Website Maintenance Plans: What Should Be Included and What They Should Actually Cost

A clothing retailer we'd built a site for two years earlier called us in a mild panic last month. Their checkout had stopped working sometime over the weekend, and by the time a customer emailed to complain about it on Monday morning, they estimated they'd lost close to four days of online orders during a sale period. Nobody had touched the site since launch. No one was watching for this. A payment gateway plugin had pushed an update that quietly broke compatibility with an older WordPress version, and because there was no maintenance plan in place, no one caught it until a paying customer did.

That story isn't rare. It's close to the default outcome for any website that launches without someone assigned to keep an eye on it afterward. "Website maintenance" sounds like the boring line item on a proposal, the one clients skim past to get to the design mockups, but it's usually the difference between a site that quietly keeps working for years and one that breaks in some small, expensive way roughly every six to twelve months.

The word "maintenance" covers about six different jobs, and agencies rarely separate them

Part of why maintenance pricing looks so inconsistent across agencies is that the word is doing a lot of work. When a client asks "do you offer maintenance," they might mean any of these, and a fair plan should tell you plainly which ones are actually included rather than bundling vague reassurance into a single monthly number.

• Core software and plugin updates - keeping WordPress, Shopify apps, npm packages, or whatever the site runs on patched against known vulnerabilities and compatibility breaks
• Backups that are actually tested - a nightly backup nobody has ever restored from is not a safety net, it's a hope
• Uptime and error monitoring - something pinging the site every few minutes so a 500 error gets caught in minutes, not when a customer emails
• Security scanning and hardening - malware scans, firewall rules, and login protection, separate from general updates
• Small content edits - swapping a banner, updating a phone number, fixing a typo, without opening a ticket with a full dev sprint attached
• Performance upkeep - checking page speed hasn't degraded as more images, plugins, and tracking scripts get added over time

Most of the maintenance complaints we hear from business owners who've switched agencies trace back to one of these being silently dropped, not to the whole list being ignored. An agency that says "yes we do maintenance" and means only backups is not lying, exactly, but it's also not telling you enough to make a real decision.

What the three common tiers actually cost, and what changes between them

In the Indian market, we see maintenance retainers cluster into three rough bands. None of these numbers are fixed - a high-traffic e-commerce store with custom checkout logic costs more to maintain than a five-page brochure site - but they're a reasonable starting point for sizing up a quote.

• Basic / DIY-lite (₹2,000-6,000 per month): automated backups, core updates applied on a schedule, and uptime monitoring with an alert. No content edits, no priority support, and you're on your own if something breaks between check-ins
• Standard (₹6,000-20,000 per month): everything in basic, plus a small bucket of monthly content edit hours, security scanning, and a same-week response time on issues - this is where most small business sites with real traffic should land
• Full dev retainer (₹20,000-75,000+ per month): a developer effectively on call, priority same-day fixes, performance tuning, and capacity for small feature work without a fresh quote every time - worth it once the site is generating meaningful revenue or the business can't tolerate more than a few hours of downtime

We wrote more about how these numbers compare to build costs in our piece on website development cost in India, and the short version is that maintenance is usually 10-20% of the original build cost annually if you want it done properly. A ₹1.5 lakh website with zero ongoing budget is a website that's slowly decaying from the day it launches.

The maintenance plans that are actually a markup, not a service

Here's an opinion some agencies won't like: a meaningful share of the maintenance retainers we've seen quoted to small businesses are close to pure margin. If a plan is ₹15,000 a month and the only thing happening behind the scenes is an automated backup script that costs the agency a few hundred rupees to run, you're not paying for maintenance, you're paying for the agency's recurring revenue target. That's not automatically a scam - some of that margin funds the on-call developer who's available when something actually breaks - but you should be able to ask what's included and get a specific answer, not a shrug and "we handle everything."

If an agency can't tell you exactly what happens to your site in a given month under their maintenance plan, assume the honest answer is closer to "not much" than they'd like you to believe.

What actually breaks when nobody's watching

The failure modes are rarely dramatic. They're small, slow, and cumulative, which is exactly why they're easy to ignore until they aren't.

• An SSL certificate expires unnoticed, and visitors start seeing a security warning before they even reach the homepage - we've seen this quietly tank a week of ad spend before anyone noticed the browser warning was scaring off clicks
• An outdated plugin becomes the entry point for a hack, and the first sign is Google flagging the site as unsafe in search results, not anything visible on the front end - our website security guide covers how these entry points actually get exploited
• A theme or plugin update silently changes how a contact form submits, and leads stop arriving with no error message anywhere
• Page speed degrades a few hundred milliseconds at a time as tracking scripts and plugins pile up, until a year later the site that used to load in under two seconds takes six
• Content quietly goes stale - old pricing, an event page for something that happened eighteen months ago, a team member who left the company still listed as a contact

None of these individually feels urgent enough to budget for in advance. Collectively, they're why a site that looked sharp at launch can feel embarrassing two years later, and why we sometimes get redesign inquiries where the honest answer is "you don't need a redesign, you need someone to have been maintaining this the whole time." If you're genuinely unsure which situation you're in, our post on signs you actually need a website redesign is a decent gut check before you commit to a bigger rebuild than you need.

Questions worth asking before you sign a maintenance retainer

Treat the sales call the way you'd treat any recurring contract, because that's what it is. A few questions tend to separate a real maintenance service from a line item designed to look reassuring on an invoice.

• Can you show me a log or report from an actual month of work on another client's site? Vague answers here are the biggest red flag
• What's the response time if something breaks on a weekend, and is that written into the agreement or just implied
• Are backups stored somewhere outside the same hosting account as the live site, so a hosting-level failure doesn't take both down together
• How many content edit hours are included per month, and what happens to unused hours - do they roll over, or do you lose them
• What's the exit process if you want to leave - do you keep full access to your own hosting, domain, and codebase, or does leaving mean starting over

That last one matters more than people expect. We've inherited more than one client whose previous "maintenance" arrangement meant the agency held the only admin login, and untangling that took longer than it should have.

When you genuinely don't need a formal plan

Not every site needs a retainer, and it's worth saying that plainly since agencies rarely will. A static site built on a modern framework with no database, no login system, and no e-commerce - the kind of build we cover in our static versus dynamic website guide - has a much smaller failure surface than a WordPress store with a dozen plugins. If that describes your site, a lightweight annual check-in and a solid host with automatic backups might genuinely be enough, and paying for a full monthly retainer on top of that is money spent on reassurance rather than risk reduction.

The calculation changes fast once you add a CMS with regular plugin updates, any form of e-commerce, or a login-gated area for customers or staff. At that point the site has moving parts that need active attention, and skipping maintenance isn't a cost saving, it's a deferred cost with interest.

If you're not sure whether your current setup needs a real maintenance plan or just a better host, send us the site and we'll tell you honestly which one it is - get in touch if you want a second opinion on a quote you've already received.