Website maintenance packages: what to include, and what to charge

What is a website maintenance package?

A website maintenance package is a monthly service that keeps a website updated, backed up, secure and working, usually with a set amount of time for small changes. It is sold by web designers, developers and agencies after a site launches, and by specialist maintenance firms.

The term covers very different services. At one end is an automated plan that runs updates and backups with nobody looking; at the other is a monthly retainer with a developer who knows the site and builds new pages. Comparing the two on price alone is how people end up with too little for a site that matters, or too much for one that does not.

This guide is written for both sides of the sale: agencies and freelancers deciding what to offer and charge, and businesses deciding what to buy. For agencies reselling the work, it connects to how white-label marketing works across services.

How much do website maintenance packages cost?

Website maintenance packages usually cost between $25 and $600 a month. FatLab’s buyer’s guide groups published packages into four tiers: budget at $25 to $50 a month, professional at $75 to $150, business at $200 to $400 and enterprise at $500 to $600 or more. FatLab sells maintenance itself, so read the ranges as one provider’s view.

Other providers sell blocks of time rather than tiers. Opal Infotech lists packages starting at $300 for 10 hours, which is $30 an hour. Xfive compared 19 published plans, and their prices span a similar range, from software-style subscriptions to monthly retainers.

Why the prices differ by a factor of ten

The cheapest plans are mostly automation: updates run by a tool, backups to a storage service and an uptime monitor, with little or no human time. The expensive ones buy a person’s attention: someone who tests updates before they reach the live site, answers when something breaks and makes changes. The price difference is mostly the difference in hours.

FatLab’s guide also lists the costs that cheaper plans often leave out: emergency support at $150 to $300 or more per incident and malware clean-up at $200 to $500 or more per event. A plan that looks cheap can cost more in a bad month than a plan that includes them.

What a website maintenance package should include

A website maintenance package should include tested updates, verified backups, monitoring for uptime and security, certificate and server checks, a stated number of hours for small changes and a monthly report. Each of these exists because the site will fail in a specific way without it.

Task	How often	Why it matters
Core, theme and plugin updates	Weekly, tested	WordPress updates minor core releases and translations automatically by default; themes and plugins need managing
Backups, checked	Daily, kept off the server	WordPress’s own upgrade guide says to verify that backups are there and usable
Server software	Quarterly review	WordPress recommends PHP 8.3 or later; older versions have reached end of life
Uptime monitoring	Every few minutes	So the site’s owner hears about an outage before customers do
Certificate renewal	Automatic, checked	Let’s Encrypt certificates are valid for 90 days
Security scans	Weekly	To catch malware and compromised accounts early
Speed checks	Monthly	Against Google’s Core Web Vitals thresholds
Small changes	As agreed	Text, images and minor fixes, within a stated number of hours
A monthly report	Monthly	What was updated, what was fixed and what needs a decision

WordPress, Upgrading WordPress; WordPress requirements; Let’s Encrypt FAQ; Google, Core Web Vitals

Updates, and why they need testing

WordPress’s documentation on upgrading lists four types of automatic background update, for core, plugins, themes and translation files, and notes that minor core updates and translation updates are enabled by default. That covers maintenance and security releases of WordPress itself, but not most of the plugins and themes that a typical site depends on. A maintenance package should say how those are updated, and whether updates are tried on a copy of the site before the live one.

Backups that have been checked

The same guide tells site owners to back up before upgrading, and to verify that the backups are there and usable, which it calls essential. A backup that has never been restored is a hope rather than a plan. A good package keeps backups somewhere other than the server the site runs on, and restores one as a test from time to time.

The server underneath

WordPress recommends PHP 8.3 or later and MySQL 8.0 or MariaDB 10.11 or later. It still runs on PHP 7.4 and MySQL 5.5.5, but says those versions have reached their official end of life and may expose a site to security vulnerabilities. Hosts move these versions on their own schedule, and a maintenance package should check them and plan the upgrade, because an old plugin can break when the server changes.

Certificates

A site’s HTTPS certificate expires. Let’s Encrypt certificates, which many hosts use, are valid for 90 days, and Let’s Encrypt recommends renewing them every 60 days. Renewal is usually automatic, but a maintenance package should check that it happened, because an expired certificate puts a security warning in front of every visitor.

A website maintenance checklist, by frequency

A website maintenance checklist splits the work by how often it needs doing: weekly tasks that keep the site safe, monthly tasks that keep it healthy, and quarterly and yearly tasks that keep it current. A package should say which of these it covers.

