It is a bundle, and the contents vary wildly between providers. This guide breaks the bundle apart. It covers the fixed costs you pay no matter who looks after your site, the labour costs that actually drive the price, what UK providers currently charge, and the cases where you genuinely need very little.
What website maintenance actually covers
Most quotes mix three different things together without saying so. Separating them is the fastest way to work out whether a price is fair.
Fixed running costs
These exist whether or not you pay anyone to manage them. Hosting, domain renewal, any paid plugin or theme licences, and business email all fall into this group.
They are predictable and relatively small. They are also the part people most often pay twice for, once to a hosting company and again inside an agency retainer that quietly includes hosting.
Recurring technical work
This is the actual maintenance: applying updates, checking nothing broke afterwards, taking and testing backups, monitoring uptime, and watching for security problems.
The cost here is human attention, not software. A provider running automated updates on two hundred sites can charge very little. A provider testing each update on a staging copy of your site before pushing it live cannot.
Small changes and support
Swapping a phone number, adding a team member, updating opening hours, fixing a broken form. Most plans include a monthly allowance of time for this, usually somewhere between thirty minutes and a few hours.
Check whether unused time rolls over. Usually it does not.
What UK providers actually charge
Published prices are easier to compare than quotes, and enough UK providers publish theirs to draw a reasonable map.
One provider who checked twelve live UK maintenance plans in July 2026 found a verified range of £29 to £379 per month, with most small business plans clustering between £40 and £99. That matches the tiers other UK providers publish.
| Tier | Typical monthly cost | What you are buying |
|---|---|---|
| Automated | £20 to £75 | Updates pushed automatically, scheduled backups, uptime monitoring, ticket-queue support |
| Standard managed | £75 to £200 | Manual update review, security scanning, SSL management, a small allowance of developer time, a named contact |
| Premium or ecommerce | £200 to £550 | Staging environment, priority response, larger time allowance, account management |
| Business critical | £550 upwards | Engineering time, regression testing, contractual response times |
UK IT Services tiers the market at £30 to £75 for basic cover and £75 to £200 for a standard business plan. EJK Web Solutions splits it differently, at £20 to £40 for budget national providers, £80 to £200 for local specialists, and £200 to £500 or more for larger agencies. At the top end, one Birmingham agency publishes £800 to £1,200 or more per month for ecommerce and high-traffic retainers.
Two things to watch when comparing. Most agency prices exclude VAT, so if you are not VAT registered the real cost is a fifth higher than the sticker. And any "average" quoted to the penny with no source attached was made up.
Why the labour costs what it does
The honest answer to "why can't I just click update myself" is that you can, and for some sites that is fine. For anything running WordPress, the risk profile has changed considerably over the past two years.
Patchstack's 2026 security report recorded 11,334 new vulnerabilities across the WordPress ecosystem during 2025, a 42% increase on the previous year. Of those, 91% were found in plugins and 9% in themes, with only six in WordPress core itself, all rated low risk.
The timing matters more than the volume. The same report found the weighted median time from public disclosure to first mass exploitation was five hours, with 45% of heavily exploited flaws attacked within 24 hours. It also found that 46% of vulnerabilities were still unpatched when they were made public.
That is the case for monitoring rather than just updating. A monthly update cycle cannot protect you from something exploited five hours after disclosure, which is why the better plans pair updates with a firewall or virtual patching layer.
The wider picture is not reassuring either. The government's Cyber Security Breaches Survey 2025/2026, published by DSIT and the Home Office in April 2026, found that 43% of UK businesses identified a breach or attack in the previous 12 months.
None of this means you need a £500 plan. It means the difference between a £25 plan and a £150 plan is usually whether anyone is actually watching.
The fixed costs, separately
Worth knowing these in isolation, because they should appear somewhere in your budget whether bundled or not.
Hosting is the largest of them and varies by an order of magnitude depending on whether you are on shared hosting or a managed WordPress platform. Managed hosting often includes automatic updates, daily backups and security monitoring, which can replace part of a maintenance plan rather than sitting on top of it.
Domain renewal is small but easy to forget. Check the renewal price rather than the discounted first year, since registrars price those very differently.
SSL should cost you nothing. Let's Encrypt issues free domain-validated certificates, valid for 90 days and renewed automatically by most hosting control panels. If you are being billed annually for a basic SSL certificate on a brochure site, ask why.
Plugin and theme licences are the line item that surprises people. Premium page builders, form plugins, SEO tools and booking systems all renew annually, and an expired licence usually means no more updates, which is a security problem rather than a feature problem.
Business email is a separate subscription from hosting on most modern setups, priced per user per month.
What is not maintenance
Several things get sold inside maintenance plans that are really a different product. Knowing the difference stops you paying retainer prices for work that is not happening.
SEO is not maintenance. Keeping plugins updated does not improve your rankings, and a plan that lists "SEO optimisation" as a bullet point without naming any deliverables is usually selling you a Yoast licence. If your real problem is visibility, start with why your website isn't showing up on Google.
Content is not maintenance either. Writing new pages, refreshing old ones and publishing blog posts is ongoing marketing work, priced by the amount produced.
New features and redesigns are projects. A maintenance retainer with a two-hour monthly allowance will not deliver a new booking system, and any provider implying otherwise is setting up a difficult conversation later.
Monthly reports are a grey area. Some clients read them closely. Many never open them. If you are one of the latter, say so, and see whether the price moves.
When you need very little
Not every website needs a maintenance plan, and a provider who says so is worth listening to.
If your site runs on Squarespace, Wix or Shopify, the platform handles updates, security patching and hosting as part of the subscription. You are paying for that already. What you might still want is someone to make content changes, which is support rather than maintenance and is better bought by the hour.
A static site with no CMS, no forms and no logins has almost no attack surface. Backups and uptime monitoring cover it.
A WordPress site with a handful of plugins, run by someone comfortable applying updates and checking the site afterwards, can reasonably be self-managed. The honest caveat is that this takes real time each month, and most owners stop doing it by month four.
The sites that genuinely need a plan are the ones where a broken form, a hacked page or a day of downtime costs you money directly.
Questions worth asking before you sign
- Is hosting included, or am I paying for it separately as well?
- Are updates applied automatically, or tested on a staging copy first?
- How often are backups taken, where are they stored, and have they ever been restored?
- Is there a firewall or virtual patching in place, or only updates?
- How much support time is included, and does unused time carry over?
- What is the response time if the site goes down on a Saturday?
- Who owns the hosting account and the domain?
That last one causes more problems than any of the others. If your provider registered the domain on their own account, leaving becomes considerably harder than it should be.
A realistic annual budget
For a standard small business brochure site in the UK, budgeting somewhere between £600 and £1,800 a year covers hosting, domain, a managed maintenance plan and a small allowance of support time. Ecommerce sites should plan for meaningfully more, because there is more to test and more at stake when something breaks.
Spending nothing is a decision rather than a saving. It usually works fine for a while, and then costs a few hundred pounds of emergency work plus however much business you lost while the site was down.
If you are comparing quotes and cannot tell what separates them, the fastest way to find out is to ask each provider the staging question. The answer tells you almost everything about which tier you are actually being offered.
Want a straight answer on what your site actually needs? See how we build and look after websites.