Website maintenance cost: what changes it

Platform and plugins

The first question in any maintenance quote is what the site is built on. The platform, the theme and every plugin are software that their own developers keep changing. Each change has to be applied, and each one can break something else. The more separate pieces a site depends on, the more updates arrive, the more combinations need testing, and the more time each month goes into keeping them working together.

A worked example. Two sites look the same to a visitor. The first is a set of static pages, with its contact form handled by the host. It has almost nothing to update and very little that can be attacked. The second runs on a popular content management system with a page builder, a forms plugin, a caching plugin, an SEO plugin and a translation plugin, each made by a different company. When the page builder releases an update, someone has to confirm that the forms still send, the cache still clears and the translated pages still load. The second site is not worse. It simply has more to look after, and every one of those pieces has its own release schedule.

Custom code sits between the two. It avoids third-party plugins, but it has its own dependencies, and it is only as easy to maintain as it is well documented. This is why, when we scope a website build, the way it will be maintained is part of the brief. Decisions made during the build set the cost of every month that follows.

How much the business depends on the site

The same site can need very different care depending on the role it plays. A site that exists to be found and to give a phone number can be down for an afternoon without anyone noticing. A site that brings in enquiries every week cannot, because a fault there costs the business work it never knew it lost. Maintenance cost rises with what a failure costs, not with the size of the site.

Consider Leadinsure, an insurance brokerage site in our shipped work. A visitor chooses a line of insurance, and the quote form opens already set to that choice. The quote forms are among the most important parts of the site. A change at the mail provider, a spam filter set too tight, or an update to the form component can stop requests like these arriving, with no error anywhere on screen. For a site like that, maintenance has to include testing each form end to end on a schedule, not only checking that the home page loads.

Compare a portfolio site that changes rarely and receives few messages. It needs the same basics: updates, backups, a valid certificate. Its forms do not need testing as often, and a fault can wait for normal working hours. The two sites might be the same size. They are not doing the same job, and they should not be maintained as if they were.

Traffic and hosting

Hosting is often part of a maintenance arrangement, and traffic shapes its cost. Volume is only part of it. What matters more is how visits arrive, what each visit asks the server to do, and what happens when demand rises at the wrong moment.

A site of mostly static pages can be served through a content delivery network, close to every visitor, and it absorbs a sudden rise in visits with little effort. A site that builds each page on the server, queries a database on every request, or lets visitors log in, search and filter, needs more capacity. It also needs caching that someone configures and watches, and monitoring that notices when pages start to slow down before visitors do.

A worked example. A restaurant's information site and a restaurant's table-ordering system are both busiest at dinner time. The information site shows the same pages to everyone, so a full evening barely registers. In the ordering system, at the same moment, guests are placing orders, waiters are approving them and screens in the kitchen are updating. That load has to be planned for, tested and watched. The hosting has to leave room for the busiest Saturday of the season, not a quiet Tuesday.

How often content changes

Some sites are finished at launch and change only when the business does. Others behave like publications, with new articles, new products, new staff pages and new offers every week. Frequent change costs maintenance time in two ways. The changes themselves take hours if the business asks someone else to make them. And every new page is one more place where a broken link, an oversized image or a missing title can appear.

The answer is rarely to stop changing the site. It is to decide who changes what. Where the owner edits content directly, the maintenance work moves elsewhere: into editing fields that are hard to misuse, sensible limits on images, and checks that catch a mistake before a visitor does.

Two worked examples, both shipped products. Kalimenu is a QR menu for restaurants, tavernas, cafés and hotels. The venue changes its own dishes and prices in the admin area, whenever it wants, and the changes appear straight away without reprinting the QR codes. Content can change every day, and nobody has to file a request for it. Leadinsure carries a different kind of content: a large library of insurance guides, each a page that has to stay accurate, linked to the others and indexed. Both hold a lot of content. The maintenance load differs in kind. In one case the work is making everyday edits by the owner safe. In the other it is keeping a whole library in order.

E-commerce and payments

A site that takes money carries a different kind of responsibility. Checkout depends on the shop software, the payment provider, the tax and shipping rules, and the emails that confirm each order. Any of these can change without warning. A fault in any of them does not merely inconvenience a reader. It stops sales.

Maintenance for a shop therefore includes work that a brochure site never needs: test purchases after updates, checks that confirmation emails arrive, attention to the payment provider's notices about changes, more frequent backups so that no order is lost if the database has to be restored, and a staging copy of the site where updates are tried before they reach customers.

A worked example. At a table using Kalimenu, the guest orders, pays by card, Apple Pay or Google Pay, can split the bill, and the money goes directly to the venue's own Viva Wallet account. The payment passes through services outside the product itself: the payment provider and the wallet services. If one of them changes something and nobody is watching, the venue finds out at the table, in front of a guest. A small online shop with a handful of products has the same structure on a smaller scale. What sets its maintenance cost is less the number of products and more the number of things that must keep working for one payment to complete.

Security and compliance

Every public site needs current software, a valid certificate and backups. Beyond that baseline, the work grows with what the site holds. A form that asks for a name and an email address is collecting personal data, and data protection law expects that data to have a clear purpose, to be kept no longer than needed and to be protected. User accounts add passwords, sessions and access rights. Documents about people add the question of who can see them, and what is recorded when they do.

Compliance is not a task that ends at launch. The cookie banner has to match the scripts actually running on the page. The privacy notice has to match the services actually in use. Deletion has to happen, not just be promised. Every new form, plugin or tracking script reopens these questions, and someone has to answer them each time.

A worked example. Leadinsure's newsletter sign-up asks for consent with a checkbox and links to its privacy policy, and its quote forms take requests about the insurance of individuals and businesses. AppInsure, a free iOS app we shipped, goes further. A person signs in with their tax number and sees their policies, cover and expiry dates in one place, kept current by their broker. A brochure site with no forms carries a light version of this work. A product that holds insurance details about real people carries all of it: access has to be reviewed, updates handled with care and changes recorded.

Response time expected

The last factor can outweigh all the others. When something breaks, how soon must someone start working on it? A response on the next working day is one kind of arrangement. Cover in the evenings, at weekends and on public holidays is another, because it means a person is available at the hours when most businesses are closed.

The useful distinction is between first response and resolution. First response is the time within which investigation begins, and it can be promised. Resolution depends on the problem, and nobody can honestly guarantee it for a fault they have not yet seen. An agreement that promises a fast fix for anything is promising something it does not control.

A worked example. If an accountant's website goes down on a Saturday night, it can wait until Monday; the people who meant to visit will come back. If a table-ordering system stops taking orders on a Saturday night, it cannot wait until the kitchen closes, because the guests are already seated and the kitchen is waiting for their orders. The expected response time follows the hours in which the business actually earns. The closer those hours sit to evenings and weekends, the more the agreement has to cover.

Putting the factors together

No single factor decides the cost. A simple site with an expensive failure can need more care than a large site that rarely changes. The way to scope maintenance is to take the questions in order: what the site is built on, what the business loses when it stops working, how it is hosted and how busy it gets, how often it changes and who changes it, whether it takes money, what data it holds, and how quickly someone must respond. The answers describe the work, and the work sets the cost.

This is how we scope Website Care. It is one standard, applied to every site we look after and sized to the role that site plays, and it is quoted in writing before it begins. This page is about what makes maintenance larger or smaller. For the components any responsible arrangement should contain, whoever provides it, read what a website maintenance plan should include. If you want your own site measured against these factors, the starting point is a technical audit of what is already there.