Every week

• Apply core, theme and plugin updates, on a copy of the site first where the site takes payments or bookings.
• Check that the week’s backups ran, and that one can be opened.
• Review security scan results and any failed login alerts.
• Look at the uptime log for short outages nobody reported.

Every month

• Test the forms and any checkout or booking flow end to end.
• Check for broken links and pages returning errors.
• Check page speed on the most visited pages against Google’s Core Web Vitals thresholds: LCP within 2.5 seconds, INP under 200 milliseconds and CLS under 0.1.
• Remove plugins and user accounts that are no longer needed.
• Send the monthly report.

Every quarter

• Restore a backup to a test location to prove it works.
• Check the server’s PHP and database versions against what the platform recommends.
• Review who has administrator access, and remove anyone who has left.
• Check that the certificate renewal and domain renewal dates are in hand.

Every year

• Renew the domain and any premium licences, in the client’s name.
• Review the hosting plan against the site’s traffic and storage.
• Check the privacy policy, cookie notice and contact details are still accurate.
• Agree the next year’s package, and any price change, in writing.

What happens when maintenance is skipped

When maintenance is skipped, a website rarely fails all at once. It fails in small ways that each look like bad luck: a security warning, a broken form, a page that will not load after an update.

• An expired certificate. Let’s Encrypt certificates last 90 days. If automatic renewal fails and nobody checks, visitors see a browser warning instead of the site.
• An end-of-life server. WordPress says PHP versions older than its recommendation have reached end of life and may expose a site to security vulnerabilities. A host upgrading PHP on its own schedule can also break an old plugin overnight.
• A broken update. WordPress’s upgrade guide tells owners whose site looks scrambled after an update to deactivate plugins that do not come with WordPress and reactivate them one by one, which is a job for someone who knows the site.
• A backup that does not work. The day a backup is needed is the wrong day to find out it was never verified.
• A form nobody tested. A contact form that stops sending email loses enquiries silently, sometimes for months.

None of these is dramatic, which is exactly why they go unnoticed without a routine. A maintenance package is mostly the cost of someone noticing.

What uptime promises mean

An uptime promise is a percentage of the month the site should be available, and the gaps are larger than the numbers suggest. In an average month of 30.44 days, 99.9% uptime still allows about 44 minutes of downtime.

Uptime	Downtime
99%	7.3 h
99.5%	3.7 h
99.9%	43.8 min
99.95%	21.9 min
99.99%	4.4 min

Calculated for an average month of 30.44 days (43,833.6 minutes)

Two things matter more than the headline number. The first is who is promising it: uptime depends mostly on the host, so a maintenance provider that does not run the hosting can monitor uptime and respond to outages but cannot guarantee it. The second is what happens when the promise is missed: a credit, a refund or nothing. A percentage with no remedy is a description, not a promise.

Website maintenance package tiers

Many providers sell three tiers: basic care, care with a few hours of changes, and a development retainer. The names vary; what matters is how many hours of human time each includes and what they can be spent on.

Care

Strengths

• Updates, backups, uptime and security monitoring
• Certificate and server checks
• A short monthly report

Limits

• No changes to the site beyond fixes
• Suits a site that rarely changes

The floor for any site that takes enquiries or payments.

Care and changes

Strengths

• Everything in Care
• A stated number of hours for small changes
• Speed checks against Core Web Vitals

Limits

• Hours that are not used should have a stated rule: lost, rolled over or capped

The usual choice for a small business that updates its site.

Development retainer

Strengths

• Everything in Care and changes
• New pages, features and integrations
• A named developer who knows the site

Limits

• Costs more; worth it only if the site keeps changing

For sites that are part of how the business sells.

Defining a small change

A common source of dispute is what counts as a small change. A clear package defines it by time, such as anything that takes under an hour, and gives examples: replacing text and images, adding a team member, fixing a broken link. New pages, new features and redesigns are development, priced separately or covered by the retainer tier.

Unused hours

If a package includes hours for changes, it should say what happens to the hours a client does not use in a month. The three common answers are that they lapse, that they roll over for a set period, or that they roll over up to a cap. Any of the three is fair if it is written down; a client discovering the rule after paying for unused hours is how relationships end.

What a monthly maintenance report should show

A maintenance report proves that the package did something in a month when nothing went wrong, which is most months. A useful one is short and covers four things:

1. What was updated. Core, theme and plugin versions before and after, and anything held back and why.
2. What was checked. Backups, uptime, security scans, forms and speed, with any problems found.
3. What was changed. The change requests completed and the hours they took, against the hours included.
4. What needs a decision. A plugin with no updates, a PHP upgrade coming, a licence to renew.

