How Much Does Website Maintenance Cost in 2026?

Website maintenance cost in 2026 is not one monthly number. It is a budget made of ownership costs, planned technical work, changes to the site and, sometimes, incident work. A simple company website, an online store and a business system can all be maintained, but the things that must be checked are very different.

For a European small or medium business, a useful answer starts by separating the bills. Hosting, domain renewal and paid software licences are owner costs. Routine maintenance is the human work of updating the site, keeping a backup ready, checking that important journeys still work and making agreed small changes. New features, major content work and incidents need their own estimate. At Artbrain, agreed one-off improvements and fixes are €45 per hour. A monthly maintenance plan starts from €200 per month, or €2,400 per year at that published starting point, after a free review defines the scope. Work outside that scope is €45 per hour. Hosting, domain and paid modules are paid separately by the owner. Those figures are Artbrain prices, not a claim about a European market average. The right annual budget depends on your platform, how it is used, its current condition, connected services and the work you actually agree.

How much does website maintenance cost in 2026?

First decide which question you are asking. “Keep the existing site healthy” is maintenance. “Add a booking flow” is an improvement. “The checkout has stopped working” is an incident. Their cost should not be hidden inside one attractive monthly figure.

The published monthly plan is a starting point, not a universal package. A brochure site with one enquiry form has a different maintenance profile from a store with payment and delivery flows. A business system may also need attention to data exchange with accounting, customer records or staff access. Before work starts, we agree the scope, cost and order of work. That is more useful than pretending every website has the same monthly needs.

For a newly launched Artbrain project, the included post-launch support period depends on the service: published service pages show 30 to 90 days. For example, an e-commerce project includes 60 days of support after launch. That period is distinct from an ongoing maintenance arrangement and does not make hosting, domains or paid licences part of the project price.

What maintenance includes, and what it does not

Routine maintenance normally concerns the existing foundation. Depending on the agreed scope, it can include content management system (CMS), plugin or module updates; backups; checks that the site is working; and small changes. For a store, the checks should consider the customer path, such as a product, basket, checkout and confirmation. For a system, they may concern a key staff task or a data exchange. Updating software without checking the relevant business path is only part of the job.

A backup is valuable when it can be found, restored and used at the moment it is needed. Ask where it is held, how long it is retained and whether restoration is tested. A monitoring service can detect that a page is unavailable or a certificate has a problem. It does not, by itself, diagnose why a payment is failing or make a human fix. Treat monitoring, acknowledgement, diagnosis and resolution as separate parts of an offer.

Hosting is infrastructure, not maintenance

Hosting provides the server environment. For comparison, OVHcloud Spain lists a managed WordPress plan at €9.99 per month plus VAT. It includes infrastructure features, but it cannot decide whether a new catalogue form is collecting the right information or whether an order flow still matches your business. At the other end, Hetzner lists its CX23 virtual server at €5.49 per month, excluding VAT and IPv4. A low server price is not a price for server administration, backups, application updates or human investigation.

Likewise, a free certificate is not free maintenance. Let’s Encrypt certificates cost €0, but someone still needs to set up renewal, notice a failure and investigate an HTTPS warning. Your agreement should say what is checked and who owns the accounts.

Do not assume that large content batches, copywriting, translation, SEO strategy, a redesign, new functions or emergency work are included. They may be sensible work, but they need to be named in the scope. The same rule applies to third-party services and paid modules.

Recurring owner costs before developer time

Every website has some costs that belong to the owner even if no developer changes a line of code that month. Prices below are official supplier examples checked for this guide. They are not a required stack, and supplier prices, taxes and promotions can change.

A premium plugin licence is relevant only when the site needs its function. It does not belong in a company website budget merely because the site uses WordPress. The same is true of monitoring, backup and consent products. Choose a tool because its function is needed, record the renewal date and keep the account under the business owner’s control.

