging copy to test updates on. The monthly checklist in this article is written for that person. It stops being a good use of time when the site carries revenue or RFQs, runs several integrations, or when nobody on the team would know how to restore it after a bad update.
What should a monthly website maintenance report show?
What was updated and whether anything broke, the date of the last successful backup and the last test restore, uptime, any security events, a pass or fail for every form and integration test, page speed on your key pages, the dates that expire in the next 90 days, and your main business number for the month, such as inquiries or RFQs, against the month before. A report that only lists plugin updates tells you the work was done, not whether the site is producing.
What happens if my website breaks on a weekend?
It depends on the plan, so ask before you sign. Many plans, including ours, monitor uptime automatically but handle requests in business hours. We do not offer after-hours or weekend support. If your site needs a person on call at night, you need a plan or a team that says so in writing, and it will cost more.
Keep reading
Automation & Website SupportHow to Build a WordPress Site Easily with Elementor Page Builder
Here’s a way to build a WordPress site easily without learning code for months or years. Try using a page builder like Elementor so your online business can run soon. Building a WordPress site for…
Automation & Website Support4 Ways to Protect & Secure Your Email Address Against Hackers
How do you know if your email is safe from potential hackers? What precautionary steps can you take to secure your email address and ramp up your email security game? Find out in this article. If our…
UX & Web DesignWhat a B2B Website Redesign Really Costs
Published guides put most B2B redesigns between $50,000 and $150,000, and not one shows its data. Here is our own price, what it buys, and a calculator for the bigger number: what your current site costs you every month.
See exactly where your site is losing conversions
Paste your URL and get an instant conversion score. No form to fill out, no sales call.
Strategies for businesses building what's next.
The Next Draft: occasional notes on turning B2B websites into pipeline. Unsubscribe any time.