Doing it yourself or buying a package

Whether to maintain a website yourself or buy a package depends on how much the site matters to the business and how much time someone has to look after it. The weekly checklist above is not long; the difficulty is doing it every week, and knowing what to do when an update goes wrong.

• Do it yourself if the site is small, uses few plugins, takes no payments and someone on the team is comfortable restoring a backup.
• Buy a care package if the site takes enquiries or bookings, nobody in-house wants the job, or the last update that went wrong took a day to fix.
• Buy a development retainer if the site changes every month, because a maintainer who also builds will cost less than paying for each change as a project.

The calculator below works for both decisions: put in your own time as the cost of an hour and the margin at zero, and it shows what doing it yourself costs a month.

How to price a website maintenance package

Price a website maintenance package from the hours it takes, the tools it uses and the margin you need. Copying a competitor’s tier prices without knowing their hours can leave an agency maintaining sites at a loss.

Enter the hours a site takes each month, what an hour costs you, the tools you pay for per site and the margin you want.

Routine care hours a monthhChange hours included a monthhCost of an hour of your time$Tools and services per site a month$Target margin%

Monthly cost of the package

$230.00

(care + change hours) x rate + tools

Price that leaves the margin

$383.33

Cost / (1 – margin)

Effective hourly price

$95.83

Price / hours included

Hypothetical defaults. The cost of an hour should include your overheads, not only pay. Tools means backup storage, monitoring, security and any licences you pay for per site.

At the defaults, 2 hours of routine care and 2 hours of changes a month at $50 an hour, plus $30 of tools, cost $230 a month. To keep a 40% margin, the price is $230 / 0.6 = $383.33, which works out at about $95.83 for each hour included. Change the inputs to match your own costs.

Margin, not markup

The calculator divides by one minus the margin rather than adding a percentage to the cost, because a 40% markup and a 40% margin are different prices. Adding 40% to $230 gives $322, which is only a 28.6% margin. The difference is explained in markup vs margin, and the markup calculator works it out for any cost and target.

Per site or per client

Price per site, not per client. A client with three sites has three sets of updates, backups and certificates, and three things that can break. Where several sites share a codebase, the routine care hours fall, and the calculator shows how much the price can follow.

Website maintenance contract terms

The terms of a maintenance package decide what happens in a bad month, which is when they matter. Write them down before the first invoice.

• Response times. How quickly urgent problems, such as a site that is down or hacked, are answered, and how quickly routine requests are.
• What is excluded. Malware clean-up, restores after a client’s own mistake and problems caused by the host, and whether each is included or priced. FatLab’s figures for emergency fees show why this matters.
• Access. The provider works with its own login, not the client’s, and that login is removed when the package ends.
• Ownership. The hosting, domain and premium licences are in the client’s name, so the client is never locked to the provider.
• Notice. How much notice either side gives to end the package, and what is handed over, including the latest backup.
• Price changes. When the monthly price can change, and how much notice is given.

Scope

The tasks and how often each happens are written down Small changes are defined, with a number of hours What happens to unused hours is stated

Response

Response times are stated for urgent and routine problems Malware clean-up and restores are either included or priced Someone is named as the contact

Ownership

The client owns the hosting, domain and licences The provider has its own login, removed when the plan ends Backups can be handed over

Proof

Backups are restored as a test at least occasionally The monthly report shows what was done, not only that the site is up The notice period to end the plan is stated

Ticks are saved in your browser.

Ending a maintenance package cleanly

The end of a package is where ownership is tested. When a package ends, the client should receive the latest backup, a list of the plugins, themes and licences in use with their renewal dates, any notes on custom code, and confirmation that the provider’s login has been removed. If the hosting, domain and licences were in the client’s name from the start, this takes an hour; if they were in the provider’s name, it can take weeks and goodwill on both sides.

Reselling website maintenance as an agency

Many agencies offer maintenance on the sites they build, because it is recurring revenue and keeps the client relationship going between projects. The work itself can be done in-house or by a white-label partner, under the agency’s name.

If the work is done by a partner, the arithmetic is the same as above with the partner’s wholesale price as the cost, plus the agency’s own time on the account. My own white-label web development includes a monthly development and care option at $1,200 wholesale, half its $2,350 market rate, which suits sites that keep changing; a site that only needs care needs far fewer hours and should be priced from them.

Whoever does the work, the ownership rules do not change: the hosting, the domain and the licences stay in the client’s name, the provider works with its own login, and the agency can move the work in-house or to another partner without the client noticing. The full price list, with the source for each rate, is on the white-label price list.