What changes the maintenance price

Business criticality changes the work. If a contact form fails, the company may miss enquiries. If a checkout fails, customers cannot complete orders. If an internal system fails, staff may be unable to process requests or see current data. The more important the path, the more carefully it should be understood and checked after changes.

The condition of the site matters too. A current platform with documented access, a documented way to publish changes and a usable backup is easier to maintain than a site with abandoned modules, unknown custom code or accounts held by a former contractor. Platform version, code condition, paid modules and access all affect the estimate.

Integrations add another layer. Payment, delivery, email, CRM and accounting connections can change independently of the website. An update can leave the page looking normal while a confirmation, export or payment step no longer works. Decide who tests the full path and what access is available for that test. Change frequency matters as well. A site with an occasional address update differs from a store with seasonal promotions and new catalogue rules.

Finally, distinguish an automated check from a contractual response arrangement. Some suppliers publish support hours or response terms; others do not. Artbrain does not publish a numerical service-level agreement (SLA), response-time promise or uptime promise. If coverage matters to your operation, ask the provider to state the terms in the proposal rather than inferring them from the word “monitoring”.

Fixed plan, hourly work or pay per incident?

A fixed plan is sensible when routine work should happen whether or not someone remembers to send an email. It can also make ownership checks, licence renewals and small agreed edits easier to organise. The risk is assuming that a monthly fee includes every future request. At Artbrain, a plan starts from €200 per month and its scope is agreed after the free review. Work outside the agreed scope is €45 per hour.

Hourly work is a good fit for a stable site that needs an occasional correction, page change or focused improvement. Artbrain charges €45 per hour for agreed one-off work, with the estimate agreed before work starts. It gives a clear path for a defined task, but does not replace a recurring process for updates and checks.

Paying only when something breaks can seem economical, especially for a site that changes rarely. The trade-off is that an expired licence, failed form or an outdated software component the site relies on may be discovered after it has already affected the business. It is also harder to estimate an incident before diagnosis. Compare offers by the work and decision process, not just the lowest monthly number. An automated update package and a plan that includes human checks are different purchases.

Three annual budget worksheets

These annual budget examples are illustrative, not quotations. They use only the published Artbrain starting price and the supplier examples above. Each assumes that the owner chooses the stated hosting and domain example, and that the monthly plan is agreed at its published starting point. VAT treatment follows the supplier wording, so totals are shown before applicable VAT. No hours, incident allowance or feature budget has been invented.

Small company website

Assumption: an existing company site needs an agreed monthly maintenance scope, an OVHcloud managed WordPress plan and one .com domain renewal. Monthly plan: €2,400. Hosting: €9.99 × 12 = €119.88. Domain: €13.49. €2,400 + €119.88 + €13.49 = €2,533.37 before applicable VAT. If cookie consent software is required, the listed iubenda example adds €4.99 × 12 = €59.88, making €2,533.37 + €59.88 = €2,593.25 before applicable VAT. A site that changes rarely could instead budget one-off work as the hourly rate × agreed hours, plus its owner costs. No annual hourly total is shown because it depends on the agreed estimate.

Online store

Assumption: an existing store agrees a monthly scope at the published starting point, uses the same managed hosting example and renews one .eu domain. Maintenance: €2,400. Hosting: €119.88. Domain: €8.59. Annual EUR total: €2,528.47 before applicable VAT. This example uses the published starting price, not the usual or complete cost of a store. A payment, delivery or catalogue change can be outside scope and is priced from an agreed estimate. A premium plugin licence may be a separate owner cost when the store needs its function. Backup, monitoring and consent tools are also separate choices, not automatic plan inclusions.

