What does website maintenance cost in the UK, and what are you paying for?
Website maintenance cost in the UK has two halves: fixed running bills you pay to providers, and labour you pay someone to do. Keeping them apart is the single most useful thing you can do when comparing quotes.
Fixed bills are the domain name, hosting, business email, and any premium theme or plugin licences. They are due whether or not anyone touches the site. Labour is the work of updating software, checking backups, watching uptime, fixing faults and making edits. That is what care plans and retainers charge for.
Many quotes blend the two into one monthly figure. That makes one supplier look cheaper than another when they are simply including or excluding hosting. Ask every supplier: which of these bills do I pay directly, which do you pay and pass on, and what exactly does the labour cover each month?
- Paid to providers: domain, hosting, email, licences, any paid services such as search or forms.
- Paid for labour: updates, backups, monitoring, security checks, edits, fixes, reporting.
- Paid occasionally: emergency repairs, redesigns, new features.
How much do hosting, a domain and SSL cost in the UK?
Hosting and a domain are usually modest yearly costs for a small business site, and an SSL certificate can cost nothing at all. Where these bills balloon is when a supplier resells them to you with a large markup.
A .co.uk or .uk domain is registered through a registrar and renews yearly or for several years at once. Register it in your business's name, with your email as the account owner. If someone else registered it for you, check who the registrant is; losing control of the domain is the worst outcome in any supplier dispute.
Hosting ranges from shared plans suitable for simple sites to managed WordPress hosting and cloud servers for busier ones. A static site can often run on low-cost or free static hosting, which is one reason static sites are cheap to maintain.
For SSL, Let's Encrypt issues certificates without a fee; its default certificates last 90 days and it recommends renewing every 60 days, which most hosts automate. Paid certificates still exist for specific needs, but a small business site rarely requires one. If you are paying a yearly SSL charge on a basic site, ask why.
What do premium plugin and theme licences add to maintenance costs?
Premium plugins and themes usually charge a yearly licence for updates and support. Individually small, they add up, and letting them lapse leaves you running software that no longer receives security fixes.
A typical WordPress business site might carry a premium page builder, a forms plugin, an SEO plugin's paid tier, a backup plugin and perhaps a booking or membership add-on. Each renews on its own date. Nobody tracks them, until one expires and an update stops arriving.
Two questions keep licence costs down. Does the site actually use the premium features, or would the free version do? And is each licence in your name? A licence bought on a developer's account may stop working when that developer moves on, and you then pay again for something you thought you owned.
This is a big reason we prefer lean builds. A site with five well-chosen plugins is cheaper and safer to maintain than one with thirty, and a hand-built site with no page builder has fewer licences to renew at all.
Website care plans in the UK: what each tier should include
UK care plans usually come in three or four tiers. The cheapest cover updates and backups only; the middle tiers add monitoring, security checks and some edits; the top tiers include developer hours, performance work and priority help. Compare the task list, not the tier name.
Basic tier
Software updates on a schedule, automated off-site backups, and uptime monitoring. Suits a brochure site that rarely changes. Check whether updates are tested or just applied blindly.
Standard tier
Everything above, plus security scanning, a monthly health check, a small edit allowance and a short report of what was done. The tier most small businesses need.
Business tier
Adds a bigger block of developer time for new pages or features, performance tuning, and checkout testing for shops. Worth it when the site changes weekly.
Ecommerce or custom-app tier
Adds testing of payments, stock sync and integrations after every update, because a silent failure here loses sales immediately.
Our care starts at US$120/mo for a standard-style scope on a site we built, and we tailor the task list rather than forcing you into a fixed tier. Ask for the list in writing, whoever you choose.
What does website maintenance actually include?
Proper website maintenance includes updates, backups you have tested, uptime and security monitoring, fixes when things break, and small content changes. Anything less is hosting with a newsletter.
- Updating the CMS core, theme and plugins, ideally after checking them on a copy of the site first.
- Daily or weekly off-site backups, with an occasional test restore to prove they work.
- Uptime monitoring that alerts someone when the site goes down.
