Website Maintenance for Small Business: What It Includes, What It Costs, and the DIY Routine

Website maintenance is the recurring work that keeps a site secure, accurate, fast, and findable after launch: software and security updates, backups, content corrections, performance checks, uptime monitoring, and the unglamorous renewals of your domain and hosting. For a typical small business site, all of it fits in a monthly routine of about 30 minutes, or a care plan costing a few hundred dollars a month, depending on who does it.

Maintenance is the least discussed line in every website conversation, and it is the one that decides what your site looks like three years from now. I covered it as a cost line in my website cost breakdown; this post is the operational version: exactly what the work is, what it honestly costs at each level, and the routine you can run yourself starting this month without paying anyone anything.

What does website maintenance actually include?

The word “maintenance” hides five different jobs. Knowing them separately matters, because cheap care plans cover one or two of them and quietly skip the rest.

1. Security and updates. The software your site runs on (the CMS, its plugins, its themes) ships security patches continuously, and unpatched software is how small business sites get hacked. Not by targeted attackers, but by automated scanners sweeping the internet for known holes. This category includes applying updates, keeping the SSL certificate valid, and checking that nothing broke after each update. It is the category with real consequences when skipped.

2. Backups. A copy of your site and its data, stored somewhere that is not the same server as your site, tested occasionally by actually restoring it. Hosting companies advertise backups; the fine print on retention and restore fees is where the surprises live. If you cannot say where your last backup is, you do not have one.

3. Content accuracy. Prices, hours, staff, services, photos. Wrong information is the most damaging website problem there is, and it accumulates silently, one retired service and one departed employee at a time. This is the category I called the truth test in my redesign-or-fix framework, and it is pure discipline, not technology.

4. Performance and breakage. Sites slow down over time as images pile up and plugins accumulate, and links die as pages you linked to move or vanish. A periodic speed check and a broken-link pass keep the decay from compounding.

5. Visibility and admin. Your Google Business Profile stays current (hours, photos, review responses; the full case for why this matters is its own post), your analytics still record, search engines can still find your pages, and your domain and hosting renew on a card that has not expired. Businesses genuinely lose their domains to a lapsed card on file. It is rare, and it is catastrophic, and it is entirely preventable.

What happens to a website nobody maintains

Nothing, for a while. That is what makes maintenance easy to skip.

Then the pattern I see over and over: somewhere in year two or three, the compound interest arrives. The plugin that was never updated becomes the hole that gets the site quietly hacked to serve spam links, which gets it flagged by Google. The prices from two years ago cost a customer conversation that never happened, and nobody will ever know its number. The site drifts slow enough that visitors leave before it loads. The contact form broke in an update eight months ago, and every inquiry since has gone nowhere.

By year three or four, the site has rotted into what looks like a design problem, and the owner starts shopping for a redesign. Some of those redesigns are really just deferred maintenance with a five-figure invoice. A maintained site almost never reaches that point, which is why I wrote in the redesign decision post that monthly maintenance is the cheapest redesign strategy there is.

One more category has teeth now: accessibility. Alt text, contrast, and form labels drift out of compliance as content gets added, and the ADA lawsuit wave targeting small business sites does not care that the site was compliant at launch. An annual accessibility pass belongs in the maintenance calendar.

How much does website maintenance cost?

Honest numbers, by level. The ranges are what I see in the market; the exact figure depends on your platform and how much content changes.

DIY: $0 plus about 30 minutes a month. The routine in the next section covers a standard small business site. Your real costs are hosting and domain (typically $100 to $400 a year combined) and your attention. This is a legitimate choice for a simple site and an owner who will actually do it. The failure mode is not skill, it is consistency.

Hourly help: roughly $50 to $150 per hour, as needed. A freelancer who does your updates and fixes quarterly. Works if you have a reliable person; the risk is that “as needed” in practice means “after something breaks,” which puts you back in the year-three story above.

Template care plans: roughly $30 to $150 a month. The plans sold by hosts and low-cost agencies. Read what is actually included: many cover only automated software updates and backups (categories 1 and 2) and none of the content, performance, or visibility work. Automated updates alone are better than nothing, and meaningfully less than “maintained.”

Full care plans: roughly $300 to $1,000 a month. All five categories, done by an agency or studio, usually with a monthly report. At the top of this range you are typically also paying for ongoing SEO or content work, which is a different purchase and worth separating in any quote you read.

