How much does website maintenance cost, per month and per fix?

How much does website maintenance cost per month?

Published price guides disagree because they measure different things: some price only the labour, others add hosting, licences and content work. Three 2026 guides side by side:

The gap is not an error. Gravitate’s own guide gives $50–$250 a month for a small business site, yet says most businesses spend $500 to $2,500 once security tools, content work and support are counted; it adds that basic plans usually include hosting and the domain. Ask which of these a quote means.

What is included in a website maintenance plan?

Gravitate lists the standard package as CMS and plugin updates, security patches, daily or weekly backups, uptime monitoring and basic content edits. Each line hides a choice that should be visible in writing:

• Updates: core, themes and plugins, and on a custom site the framework and libraries, applied after a test.
• Security: patches, malware scans, a review of old admin accounts and a named person who reads the alerts.
• Backups: how often, how long they are kept, where they are stored and when a restore was last tested.
• Monitoring: an uptime check, how often it runs and who is told when it fails.
• Small changes: a stated amount of edits a month, with an hourly rate beyond it.
• Bug fixes: whether repairing a broken form or page uses up the included hours.
• A short report: what was updated, what failed and what is coming.

Good providers keep three jobs apart: routine maintenance, recovery after an incident such as a hack, and new development.

What does a maintenance quote often leave out?

Some providers bundle hosting and the domain; others bill them apart. These are the lines to check:

New features, new sections and redesigns are separate work with their own estimate. Ask who holds the hosting, domain and licence accounts: it should be you.

Is paying per fix cheaper than a monthly plan?

Sometimes. Gravitate says agencies and freelancers often charge $75–$200 an hour for maintenance, and GoDaddy puts developer rates at $50–$150 or more. Say a plan costs $150 a month: that is $1,800 a year, or 18 hours at $100 an hour. If your site needs fewer than 18 hours of updates and repairs a year, paying as you go is cheaper on paper.

On paper is the catch. Between incidents nobody applies updates, watches uptime or holds a fresh backup. Patchstack found that 46% of the WordPress vulnerabilities disclosed in 2025 had no fix at disclosure, and that for heavily targeted ones the median time to the first attack was 5 hours. The real question is whether the routine happens when nothing is broken.

A defined fix is one problem with one cause: a form that stopped sending, a checkout button that does nothing, a layout broken on phones. It is priced before work starts. Many owners combine a small plan for the routine with per-fix pricing for larger repairs.

At VITON¹³ a defined fix starts from $13; the monthly plan has a setup fee and a monthly fee, shown in the written estimate. Divide the monthly fee by the price of one defined fix: the result is how many fixes a year the plan must replace to pay for itself.

Who should maintain your website: you, a freelancer or an agency?

Whichever you pick, you should own the accounts: domain, hosting, code repository and analytics.

Does WordPress cost more to maintain than custom code?

The work moves; it does not disappear. WordPress’s documentation says minor core releases update automatically by default, while plugins and themes do so only in special cases. Plugins are where the risk sits: Patchstack counted 11,334 new WordPress vulnerabilities in 2025, 42% more than in 2024, and 91% were in plugins.

Custom code has no plugin marketplace, but it has dependencies. In December 2025 Next.js published CVE-2025-66478, rated CVSS 10.0: remote code execution in unpatched App Router apps, with no workaround and an upgrade required. A custom site needs someone who reads such notices and ships the update promptly.

So the question is what you run, not its label: a WordPress site with 25 plugins and a custom site with 25 dependencies both need a routine. A site on a hosted builder needs the least, because the vendor patches the platform; the price is control.

What hidden costs appear after you sign a maintenance contract?

• Hours that expire: plans often cap small changes at a few hours a month. Ask whether unused hours carry over and what an extra hour costs.
• Expired licences: when a plugin licence lapses, features such as forms or a cart can stop working.
• A first catch-up: a site with years of missed updates is not a normal month’s work. Ask whether an initial audit is charged.
• Emergency rates: Gravitate warns that a hacked site or a failed plugin can lead to urgent repairs costing hundreds of dollars an hour.
• Tax: whether the price includes sales tax or VAT where it applies.

What should you ask for in a website maintenance quote?

Two quotes at the same price can buy very different protection. Ask for these eleven points in writing, and treat “unlimited support” with no hours or response time as a red flag:

1. Scope by platform: which parts are covered (core, plugins, theme, custom code, integrations) and which are not.
2. Update routine: how often, and whether updates are tested on a copy before they reach the live site.
3. Backups: frequency, retention, where copies are stored and the date of the last successful restore test.
4. Monitoring: what is checked (the home page only, or also checkout and forms), how often, and who receives the alert.
5. Response time: when the clock starts, which hours it runs, and whether it promises a first reply or a fix.
6. Hours: how many are included, whether they carry over, the rate beyond them and whether bug fixes use them.
7. Exclusions: hosting, domain, licences, new features, redesign and malware recovery, each with a price or a rate.
8. Ownership: you hold the domain, hosting and code accounts; the provider works through added users.
9. Report: what you receive each month and when.
10. Term and exit: the minimum period, the notice and what is handed over when you leave.
11. Personal data: if the provider sees customer data, a written data-processing agreement; for EU data subjects GDPR Article 28 requires a contract. This is not legal advice; ask a lawyer.

What would one-off fixes cost with VITON¹³?

The calculator adds up VITON¹³’s one-off packages. The monthly plan is not in it because it is billed monthly: its setup and monthly fees come in the written estimate, which arrives within one working day, and it can be cancelled with 30 days’ notice.

One defined fix is delivered in 1–2 working days.