What website maintenance covers each month, line by line.

What the monthly fee pays for

Website maintenance is a bundle of separate jobs. A plan includes some of these, and every quote should say which:

• What keeps the site online: hosting, the domain and the security certificate.
• What keeps it safe: software updates, backups and security checks.
• What tells you it works: checks that it is up, fast and that the forms still send.
• Work done for you: small edits and support when something breaks.
• Extras sold alongside: reports, search work, a chatbot kept running and tuned.

Some lines are costs passed on from other companies, such as the domain registration or a paid plugin licence. Others are someone's time. The price of a plan mostly follows the second kind, and five things decide how much of it your site needs: the platform it is built on, how many plugins and connections it has, whether it sells online, how often you change it and how fast you need help when it breaks.

The list of what you pay for after launch is in what decides the price of a website. This guide takes each line in turn and says what to ask about it.

Hosting

Hosting is the computer your website runs on and the company that keeps it running. It comes in a few kinds: shared hosting, where many sites share one server; managed hosting for one platform such as WordPress; a server of your own; and the hosting included in a website builder plan such as Wix, Squarespace or Shopify.

What decides the cost: the kind of hosting, the traffic and storage the site needs, whether email is included, and extras such as caching and daily backups. A six-page site for a local business needs little. A busy store needs much more.

What to ask: whose account it is in, where the server is (European businesses often prefer a server in Europe), whether backups and the certificate are included, and how slow pages are dealt with.

Padding: premium hosting for a small site with modest traffic, or paying for separate hosting on top of a website builder plan that already includes it.

The domain

The domain is your address on the web, renewed every year or every few years. Its price is set by the registry for that ending and the registrar you buy it through, so a .com, a .de and a .io all cost different amounts. Many registrars include DNS settings and a privacy option that hides your details from public lookups.

What to ask: is the business the registrant, is it set to renew automatically, and on whose card? For .com and other generic domains, ICANN's rules make the registrar send renewal reminders about a month and about a week before expiry. If those reminders go to someone who left, nobody acts on them, and once the domain expires the registrar switches it off before it can be lost, taking the website and every email address on it with it.

A plan should either pass the domain fee on at cost or let you pay the registrar directly. Padding: a large markup on the domain, or a "domain management" fee for a domain that nobody touches.

The security certificate

The certificate is what puts https and the padlock in front of your address, so browsers do not warn visitors away. Most hosts and website builders now provide a free certificate and renew it automatically.

What to ask: is the certificate free and automatic on this hosting, and who gets the alert if renewal fails?

Padding: a yearly charge for a certificate when the host includes a free one. A small business site rarely needs a paid certificate.

Software updates

Websites built on WordPress and similar systems are made of the core software, a theme and plugins, each updated by its makers to fix bugs and security holes. WordPress installs its own maintenance and security releases automatically on most sites, but plugins and themes usually wait for someone to update them unless automatic updates are switched on for them.

Updates sometimes break things: a contact form stops sending, a booking widget vanishes, a checkout fails. So the real work is updating and then testing. A careful supplier updates a copy of the site first, or at least checks the forms, the booking button and any checkout straight after.

What decides the cost: the number of plugins, any custom code and how carefully changes are tested. What to ask for: a short monthly note of what was updated and what was checked afterwards.

Padding: an update fee for a site on a website builder such as Wix or Squarespace, which updates its own software, or for a static site with nothing to update.

Backups, and a restore that works

A backup is a copy of the whole site, files and database, from which it can be rebuilt after a hack, a bad update or a deleted page. It is only useful if it is recent, kept somewhere other than the server it protects and actually restores.

What decides the cost: how often copies are taken, how long they are kept and how much there is to copy. A store that takes orders every hour needs more frequent copies than a site that changes once a month.

What to ask: how often, kept for how long, stored where, and when was a restore last tested.

Until someone restores a backup, nobody knows it works. Ask for a test restore to a copy of the site at least once a year, and for the date it was done.

Padding is rare here. Copies kept only on the same server are the exception: if the server fails, the backups fail with it.

Security checks

Security work keeps people out of the site and spots trouble early: a firewall, scans for malicious code, limits on login attempts, two-step verification on every admin account, and removing old users and plugins nobody needs.

What decides the cost: the platform, the number of plugins and logins, and whether the site takes payments or stores customer accounts. A WordPress site with a members area needs far more care than a static site with no login at all.