Custom business system

Assumption: a system has an individually agreed maintenance scope at the published starting point, one Hetzner CX23 server and a .com renewal. Maintenance: €2,400. Server: €5.49 × 12 = €65.88, excluding VAT and IPv4. Domain: €13.49. Annual EUR total: €2,479.37 before applicable VAT, IPv4 and any additional infrastructure charges. This is only a mathematical minimum based on the stated assumptions, not a system quote. The actual scope can be higher because data exchanges, dependencies, access controls and business workflows have to be reviewed. Out-of-scope improvements use the hourly rate × agreed hours. Subscription-based online services (SaaS), data exchange and other third-party service usage remain owner budget lines.

Fill in your own annual budget

What happens when nobody maintains a site

Problems often accumulate quietly. A domain or licence can reach its renewal date. A contact form can stop delivering messages after a mail-service change. A checkout or integration can fail after a provider updates its side. A backup may exist but have no recent restoration check. These are operational issues, not theoretical ones, and they are why ownership, renewals and key-path tests belong in the maintenance conversation.

Software support lifecycles are another practical reason to review a site. The PHP support schedule lists security support ending on 31 December 2026 for PHP 8.2, 31 December 2027 for PHP 8.3, 31 December 2028 for PHP 8.4 and 31 December 2029 for PHP 8.5. WordPress recommends PHP 8.3 or greater. A site may still run on an older version even after that version stops receiving security updates.

Maintenance does not mean updating everything immediately. A safe decision considers compatibility, a backup, the affected business flow and a way to restore the previous working version. Ignoring the work entirely, however, leaves more versions, licences and unknown changes to untangle later. The sensible aim is an understandable system with current ownership and agreed priorities.

Taking over a site from another developer

A new team can take over a website even if another team built it. Start with the URL and a short description of the problem or change you need. Do not send passwords in the first message. A free review can explain the current condition, what needs attention and which work can be taken on. It is not a promise that every platform or site builder can be accepted without review.

Owner handover checklist

• Domain and hosting accounts registered to the business owner
• Website administration access and a list of administrator accounts
• File access through FTP, SSH or a file manager, plus database access where relevant
• Source-code repository and deployment notes, if they exist
• Licences, renewals, billing contacts and the owner of each paid account
• Payment, delivery, email, CRM, accounting and other integration details
• Analytics and tag-management access
• A current backup and a note of how it was made
• Former-user accounts to remove, and a short record of password-change dates and responsible people

If a previous developer has disappeared, access to the domain and hosting can often be recovered through the providers when the accounts are in the owner’s name. That is not a guarantee, which is why owner-controlled accounts matter from the beginning.

A safe takeover sequence

1. Review the URL and the requested task.
2. Map the available accounts, access and ownership.
3. Create a backup before changes.
4. Review the condition, dependencies and risks relevant to the request.
5. Agree the estimate, scope, cost and order of work.
6. Make only the agreed fixes, changes or new functions.
7. Agree an ongoing maintenance scope if regular care is useful.

This sequence avoids the common mistake of changing a live site before confirming who owns the domain, code and licences. It also gives the owner a cleaner exit path later. Store access records and a brief technical note with the business, rather than relying on one person’s inbox.

EU compliance is ongoing work, not a one-off banner

Maintenance can include compliance upkeep when that work is in scope, but a technical plan is not legal advice. The right obligations depend on the business, data, countries and services involved. Ask a lawyer to confirm your case, especially if your business is UK-only, because EU rules are not the whole UK legal position.

GDPR operations

The European Commission explains that GDPR applies to SMEs too. A business with fewer than 250 employees may be exempt from records of processing only under specific conditions, including that processing is not regular, does not create a risk and does not concern special-category or criminal data. A processor needs a contract or other binding legal act setting out the processing arrangement. If a personal-data breach is likely to create a risk to people’s rights and freedoms, the controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. Read the Commission guidance on GDPR application and its guidance on obligations and breach notification with legal advice for your circumstances.

For ongoing website work, that can mean keeping a processor list and data-processing agreement current, reviewing staff and supplier access, retaining an understandable record of the services involved and knowing how to assess an incident. A technical outage is not automatically a reportable personal-data breach.