What I charge: $500 a month. My care plan covers hosting, all updates and security patching, backups, monitoring, content changes when you send them, and an SEO report so you can see whether the site is earning its keep. It exists for exactly the failure pattern this post describes: sites that rot because the recurring work belonged to nobody. Full details are on the websites page, alongside my build pricing ($4,500 standard, $6,500 complex).

Level	Typical cost	What you actually get
DIY	$0 + ~30 min/month	Everything, if you are consistent
Hourly freelancer	$50 to $150/hr, quarterly	Updates and fixes, usually reactive
Template care plan	$30 to $150/mo	Automated updates and backups only
Full care plan	$300 to $1,000/mo	All five categories, reported monthly

The 30-minute monthly DIY routine

If you keep the site yourself, put a recurring calendar block on the first Monday of the month and run this list. It is deliberately short enough to survive contact with a busy month.

1. Update everything (10 minutes). CMS, plugins, themes. Then click through your five most important pages and submit your contact form to yourself to confirm nothing broke. The form test matters most; a silently broken contact form is the most expensive quiet failure a small business site has.
2. Check the backup (3 minutes). Confirm a backup from the last week exists somewhere off the server. Twice a year, actually restore one to prove it works.
3. Truth pass (10 minutes). Prices, hours, staff, services, one page per month on rotation. Fix what drifted.
4. Speed and links (5 minutes). Run the homepage through PageSpeed Insights and click the links on the page you edited. You are watching for decline, not chasing a score.
5. Admin glance (2 minutes). Google Business Profile current, analytics recording, domain and hosting renewal dates and payment card valid.

Once a year, add the longer passes: an accessibility check, a full content review of every page, and a look at whether the site still matches what the business sells. That last question, when it fails, is a redesign conversation, not a maintenance one.

When to pay someone instead

The DIY routine fails for predictable reasons, and they are worth being honest about upfront. Pay for maintenance when any of these is true:

• The routine will not survive your calendar. If three months have passed and the block got skipped every time, the plan is fiction. Deferred maintenance costs more than a care plan; that is the whole business case.
• Your platform fights you. Some builds make updates risky enough that each one needs a person who can fix what breaks. If you hold your breath every time you click update, stop clicking it yourself.
• The stakes went up. Client portals, e-commerce, regulated industries, or a site that generates real lead flow. When downtime and data have a price, monitoring and same-day patching stop being optional, and those are not 30-minute-a-month services.
• Your time is worth more. The routine is only free if your hour is free. For most owners it is not, which is the same arithmetic as every other hire-or-DIY decision: DIY to learn the terrain or when the budget genuinely is not there, pay when the math flips.

Frequently asked questions

How much does website maintenance cost per month?

For a typical small business site: $0 if you run a monthly routine yourself, $30 to $150 for template care plans that cover automated updates and backups only, and $300 to $1,000 for full-service plans covering security, backups, content, performance, and reporting. Mine is $500 a month, hosting included.

What is included in a website maintenance plan?

It varies enormously, which is the trap. A complete plan covers five categories: software and security updates, backups, content accuracy changes, performance and broken-link checks, and visibility admin (search presence, analytics, renewals). Many cheap plans cover only the first two. Ask a vendor which of the five they include, in writing.

Do static or custom-built sites need maintenance?

Less, which is one reason I build with modern static architecture, but not zero. A static site has almost no software attack surface to patch, and it still needs content truth passes, backups, link and speed checks, renewals, and accessibility upkeep. The security category shrinks; the accuracy and admin categories never go away.

How often should a website be updated?

Security patches: as released, which in practice means checking monthly at minimum, or automating them. Content: monthly truth pass on rotation. Full review: annually. The schedule matters less than its existence; sites fail from years of nothing, not from choosing the wrong month.

The one-sentence version

Your website is not a purchase, it is a small ongoing responsibility: five categories of upkeep, thirty minutes a month if you do it, a few hundred a month if someone does it for you, and a slow expensive rot if nobody does.

If you would rather it be somebody’s actual job, that is what my care plan is for. The websites page has the details, and if your site was built by someone else, that is fine; I take over existing sites after a quick health check, and I will tell you honestly whether yours needs a caretaker or a rebuild.

---

Jose Lugo is a CISSP-certified security engineer who builds fast, secure, AI-ready websites for small businesses at josecustom.ai.