A website is not a one-time purchase. It's a piece of infrastructure with a domain that renews, a CMS that pushes security patches, an SSL certificate that expires, and forms that quietly stop working the day your host changes a PHP version. Most small business owners budget for the build and forget the upkeep — then get surprised eighteen months later when the site is slow, flagged by Google, or simply down.
This is a straight answer on what maintenance actually costs, what you're paying for, and what tends to break first when nobody's watching. If you're still deciding whether to build at all, we've written a separate, full breakdown of what a small business website costs to build in 2026. This article is only about what happens after launch.
Typical maintenance budget ranges
Maintenance pricing varies with the size and complexity of the site, but for most small business sites — a handful of pages, a contact or lead form, maybe a blog or CMS — the market roughly splits into three tiers:
Basic care — $50 to $150/mo
Covers core software and plugin updates, automated backups, and uptime monitoring. This is the floor: enough to keep the site from silently rotting, but with little to no human time included beyond the automated checks.
Standard care — $150 to $350/mo
Adds security hardening, a monthly or quarterly health report, and a small monthly allotment of edit hours (typically 2–4) for content changes, image swaps, and small fixes without a separate invoice.
Managed / enterprise care — $400/mo and up
A dedicated point of contact, an uptime SLA, unlimited or near-unlimited edit requests, and proactive performance and SEO monitoring. Appropriate once the site is a meaningful revenue channel, not a brochure.
For reference, our own care plans sit at $99/mo for Basic Care and $249/mo for Pro Care, with custom Enterprise pricing above that — in line with the ranges above. On top of a care plan, expect a hosting bill separately (unless it's bundled): usually $10–$30/mo for shared or managed hosting on a small business site, more if you're on a dedicated server or need higher traffic capacity. For the full tier-by-tier breakdown and the renewal-price trap most hosts don't advertise, see our website hosting costs guide.
One-time fixes are a different budget line entirely. A technical SEO audit typically runs $300–$600, a Core Web Vitals / speed fix $300–$500, and a hosting migration $300–$500. These aren't recurring — you pay once, the issue is resolved, and it doesn't need to repeat unless something changes again (a new host, a redesign, a major CMS upgrade).
Which tier you actually need comes down to three questions, not the size of your site. First: how dependent is your revenue on the site staying up? A brochure site that mostly exists so people can find your phone number tolerates more risk than a site with a booking form or checkout generating daily leads. Second: how old and how modified is the underlying build? A fresh, simply-built site needs less hands-on attention than a five-year-old install with layers of plugins nobody remembers installing. Third: do you, or anyone on your team, have the technical ability to notice a problem before a customer does? If the honest answer is no, that gap is exactly what a care plan is priced to cover.
What's actually included in a care plan
"Maintenance" is a vague word that gets used to justify very different scopes of work. When you're comparing quotes, make sure the plan actually covers these items — not just "monitoring":
- Core, theme, and plugin updates applied on a schedule, with a rollback plan if an update breaks something
- Automated, versioned backups — not just one backup, but multiple restore points so you can roll back further than 'yesterday' if a problem goes unnoticed for a few days
- SSL certificate renewal, since most certificates issued by services like Let's Encrypt expire every 90 days and need automated renewal, not manual tracking
- Uptime and broken-link monitoring, so a 500 error or a dead form gets caught in minutes, not when a customer complains
- Security scanning and hardening — firewall rules, login rate-limiting, and malware scanning, particularly important on CMS platforms like WordPress where outdated plugins are the most common entry point for attackers
- A defined monthly allotment of content-edit hours, so small changes (a new price, a new photo, a new team member bio) don't each require a separate invoice
- A monthly or quarterly report showing what was updated, what was fixed, and current site health
If a "maintenance plan" only promises to "keep your site online," ask what happens the day a plugin update breaks your checkout form, or your SSL certificate silently expires over a long weekend. The answer tells you whether you're buying a monitoring dashboard or an actual safety net.
What happens if you skip it
Nothing breaks immediately. That's exactly why maintenance gets skipped — the cost of neglect is deferred, then it arrives all at once. Here's the rough order things tend to fail in on an unmaintained small business site:
1. The SSL certificate expires
Browsers show a hard 'Your connection is not private' warning, and most visitors bounce immediately rather than click through it. This is the single fastest way to lose a week of traffic, and it's entirely preventable with automated renewal.
2. Plugins and the CMS core fall behind
Outdated CMS installs and plugins are consistently the leading entry point for site compromises — attackers scan the web for known, unpatched vulnerabilities rather than targeting sites individually. A site that hasn't been updated in a year is not hypothetically at risk; it's actively being scanned.
3. Google flags the site
If the site does get compromised — injected spam links, a malware redirect, a defaced page — Google's Search Console can raise a security issue and, in worse cases, browsers will show visitors an interstitial warning before they can even reach the page. Recovering search rankings after a 'this site may be hacked' flag takes weeks even after the malware is removed.
4. Forms and integrations quietly stop working
Contact forms, booking widgets, and payment integrations depend on third-party APIs and PHP/Node runtime versions that change on your host's schedule, not yours. A form can fail silently — no errors, no complaints, just leads never arriving in your inbox — for months before anyone notices.
5. Performance degrades
Unoptimized images pile up, plugins accumulate, and nobody prunes what's unused. Core Web Vitals scores drift down slowly, which quietly costs both conversion rate and search ranking — the site doesn't 'break,' it just gets worse at making money.
6. A full rebuild becomes cheaper than a fix
Past a certain point of neglect — end-of-life CMS versions, undocumented custom code, no backups to safely test against — patching the existing site costs more in developer hours than starting over. This is the expensive failure mode maintenance exists to prevent.
Bonus: the domain itself lapses
Domain registration is a separate renewal from hosting and maintenance, and it's the one most likely to be forgotten entirely because it only comes due once a year. A lapsed domain can be re-registered by someone else within days, taking your email and every backlink you've built with it. It's a five-minute fix to set auto-renewal — until the day it isn't.
If any of this sounds familiar — a slow site, a form that stopped converting, a design that hasn't changed since launch — it's worth reading our related piece on 10 signs your website is hurting your sales. Neglect and lost revenue usually show up as the same symptoms.
Support and warranty expectations after launch
Most reputable developers include a warranty window after launch — commonly 30 to 90 days — during which bugs in the delivered work are fixed free of charge. It's worth getting this in writing before the project starts, along with a clear definition of what counts as a "bug" (something that doesn't work as specced) versus a "new feature" (something you're now deciding you want, which is billable, whether that's during the warranty period or after).
After the warranty period ends, that's precisely where a maintenance plan is supposed to pick up. Ask any developer or agency you're evaluating three direct questions: What's your response time for a site-down emergency? Is that response time contractual (an SLA) or just a verbal expectation? And what exactly happens to the site if you cancel the plan — do you keep your own hosting and domain, or are you locked into their infrastructure? A vendor that can't answer the third question clearly is building in lock-in on purpose.
Our own care plans are built around that response-time expectation directly: Pro Care and Enterprise clients get priority support with a same-business-day response target, and Enterprise includes an uptime SLA with a dedicated engineer rather than a shared support queue.
Get the contract details in writing before you sign, not after something goes wrong. That means a written response-time commitment, a clear list of what counts as included work versus a billable request, and a documented offboarding process — what you get to keep (your domain, your content, your hosting credentials) if you ever cancel. A month-to-month plan with no lock-in is a healthy sign; a plan that only makes financial sense if you never leave is not.
Care plans from $99/mo — updates, backups, security, and support built in from day one.