Cookies, accessibility and NIS2

The CNIL says that, except for exemptions, cookies require consent, rejecting must be as easy as accepting, and information must be clear about purposes and refusal. Its cookie-banner guidance is a useful operational reference. Recheck consent after adding analytics, advertising tags, embedded content, chat or a plugin: optional cookies should stay blocked until consent, and accepting, rejecting and withdrawing consent should all work. A consent product can support the work; it does not guarantee compliance.

The European Accessibility Act rules apply to covered services provided to consumers after 28 June 2025, including e-commerce, subject to transitional provisions and exceptions that need checking. Microenterprises providing services are exempt. Directive (EU) 2019/882 defines a microenterprise as fewer than 10 persons and either annual turnover or an annual balance sheet total not exceeding €2 million. National law implements the directive, so do not assume every small-business website is in scope. See Directive (EU) 2019/882 and the Council explanation, then confirm applicability with a lawyer. New templates, checkout changes and banners can introduce new accessibility issues, so relevant checks continue after launch.

NIS2 is not a general rule for every SME website. The European Commission says it generally applies to medium-sized and large entities in critical sectors, with exceptions and national implementation to consider. If your business may be in scope, review its systems and suppliers as part of a wider risk-management process with the appropriate adviser. Read the Commission overview of NIS2.

How to compare maintenance offers

A useful offer allows you to see what you are buying and what you still own. Ask each provider the same questions:

• Which tasks are included, how often and for which parts of the site?
• What is excluded, including content, new features, redesign and incident work?
• Are hours, tasks or a different measure included, and do unused allowances roll over?
• Is hosting included or paid separately? Who owns the hosting and domain accounts?
• What does the backup contain, where is it stored, how long is it kept and is restoration tested?
• Is monitoring only an alert, or are human response terms stated separately?
• Is there a safe test environment and are key paths checked after updates?
• How are extra tasks approved and priced?
• Who owns licences, paid tools, code, analytics and integration accounts?
• What reports are provided, what is the notice period and what access is handed over at exit?
• If personal data is processed, what processor terms and data-location information are available?

Put the answers beside the price. A lower fee can be reasonable if the scope is genuinely smaller and that suits your site. It is not a like-for-like saving if it leaves owner renewals, restoration testing or business-path checks unaddressed. Clarify the price for extra work before the first urgent request arrives.

Maintain, improve, redesign or rebuild?

Maintain when the site has a supported foundation, owner access is clear and ordinary changes are predictable. Maintenance preserves useful URLs, content and established functions. Improve when the underlying site works but a page, form, integration or workflow needs a focused change. That work should be separately estimated because it changes the product, rather than merely caring for it.

A website redesign is appropriate when the structure, visual system or customer journey no longer serves the business, while existing search visibility and URLs need a considered migration. Rebuild when the platform is unsupported, there is no safe upgrade path, or routine changes repeatedly create side effects. A rebuild is a project decision, not an automatic answer to an old design.

For a new foundation, see website development. If selling online is central to the decision, review the scope of an e-commerce project. The same separation applies afterwards: owner costs, ongoing care and future improvements should be visible rather than folded into one vague promise.

What to prepare for an accurate quote

Send the URL, a short explanation of the business problem and the outcome you need. Mention the platform if you know it, recent changes, current hosting provider, important integrations and whether the previous developer is still involved. Say whether you are looking for a one-off fix, regular maintenance, an improvement or a redesign. If you have a list of requested changes, include it, together with any dates that genuinely matter.

Do not send passwords in the first message. After the initial review, the work may require access to hosting, domain and the site administration area. Keep those accounts in the owner’s name and share access through an agreed, appropriate route. You can use the project brief to organise the request or the calculator for an indicative estimate. Neither replaces a reviewed scope and agreed price.

CEO & Lead Developer at Artbrain

Anton Kunashenko

Founder of Artbrain since 2018. Builds digital products for business — from landing pages to enterprise systems.