What to ask: who has admin access today, whether two-step verification is on, and whether cleaning up after a hack is included or billed extra. Ask before you need it.

Padding: security monitoring sold for a site with no logins and no plugins, or a dashboard of alarming numbers with no explanation of what was done about them.

Checks that it is up, fast and still taking enquiries

Most of this is automatic. An uptime monitor checks the site every few minutes and alerts someone when it stops answering. Speed checks run the main pages through a tool such as PageSpeed Insights, explained in PageSpeed Insights explained. Search Console shows pages Google cannot reach.

The check plans often leave out is the one that matters most: a test enquiry through every form, every month, to see that it still lands in the inbox. A broken form sends nobody an error. The enquiries just stop.

What to ask: who receives the alerts, how quickly they act, and whether the form test is part of the plan. Padding: a monthly report of numbers nobody acts on.

Small edits

Edits are changes to what the site says: new prices, opening hours, a holiday notice, a new photo, a team member who joined or left. Most plans include some each month.

What to ask, because the word small hides everything:

• What counts as a small edit, and what counts as new work, such as a new page or a new form.
• How you send a request, and how soon it is done.
• Whether unused edits carry over or vanish at the end of the month.
• Whether you can make simple changes yourself as well.

If you change your site twice a year, paying for edits every month is waste: pay per job. If you change it every week, an included allowance pays off. Padding: "unlimited edits" with no description of what an edit is or how fast it happens.

Someone to call

Support is what happens when something breaks: the site is down, a form stopped sending, a page shows an error, someone thinks the site was hacked. Ask how you reach a person, during which hours, and how quickly they respond for something urgent and for something that can wait.

Write the answers down where the whole team can find them. A plan that promises priority support without a stated response time promises nothing you can hold it to.

Extras often sold with maintenance

These are separate jobs, and each should be priced and described on its own:

• Search work. Ask exactly what is done each month: pages written or improved, technical fixes, a report. "Monthly SEO" with no named work is the line to question first.
• Reports. Worth paying for only if they are short, in plain words, and someone reads them and acts on them.
• New pages and ad landing pages. Useful if you run campaigns, see landing pages for ads.
• Tools kept running, such as an AI chatbot whose answers are read and corrected each month.
• Licences for paid plugins, themes and fonts. These are costs passed on, renewed yearly, and should be in the business's name.

As an example of how plans split these, ours start with hosting, updates, backups, small edits and a check that the site is up and fast, then add a chatbot or missed-call text-back kept running and tuned, a monthly look at your Google results, reviews and enquiries in plain words, and on the largest plan new pages, ad landing pages and a monthly call.

Lines that are padding

Put any quote next to this list:

• Monthly search work with no named tasks.
• Software updates for a platform that updates itself.
• A paid certificate when the host gives one free.
• Security monitoring for a site with no logins or plugins.
• Unlimited edits with no definition.
• Reports nobody reads.
• A markup on the domain or on licences you could pay directly.
• Bigger hosting than the site's traffic needs.

And three lines that look like padding and are not, because nobody sees them until the day they matter: backups with tested restores, updates followed by testing, and the monthly form test.

What you keep if you stop

Before you sign, ask in writing what happens if you stop paying. The answers should be simple: the domain is registered to you, the hosting account is yours or the site and its backups are handed over, paid licences are in your name, and the notice period is stated.

Some plans fold the cost of building the site into the monthly fee in exchange for a minimum term. That can suit a business that wants one bill, as long as you know what happens at the end of the term and what you can take with you.

Our plans run month to month, except that a site built with no setup fee needs at least 12 months on the plan, as the prices page says. Either way, the domain, the site and the accounts stay yours. If you are reading this because a past supplier still holds your logins, start with how to get your website back from a web designer.

When you do not need a plan

You may not need a maintenance plan at all if your site is on a website builder that handles hosting, updates and security for you, you are happy to make your own edits, and someone in the business does a monthly check: send a test enquiry, read the prices and hours, look at Search Console. The builder's own plan is then most of the cost.

You need one when the site runs on WordPress with plugins, sells online, connects to your booking tool or CRM, or when nobody in the business has the time or the logins to look after it. How the platforms compare on upkeep is in Wix, Squarespace or WordPress.

Either way, the test is the same: pay for work you can check. A good plan tells you each month what was done, and you can confirm it.