- Security scanning and prompt clean-up if something is found.
- Checking forms, checkout and key pages still work after updates.
- Keeping the server's PHP version supported.
- Small edits: text, images, opening hours, team changes.
- A short monthly note of what was done.
What it usually does not include: redesigns, new sections, copywriting, SEO campaigns or marketing. Those are separate work, and a fair care plan says so.
Why do outdated PHP versions push maintenance costs up?
Many UK sites run on PHP, including every WordPress site, and each PHP version only receives security fixes for a limited time. Staying on an unsupported version is cheap today and expensive when something breaks or gets hacked.
The PHP project's supported versions page shows each branch getting two years of active support and then two years of security fixes only. At the time of writing, PHP 8.2 receives security fixes until the end of 2026, 8.3 until the end of 2027 and 8.4 until the end of 2028. WordPress itself recommends PHP 8.3 or greater and warns that older versions have reached end of life.
Moving to a newer PHP version is usually quick on a lean site, but can reveal old plugins or custom code that no longer work. That is why a site nobody has maintained for years costs more to fix than one updated steadily. The work is the same; it has just piled up.
Part of our care is checking which PHP version your host runs and planning upgrades before support ends, testing on a copy of the site first.
How much does an emergency website fix cost?
An emergency fix outside a care plan is usually charged per job or per hour, often at a higher rate than planned work, because someone drops other work to deal with it. The cost depends on the cause: a failed update is quick; a hacked site with no clean backup is not.
Common emergencies are a white screen after an update, an expired domain, a hacked site redirecting visitors elsewhere, a broken checkout, or email suddenly going to spam. Most are preventable with routine maintenance, which is why care plans pay for themselves on busy sites.
If your site is hacked and personal data may have been exposed, there is also a legal angle. The ICO says organisations must report a notifiable personal data breach as soon as possible and, where feasible, within 72 hours. We can help work out what happened technically; whether and how to report is for you and your adviser to decide.
For clients on care, fixes within scope are covered. For anyone else, we look first, then quote the fix before doing it, so you never receive a surprise bill.
What are the hidden costs when an agency controls your hosting and logins?
When an agency holds your hosting, domain or admin logins, the hidden cost is that leaving becomes expensive or impossible. You end up paying their care fee because the alternative is rebuilding from scratch.
It rarely starts as a trap. An agency sets up hosting on its own reseller account because it is convenient. The domain gets registered under its name. You are given an editor login but never the administrator one. Years pass. Then you want to change supplier and discover you do not have the keys.
Signs you are in this position: you cannot name your hosting company, the domain's registrant is not your business, you have never seen an admin password, or the agency's invoice includes “hosting” with no provider named. None of these is illegal, but each weakens your hand.
The fix is methodical. Ask in writing for full admin access, hosting account details and the domain transfer code. Move the domain into your own registrar account, set up hosting in your name, copy the site across and test it. We do this regularly as the first step before care begins; our redesign service covers cases where the old site is not worth moving.
Website maintenance cost by type of site
The type of site you run decides most of your maintenance cost. A static site has almost nothing to update; a WordPress shop with many plugins needs weekly attention.
Static sites are plain files with no database or plugins, so there is little to patch. Maintenance is mainly content edits and occasional checks. This is why we build many small business sites as static: a site from US$150 with very low upkeep.
WordPress sites need regular core, theme and plugin updates, plus backups and security monitoring. Cost scales with plugin count. See our WordPress website design page for how we keep builds lean.
Shopify stores have hosting and platform security handled by Shopify, so maintenance is theme updates, app checks and content. The Shopify website cost guide sets out the platform's own monthly fees.
Custom web apps need framework and library updates, server patching, monitoring of scheduled jobs and integrations, and ongoing changes. Our bespoke software cost guide covers that side.
Is website maintenance necessary for a small UK business?
If your site runs a CMS such as WordPress, yes: an unmaintained plugin with a known security flaw can let an attacker in. If your site is static, much less is needed, though someone should still watch the domain, hosting and forms.
