Why a website needs maintenance, and what it really costs
- An un-updated site is the primary target for automated attacks.
- Maintenance starts at $100 a month; recovery after a hack costs several times more.
- The real value is not “fixing it” — it is noticing before your customer does.
“The site is built, it works, why pay every month” is a fair question — right up until the morning it does not open. Here is where that money goes.
What is covered
- Updates. Core, plugins and themes, applied on a staging copy first and only then to the live site.
- Backups. Daily, stored off the hosting account. A backup on the same server does not help when that server dies.
- Uptime monitoring. Continuous checks that the site loads and returns the right status code.
- Security. Login rate limiting, two-factor authentication, regular malware scans.
- Small changes. Edit text, add a product, publish a post.
- A monthly report. What was done, plus speed and Search Console trends.
Why “it just works” is not a thing
WordPress is the most widely used CMS in the world, which is exactly why it attracts the most automated attacks. Bots do not pick targets — they sweep sites looking for known vulnerabilities in outdated plugins. A site not updated for a year is an open door.
The overwhelming majority of infected sites we take over were not broken into through anything clever — it was a plugin nobody had updated in two years. The patch for that vulnerability had shipped back then.
Comparing the cost
| With maintenance | Without | |
|---|---|---|
| Annual cost | from $1200 | $0 |
| Recovery after a hack | included | billed separately |
| Downtime during an incident | hours | days |
| Spam pages in search results | caught immediately | found months later |
That last row is underrated. After a compromise the site often keeps working normally while thousands of injected pages quietly enter the search index. Google notices, the domain’s reputation drops, and cleaning up takes months.
Who genuinely needs it
- Online stores: an hour of downtime is lost orders.
- Sites with forms and personal data.
- Anyone without an in-house developer.
- Any site that generates enquiries — that is, any site whose downtime is measured in money.
We take on sites we did not build — audit first, plan second. If the state is critical, we will say so.