How much does website maintenance cost?

What UK providers actually charge

Every figure below is a published price from the provider's own page, checked 15 September 2026. VAT is noted where the provider notes it.

One warning about the numbers you'll see elsewhere: there is no UK survey data on what small businesses pay for maintenance. Every “average UK cost” figure online comes from a company selling the service, and the comparison articles in this niche are written by sellers who name no competitors and cite no data. One provider's guide quotes a “July 2026 survey” with no provider names and no methodology at all.

What a plan actually includes

Across every UK provider publishing an itemised list, the same seven things recur:

• Core, plugin and theme updates — frequency varies from monthly to weekly, and nobody publishes a rationale for their chosen cadence. It's a pricing lever, not a technical standard.
• Backups — daily is standard. The only distinction that matters is whether they're held off the server.
• Uptime monitoring — JMJ check every 15 minutes at £49; Red Sentence only include it at £250.
• Security and malware scanning.
• Support or development time — the real differentiator.
• A monthly report.
• Hosting — included by some, excluded by others, unstated by several. This single variable makes most published prices non-comparable.

Split honestly, that's: genuinely necessary on WordPress — applying updates and checking the site still works, off-site backups that can actually be restored, keeping PHP supported, someone to call. Often already paid for elsewhere — backups, SSL and malware scanning, all of which come with decent hosting. Not maintenance at all — content changes and new pages, which is billable work sold by the hour and bundled into a subscription.

What actually needs doing — and it depends entirely on your platform

This is the part that changes the answer completely, and almost no cost guide makes the distinction.

If your site is self-hosted WordPress, there is real recurring work: core, plugin and theme updates, checking nothing broke afterwards, backups, and keeping PHP on a supported version. PHP matters and has hard dates — PHP 8.2's security support ends on 31 December 2026, PHP 8.1's ended on 31 December 2025, and 8.0 and 7.4 are long gone. WordPress will still run on PHP 7.4 — its minimum supported version — but the WordPress project's recommended minimum is 8.3. “It still works” is not evidence it's safe.

If your site is plain HTML pages — no content management system, no plugins, no database — there is nothing to patch. Nothing executes on the server. What remains is the domain renewal, the hosting, SSL (automatic) and content changes. A monthly maintenance fee on a static site is buying content-change hours and nothing else.

If your site is on Wix or Squarespace, the platform maintains itself. Wix states it has “a dedicated SOC team” monitoring the platform around the clock with “automated vulnerability scans that find and fix risks”. Squarespace states that domains pointing to a Squarespace site “are automatically protected with free SSL certificates” and that “SSL is automatically enabled. You don't need to do anything to set it up.” Again: a plan here is content hours.

So the first question isn't “how much should maintenance cost?” It's “what am I on?” If you're not sure, do I own my website covers how to find out.

The security case, with the numbers both ways

The security argument for maintenance is real. It's also routinely overstated by people selling security products, so here are the figures with the conflicts named.

Patchstack (which sells vulnerability intelligence) recorded 11,334 new vulnerabilities in the WordPress ecosystem in 2025, up 42% on 2024. The split is the useful part: 91% were in plugins, 9% in themes, and WordPress core had six, all low priority. It also found the median time to mass exploitation for heavily-exploited vulnerabilities is five hours. And counter-intuitively, paid plugins were not safer — premium components made up 29% of reports but had three times more known-exploited vulnerabilities than free ones.

Wordfence (which sells a firewall and scanner) published 8,223 vulnerabilities for 2024 with only five affecting WordPress core, and 96% in plugins. But read what they say next, in their own words: “over 68% of vulnerabilities disclosed in 2024 are low-threat issues... most site owners should not be overly alarmed simply by the sheer volume of vulnerabilities disclosed.” Only 7.4% were classed high-threat. They also report that 35% of 2024's disclosed vulnerabilities still had no patch available a year later — which matters, because a care plan cannot apply an update that doesn't exist.

Sucuri (which sells malware clean-up, so its data comes from already-compromised sites) found that 39.1% of compromised sites had outdated software at the point of infection. The honest corollary, which nobody selling maintenance quotes: about 61% did not. Keeping everything updated reduces the risk. It doesn't remove it.

What happens if you don't

Not usually “you get hacked tomorrow”. The realistic consequence is slower and worse: if your site is compromised, Google flags it, and “pages or sites affected by a security issue can appear with a warning label in search results or an interstitial warning page in the browser”. Getting that lifted means requesting a review, and Google says “most reconsideration reviews can take several days or weeks”.

Worse, there's a repeat-offender rule: sites that “repeatedly switch between compliant and noncompliant behavior within a short window of time” are classed as repeat offenders and cannot request another review for 30 days. So a site that gets cleaned and then reinfected can sit behind a browser warning for a month. That is the real cost — not drama, just weeks of invisibility.

What you can do yourself

More than most plans imply, and this is the fair way to judge one.

Since WordPress 5.5 you can switch on automatic updates plugin by plugin and theme by theme from the dashboard, with a checkbox and a bulk action. It takes about five minutes and costs nothing. Install UpdraftPlus — over three million active installations — and schedule free backups to Google Drive, Dropbox or elsewhere, with restore from the dashboard. Delete plugins and themes you don't use. Check your contact form works once a month. Look up your PHP version in your hosting control panel.

What you should not do: a major core upgrade on a live site with no backup, edit theme or plugin files, change the PHP version without a way back, or remove a plugin you can't identify.

The overlap nobody mentions

Look at what your hosting already includes before you judge a care plan.