The question to ask is what a day offline would cost you. A plumber whose contact form silently stops working loses enquiries without knowing it. A shop with a broken checkout loses sales. A solicitor's site redirecting to spam damages trust. Maintenance is insurance against those quiet failures.
You can do it yourself if you are comfortable updating software, checking backups and reading error logs. Many owners start that way. The time cost is real, though, and most prefer to hand it over once the business is busy.
If you want the lowest possible maintenance, the answer is often in the build: fewer plugins, simpler hosting, or a static site. That decision is cheaper to make at the start than to retrofit.
How to choose a provider without overpaying on website maintenance cost
Choose on what they do each month, how you reach them, and whether you keep ownership of everything. The lowest monthly price is rarely the lowest total cost.
- Ask for the monthly task list in writing.
- Ask whether updates are tested on a copy before going live.
- Ask where backups are stored and when a restore was last tested.
- Ask how you contact them and when they typically reply.
- Confirm hosting, domain and licences stay in your name.
- Ask what counts as an edit and what counts as new work.
- Ask how you leave, and what they hand over.
With us: tasks are listed in the quote, contact is WhatsApp seven days a week (Indian time), and you already hold every account, so leaving means removing our access.
Website maintenance from India for a UK site: how it works day to day
Maintenance is remote work by nature, so being in India changes little except the clock, and that can help. Routine updates can run while your UK customers sleep, and messages sent in your morning reach us during our afternoon.
India is four and a half hours ahead of the UK in summer and five and a half hours ahead in winter. Our day overlaps yours from late morning onwards, which suits a quick call or a screen-share if you want to walk through a change. Most maintenance needs no call at all: you send a message, we reply, the edit is made.
Care is quoted in USD. You can pay monthly from a GBP account by Wise, bank wire or PayPal, and invoices are issued from India. We read WhatsApp seven days a week. For anything that needs a specific response-time commitment, ask us and we will set out what we can offer in your written quote rather than promise it here.
First week of care
We confirm access to hosting, domain and the admin area, take a full backup, and list every plugin, licence and renewal date.
Second week
Pending updates are applied after testing on a copy, monitoring is switched on, and you receive a short report of the site's health.
What do the two free months of maintenance cover?
Every site, shop or app we build includes two months of free maintenance after launch. It exists because the first months are when real users find the things testing missed.
During that time we fix bugs, apply updates, make small adjustments to text and images, and answer questions about editing the site yourself. It is not a disguised redesign allowance; larger changes are quoted, but you will not pay for fixing something we built.
At the end of the two months, you choose. Carry on with care from US$120/mo, handle maintenance yourself with the documentation we provide, or hand it to someone else. Because the hosting, domain and code are already in your name, any of those options is straightforward.
Worked example: a year of maintenance for a Norwich physio practice
This is a hypothetical scenario to show how the costs fit together. Say a two-room physiotherapy practice in Norwich has a twelve-page WordPress site built four years ago by a local agency. It pays the agency a monthly fee that includes hosting, and it has never seen the admin password.
Step one is regaining control: requesting admin access, the hosting details and the domain transfer code in writing, then moving everything into accounts in the practice's name. The site turns out to have twenty-two plugins, several unused and two no longer updated by their authors.
Step two is a clean-up: removing unused plugins, replacing the abandoned ones, updating PHP after testing on a copy, and setting up proper backups and monitoring. The practice now pays its host directly, holds its own licences, and pays care from US$120/mo for updates, checks and small edits such as new clinic hours.
The result is not a promise of savings for every site; it shows how separating fixed bills from labour makes the real website maintenance cost visible.
Website maintenance cost UK checklist
Use this list to build your own yearly maintenance budget, or to check what a care plan quote leaves out.
- Domain: registrar, renewal date, registrant in your name.
- Hosting: provider, plan, renewal date, account in your name.
- Email: provider and cost per mailbox.
- SSL: free and automatic, or paid, and why.
- Licences: every premium theme and plugin, renewal dates, whose account.
- Care plan: task list, edit allowance, contact method, exit terms.
- Emergency cover: included, or quoted per job.
- Backups: where, how often, last test restore.
- PHP version and when its security support ends.