Website Maintenance Cost: What a Quote Should Actually Include

If two maintenance quotes differ by a factor of ten, they are probably not pricing the same work. Published 2026 guides put small-business website maintenance anywhere from about $35 to $500 a month, and the full market runs from $20 to $25,000 or more. The monthly number tells you almost nothing. The line items tell you everything: whether updates are tested before going live, whether your backups can actually be restored, who pays when malware shows up, how many human hours are included, and how fast someone responds when something breaks. Below: a worksheet to score any quote, and a transparent annual cost model for WordPress, Shopify, and custom Next.js sites.

Why quotes for the “same” job run from $20 to $25,000 a month

The spread is real, and it is mostly a scope difference wearing a price tag. AgencyPartner Interactive’s 2026 maintenance cost guide (updated October 19, 2026) puts the overall market at $20 to $25,000+ per month: $50–$500 a month for a small business website, $300–$1,000 for a small-to-midsize ecommerce store, and five figures at enterprise scale. WebFX’s pricing guide lands lower for simple sites — $35 to $100 a month for a small business website, up to $1,500–$2,500 a month for ecommerce (figures summarized by PageSimple, 2026).

At the bottom of the market you are buying automation: scheduled updates, a daily backup, and an email inbox if something goes wrong. FatLab’s market-tier comparison (September 2025) prices that budget tier at $25–$50 a month with zero developer hours. Each step up buys human attention — updates tested on a staging copy, faster first response, and finally a block of developer hours (2–4 a month at FatLab’s $200–$400 business tier; 6–10+ at $500–$600+). So the first question about any quote is not “is this expensive?” but “how much human time, if any, is in it?”

The six jobs a maintenance quote is really pricing

Apexure’s September 2026 maintenance guide makes a useful cut: maintenance is six jobs — hosting and renewals, updates, security and backups, fixes, content changes, and tracking checks — and, in their assessment, most quotes cover only four of the six. That framing explains most bad surprises: a plan can honestly include “updates and backups” while excluding fixes and content changes — the jobs a business actually notices.

Hold that list against any quote you receive: for each job, the quote should say whether it is included, excluded, or available at a stated extra rate. AI Dev Expert’s published maintenance scope covers the same ground — updates, backups, security checks, speed work, content edits, form testing, bug fixes, and support — which is the level of specificity to demand from anyone, including us.

What a complete quote includes, line by line

Updates — applied and tested

“Updates included” should name what gets updated (WordPress core, plugins and theme; Shopify apps and theme; or framework dependencies on a custom site) and how. The meaningful upgrade is testing: FatLab’s professional tier ($75–$150/month) is defined by updates tested on staging, off-site backups, and malware cleanup included. Untested automatic updates are how a routine patch quietly breaks a contact form — and nobody notices until a customer mentions it.

Backups you can restore, not just backups that exist

A serious quote states backup frequency, where backups are stored (off-site, not only on the same server), how long they are kept, and whether restoring one is included. A backup that has never been test-restored is a hope, not a recovery plan.

Security monitoring — and who pays for cleanup

Monitoring and cleanup are different products. Many cheap plans include the first and bill the second per event. PageSimple’s 2026 comparison, drawing on FatLab’s published extras, puts malware cleanup at +$200–$500 or more per event and emergency support at +$150–$300 or more per incident on plans that exclude them. One bad month on a $50 plan can reach $400–$850. Your quote should state the cleanup price before you need it.

Monitoring and a written monthly report

Uptime monitoring is cheap and common. The underrated line item is a monthly written report: what was updated, what was checked, what was found, what is recommended next. Without it, you cannot verify that any work happened — you are paying for a claim.

Included human hours, the overage rate, and rollover

If a plan includes support or developer hours, the quote should state the number, what counts against them, whether unused hours roll over or expire, and the rate for work beyond them. For scale: WebFX and FatLab both bill additional developer time at $150 an hour (per PageSimple’s summary). A quote with “support” but no hour count and no overage rate is unfinished.

Conversion-path checks

After significant updates, someone should test the paths that make you money: contact forms, checkout, booking flows, key calls to action. This check separates care plans from update plans: it is a named feature of mid-tier scopes (including the Business Care level on our service page) and is usually absent from budget tiers.

Support terms in writing

First-response time, support hours, and what counts as an “emergency” (and what emergencies cost) belong in the quote, not in a sales call. FatLab’s tiers show the pattern: response time tightens from email-only at budget level to 2–4 hours at business tier and 1–2 hours at enterprise.

