Website maintenance: what it includes and what it costs

Most businesses budget carefully for building a website and not at all for keeping it alive. The build gets a proposal, a comparison of quotes and a board discussion. The maintenance gets a line at the bottom of the invoice that nobody reads, or nothing at all.

Then eighteen months later the contact form has been quietly failing for six weeks, the SSL certificate expired on a Saturday, a plugin update broke the pricing page, and nobody can reach the developer who built it.

This post covers what maintenance actually is, what it costs honestly in India and globally, and how to read a maintenance contract so you know what you are and are not buying.

What happens to a website nobody maintains

Websites are not furniture. They sit on software that changes underneath them continuously, and the decay follows a predictable schedule.

• Month 1 to 3. Nothing visible. Dependencies begin to fall behind. Content goes stale in small ways: an old price, a departed employee.
• Month 3 to 6. First security advisories affect components you are running. Browser updates cause minor visual breakage. Forms may start silently failing as email providers tighten authentication rules.
• Month 6 to 12. Real vulnerability exposure. Performance degrades as content accumulates without discipline. Search rankings drift down because competitors are publishing and you are not. Broken links accumulate.
• Year 1 to 2. Updates can no longer be applied incrementally, because the version gap is too wide. The upgrade that would have been routine becomes a project.
• Year 2 plus. You are quoted for a rebuild rather than an update, and the quote is right. This is how a ₹3 lakh site becomes a ₹3 lakh site again, four years later.

The seven workstreams real maintenance covers

1. Security and patching

Applying updates to the CMS, plugins, themes, server packages and application dependencies. Monitoring advisories for the specific components you run. Testing updates on staging before production where the risk warrants it. This is the largest single reason maintenance exists, and it is covered in more depth in our website security checklist.

2. Backups and recovery

Automated daily backups of files and database, held off the production server, retained long enough to recover from a problem you noticed late, and restore-tested on a schedule. A backup you have never restored is a hypothesis, not a safety net.

3. Uptime and performance monitoring

Checks every few minutes from multiple locations, alerting a human who is actually awake. Plus Core Web Vitals tracking, because performance degrades gradually as content and third-party scripts accumulate, and nobody notices until rankings move.

4. Content updates

The work you actually think about: new team members, updated pricing, a new service page, seasonal banners, case studies, blog posts. Usually the largest share of hours in any active retainer, and the part most likely to be under-scoped in a contract.

5. Technical SEO upkeep

Broken link checks, redirect hygiene when pages move, sitemap and structured data maintenance, Search Console error triage, and adjusting to search behaviour changes. Search is not static, and neither is the work of being findable in it. See AI search optimisation for the newest layer of this.

6. Compliance drift

Cookie banners that stop matching what your site actually loads. Privacy policies that do not mention the analytics tool you added in March. Accessibility regressions introduced by a new component. Regulations move, and so does your site, and the gap between them opens quietly.

7. Infrastructure and platform management

Certificate renewal, DNS management, domain renewals, hosting configuration, CDN and cache tuning, scaling for traffic events, and keeping the runtime on a supported version. Node, PHP and Python versions all reach end of life, and running past it means no more security fixes.

What it costs

Honest ranges. Indian agency pricing first, then a note on global rates.

Basic care, ₹3,000 to ₹8,000 per month

Suitable for a small brochure site that rarely changes. Covers hosting, backups, updates, uptime monitoring, SSL, and perhaps an hour of content changes. No strategic input. Response within a couple of business days.

Standard, ₹10,000 to ₹30,000 per month

The tier most SMBs actually need. Everything above plus four to eight hours of content and small development work, staging-tested updates, performance monitoring, monthly reporting, and a next-business-day response commitment. Emergency response included within defined hours.

Growth, ₹35,000 to ₹1,20,000 per month

For sites that are a genuine revenue channel. Adds ongoing SEO work, conversion improvements, new page and feature development, A/B testing, analytics interpretation, and a named point of contact who understands your business. Same-day response, defined uptime commitments.

Enterprise and e-commerce, ₹1,50,000 upward

Multi-environment deployments, integrations with ERP or CRM, contractual SLAs with penalties, on-call coverage, load testing before peak seasons, and a dedicated team.

Global comparison. The same tiers from a US or UK agency typically run $200 to $500, $500 to $1,500, $1,500 to $6,000 and $6,000 upward per month respectively. Indian agencies are genuinely cheaper for equivalent quality at the lower tiers; the gap narrows at the top, where the cost is senior engineering time.

Retainer, hourly, or ad hoc

• Monthly retainer. Predictable for both sides. The provider keeps context, which is worth more than people realise, because a developer who already knows your codebase fixes things in a third of the time. Watch for unused hours expiring monthly.
• Hourly, on demand. Cheapest if you genuinely need almost nothing. The catch is priority: when your site goes down on a Friday evening, the retainer clients get attention first, and you are queued behind them.
• Ad hoc, call when broken. Feels frugal and usually is not. Every engagement starts with the provider relearning your setup, billed to you. Security patching does not happen at all, because nobody is watching. This is how sites reach the rebuild stage.

How to read a maintenance contract

The questions that separate a real agreement from a hopeful one:

• What is the response time, and is it business hours or clock hours? “24 hours” means very different things on a Friday evening.
• How many hours of work are included, and what happens to unused hours? Rolling over for one quarter is a fair middle ground.
• What counts as maintenance and what counts as new development? This is where disputes actually happen. Get the boundary written down with examples.
• Who owns the code, the content and the accounts? You should hold the domain registrar, hosting and analytics accounts in your own name, with the agency as a delegated user. Never the other way round.
• What is the exit process? A named handover deliverable: code, database, credentials, documentation, DNS control. Ask this before signing, not while leaving.
• Are backups tested, and can you request a restore drill? A provider who has never tested a restore will hesitate at this question, which is itself the answer.
• What reporting do you get? Monthly, showing uptime, updates applied, work completed, and anything deferred with a reason.

What you can reasonably do yourself

Not everything needs an agency. A capable person in-house can handle:

• Routine content edits through the CMS.
• Watching Search Console and analytics for anomalies.
• Verifying that contact forms deliver, by actually submitting one monthly. This catches more real failures than any monitoring tool, because form delivery breaks silently.
• Keeping a calendar reminder for domain and certificate expiry.
• Basic image compression before upload.

What you should not do in-house without an engineer: apply major version updates on a live site, edit code through a CMS file editor, or change DNS records on a Friday.

The stack decision changes the bill

Maintenance cost is largely determined at build time, and this is the argument for thinking about it before you choose a platform. A WordPress site with 24 plugins carries a permanently higher patching and breakage load than a statically generated site with a handful of dependencies. A custom application with no tests costs more to change safely than one with a test suite and a deployment pipeline.

Our comparison of Next.js and WordPress for Indian SMBs works through those trade-offs, including the maintenance side, which is where the total cost of ownership actually diverges.

How RoseLeap can help

Our hosting & maintenance plans cover all seven workstreams above with defined response times, tested backups, monthly reporting, and no lock-in on your accounts: you own the domain, the hosting and the code, and we work inside them.

We maintain the group's own sites on exactly the same setup, which is a reasonable thing to judge us by. Tell us what you are running and what has gone wrong lately on the contact page and we will quote a plan that fits, within one business day.