20i (from £10/month) includes free SSL, automatic daily backups with 30-day retention and one-click rollback, and WAF and malware scanning, on every plan. Krystal (from £7/month) includes unlimited free SSL, daily snapshot backups rising to four-hourly at £19, and real-time scanning. UptimeRobot gives you 50 monitors at 5-minute intervals for nothing — which is more frequent than the 15-minute checking some plans list as a headline feature.

So on a small site with £7 to £20 a month hosting, the backups, SSL, malware scanning and uptime monitoring on a typical £49 to £65 care plan are largely already paid for. What isn't duplicated is the human part. Judge the fee on that.

If you stop paying, what happens to the site?

Of the six UK maintenance providers checked for this guide, not one published an answer. They publish notice periods and refund rules; none says what becomes of your website. Six checked, none answering — that silence is itself the finding.

Where the plan is bundled with a pay-monthly build, providers do publish, and the answers are worlds apart:

• Pixelish: you own the site “once the build is paid for: the design, the files, the lot”, and the domain “stays yours. It was in your name from day one”.
• Kitching Ltd: rolling monthly, no lock-in — but “if you cancel your subscription, the website will be taken offline”.
• Maverick Websites: retains “ownership and copyright of the design, underlying code and any bespoke assets created”; on cancellation “the website will be removed from your servers”.

“No contract” and “cancel any time” do not mean you keep the website. Two of those three let you leave whenever you like and take the site down when you do. Ask the question directly, and get the answer in writing.

The nine questions that settle whether yours is fair

All answerable from the plan documents and one email:

• Is hosting inside this price or on top? Without knowing, the price isn't comparable to anything.
• How many hours are included, and do they roll over? Divide the annual fee by the annual hours — one UK agency publishes £90/hour, so you have a benchmark.
• What does my hosting already include? If it does daily backups and SSL, what is the plan adding?
• When was an update last applied, and was the site checked afterwards? Ask for the last three monthly reports.
• Has a backup ever been restored? An untested backup isn't a backup.
• What PHP version is the site on, and is it still supported?
• Am I on WordPress at all? If it's static or a builder, ask what specifically is being updated.
• What's the notice period, and what happens to the site if I leave?
• Is this plan attached to a build I haven't finished paying for? If so, part of the “maintenance fee” is instalments.

If the answers come back specific, you're being looked after. If they come back vague, you're paying for a subscription rather than a service — which is the same problem covered in I paid for a website and get nothing.

Common questions

How much does website maintenance cost per month in the UK?

Published UK prices run from £24.99 + VAT to £1,000 a month. Most small business plans sit between £49 and £150 a month. There is no official average — every ‘average UK cost’ figure online comes from a company selling maintenance, and the ranges in those articles cite no data.

What does website maintenance include?

Across UK providers that publish an itemised list, the recurring items are: WordPress core, plugin and theme updates; backups; uptime monitoring; security and malware scanning; a monthly report; and an allowance of support or development time. The last one is the real differentiator — published allowances run from 60 minutes a month to 12 hours a quarter.

Do I need a maintenance plan for a Wix or Squarespace website?

There is nothing technical to maintain. The platform patches itself and SSL is automatic — Squarespace states that domains pointing to a Squarespace site “are automatically protected with free SSL certificates” and that “you don't need to do anything to set it up”. A maintenance plan on a builder site is buying content-change hours, which can be perfectly reasonable, but it should be described as that.

Is my website really at risk if I don't maintain it?

Some risk, but less dramatic than the sales pitch. Sucuri's data from sites it was paid to clean found 39.1% of compromised sites had outdated software at the point of infection — meaning around 61% did not. Wordfence, which sells security software, says of the 2024 disclosures that “most site owners should not be overly alarmed simply by the sheer volume of vulnerabilities disclosed”, with only 7.4% classed high-threat.

Can I do website maintenance myself?

Much of it, yes. Since WordPress 5.5 you can switch on automatic updates plugin by plugin and theme by theme from the dashboard with a checkbox, free, in about five minutes. UpdraftPlus, installed on over three million sites, schedules free backups to Google Drive or Dropbox with restore from the dashboard. What a plan genuinely adds is someone checking the site still works after an update, and rolling it back when it doesn't.

What happens to my website if I stop paying a care plan?

Of six UK maintenance providers checked in September 2026, not one published an answer. They publish notice periods and refund rules only. Where the plan is attached to a pay-monthly build, providers do publish, and the answers differ completely — some hand over all the files, others state the website “will be taken offline” on cancellation. Ask before you sign, and get it in writing.

Prices checked 15 September 2026 from each provider's own page: JMJ Digital, Red Sentence, MKX Design, Web Support Services, Neil Patmore, Webshape Design, ALT Agency, EdTheDev, Pixelish, Brambla, Cheap Web Design, Hollis Web, Plumber Web Design, Aspire Tech, Maverick Websites, Kitching Ltd. Technical facts from php.net's supported-versions and end-of-life pages, WordPress.org and make.wordpress.org documentation (PHP support clarification, May 2026; automatic updates), UpdraftPlus on WordPress.org, Let's Encrypt, and Google Search Central (Security Issues report; Safe Browsing repeat offenders). Security figures from Patchstack's State of WordPress Security 2026 (2025 data), Wordfence's 2024 Annual Vulnerability and Threat Report, and Sucuri's 2023 Hacked Website & Malware Threat Report — all three companies sell security products, and Sucuri's sample is drawn from sites it was paid to clean. Hosting inclusions from 20i and Krystal; monitoring pricing from UptimeRobot. Every maintenance price here is published by a company selling maintenance; none has been averaged or estimated.