Website maintenance cost in the UK usually runs from about £50 to £300 a month for basic upkeep, and from around £500 to more than £2,000 a month once content, SEO and development work are added, according to Red Evolution's 2026 guide. Those figures tell you what people charge. They don't tell you what you get, and two plans at the same price can be very different things.
This guide covers what a website maintenance package should include, what usually sits outside it, and the one test that shows whether yours is worth paying for: what happens on the day a serious security flaw is announced in the software your site runs on.
How much does website maintenance cost in the UK?
Published UK guides broadly agree on two bands.
- Basic maintenance: about £50 to £300 a month. Hosting, backups, software updates and small changes. (Red Evolution)
- Comprehensive management: around £500 to £2,000 or more a month. The basics plus SEO, content, analytics and ongoing development. (Red Evolution)
Another way to read a quote is in hours. Opace's guide models basic maintenance at 1 to 3 hours of work a month, full support at 3 to 8 hours and a fully managed service at 8 to 20 hours. Multiply by the supplier's hourly rate and you can see roughly how much attention the monthly fee is really buying.
Bear in mind that most published figures come from agencies that sell maintenance, so treat them as a guide rather than a neutral benchmark. We only look after sites we have built ourselves, so ours isn't an off-the-shelf package and we don't quote a figure for it here.
What should a website maintenance package include?
Whatever the price, these are the things that keep a business website safe and working. If a plan leaves one out, ask why.
- Security updates applied as soon as they matter. Not saved up for a monthly visit. A serious flaw doesn't wait for your maintenance day.
- Backups that have actually been restored. A backup nobody has tried to restore is a hope, not a backup. Ask when it was last tested.
- Monitoring that tells them before your customers do. Not just "is the site up?", but whether the things that should have happened, like enquiries arriving and orders going through, actually did. We wrote about this in Something broke at 3am.
- Certificates and renewals handled. The padlock certificate, the domain name and anything else that expires, renewed before it lapses.
- A person who knows your site. Someone who can answer a question without starting from scratch every time.
- A plain note when something has been done. You shouldn't have to ask whether the update happened.
What website support and maintenance usually doesn't cover
Most of the arguments about maintenance happen here, so check before you compare prices.
- New features and redesigns. Maintenance keeps what you have working. Building something new is usually quoted separately.
- Content and SEO work. Writing pages, adding blog posts and improving search rankings are often a separate service, or a higher tier.
- Out-of-hours emergencies. Some plans only cover office hours, and charge extra for a weekend fix.
- Licences and add-ons. Paid plugins, themes and third-party services may be billed on top.
- Hours beyond the allowance. If a plan includes a set number of hours, find out what the next hour costs.
The test that matters: the day a serious flaw is announced
Most months, maintenance looks like nothing at all. The real test comes on the day a serious flaw is announced in the software your website runs on, and that happens more often than most owners realise.
This week was one of those days. A flaw was announced in PHP, the software behind a large share of the web, every WordPress site included, that could let someone take control of a website without ever signing in. A fixed version was released. Nothing about an affected website looked any different, which is exactly the problem: an owner with nobody watching would have no reason to know anything had changed.
For the sites we look after, no customer had to ask. We moved each live site onto the fixed version, checked that each one still worked exactly as before, and told customers in plain English what had changed and that there was nothing for them to do.
For a sense of what "promptly" should mean, Cyber Essentials, the government-backed scheme we are certified under, expects critical and high-risk security updates to be applied within 14 days of their release. A plan that only updates once a month can miss that on its own schedule.
Questions to ask a website maintenance company
- Who watches for security announcements that affect my site, and how quickly are critical updates applied?
- Who checks the site still works after an update?
- When did you last restore one of my backups?
- How will I find out if my site has a problem, and how will you?
- What happens outside office hours?
- Will you tell me when an update has been done?
- What exactly is outside the monthly fee?
A provider with good answers will give them without hesitating. Vague answers to the first two are the ones to worry about.
Why we only maintain the sites we build
We don't take on maintenance of websites built by someone else. The people who host your site are the people who wrote it, so when an update arrives we already know every part it touches, and we can check the result properly rather than hoping nothing breaks.
The honest downside is that if your site was built elsewhere, we aren't the right choice for a maintenance plan on it. If it is a WordPress site, our post on running your whole business on WordPress explains where most of its security problems come from and what to ask whoever looks after it.
If you are planning a new site, or a system your business depends on, and want hosting and maintenance from the same team that builds it, see how our managed hosting works or book a meeting and we'll talk it through.