The Maintenance Quote Audit Worksheet

For each row: 0 = not mentioned; 1 = mentioned but vague; 2 = specified in writing, with a quantity, frequency, or commitment.

#	Line item	What a “2” looks like
1	Software updates	Core, plugins/theme (or dependencies) named, with an update schedule
2	Update testing	Updates tested on staging, or the live site checked immediately after
3	Backups	Frequency and off-site storage location stated
4	Restore	Retention period stated; restores included and periodically tested
5	Security monitoring	Scans/monitoring named, plus what happens when an alert fires
6	Malware cleanup	Included — or a fixed per-event price stated in the quote
7	Uptime monitoring	Named, with who receives alerts
8	Conversion-path checks	Forms, checkout, or booking flows tested after updates
9	Included human hours	A specific number of support/development hours per month
10	Overage rate	Hourly rate for work beyond the included hours, in writing
11	Rollover	States whether unused hours roll over or expire
12	Written report	Monthly summary of work done, issues found, and next actions
13	Response time	First-response time in writing, plus emergency terms
14	Contract & exclusions	Term, cancellation terms, and what is billed separately (hosting, licenses)

Reading your score (out of 28):

• 23–28 — The quote is genuinely itemized. Compare price against the model below.
• 15–22 — Workable. Get every 0-row answered in writing before signing; those rows are where surprise invoices live.
• 0–14 — You are buying a label, not a scope. Ask for the missing items or walk away.
• Automatic hold: if row 6 (cleanup), row 10 (overage rate), or row 13 (response time) scores 0, do not sign until it is answered. Those three decide what a bad month costs.

An illustrative annual cost model: WordPress vs Shopify vs custom Next.js

Ranges from guides tell you what the market charges. A model tells you what the work consists of, so you can see which line a quote has deleted or padded. The line items below follow the inclusion structure published on AI Dev Expert’s website maintenance page — a page that defines its plans by scope and deliberately publishes no single price, because the right scope depends on your platform and how business-critical the site is.

Stated assumptions (replace them with your own figures):

• Blended labor at $75/hour for routine maintenance work. This is an assumption, not a market average — published overage rates run higher ($150/hour at WebFX and FatLab), so substitute your quote’s rate and the labor lines scale directly.
• Third-party fees are assumptions in realistic published ranges, not quotes. Replace them with your actual bills.
• Excluded: redesigns, new features or pages, SEO campaigns, content writing, and advertising.

WordPress — 12-page brochure site, contact form, ~15 plugins

Line item	Assumption	Per year
Managed WordPress hosting	$30/month	$360
Premium plugin & theme licenses	$15/month	$180
Updates, with post-update checks	1 hr/month	$900
Monthly health checks (forms, links, backup check)	0.5 hr/month	$450
Small content edits	0.5 hr/month	$450
Incident reserve	One 2-hour fix per year	$150
Total		$2,490/year (≈ $208/month)

Shopify — small store, ~30 products, 8 apps, lightly customized theme

Line item	Assumption	Per year
Shopify subscription (Basic, monthly billing)	$39/month, paid to Shopify	$468
Paid apps	$60/month	$720
App & theme update review	0.5 hr/month	$450
Checkout & key-flow testing after changes	0.5 hr/month	$450
Small tweaks and fixes	1 hr/month	$900
Annual theme version update	4 hours, once a year	$300
Incident reserve	One 2-hour fix per year	$150
Total		$3,438/year (≈ $287/month)

Note what is missing from the Shopify table: hosting and security patching. Shopify’s subscription covers platform hosting, core updates, and security (AgencyPartner Interactive’s platform breakdown makes the same point), so maintenance labor shifts to apps, theme compatibility, and checkout testing. Published Shopify retainers reflect that: The ShopNinjas charges $259–$509 a month (billed annually); AgencyPartner puts most stores at $200–$1,000 a month.

Custom Next.js — 15-page marketing site, headless CMS, moderate traffic

Line item	Assumption	Per year
Cloud hosting (e.g., Vercel Pro, 1 seat)	$20/month	$240
Headless CMS plan (1 seat)	$15/month	$180
Monitoring & error tracking	$15/month	$180
Dependency & security updates	1.5 hrs/month	$1,350
Content support	0.5 hr/month	$450
Framework upgrade reserve	6 hours per year	$450
Incident reserve	One 2-hour fix per year	$150
Total		$3,000/year ($250/month)

A custom site has no plugins to patch; its risk concentrates in dependencies, which is why the labor line leans toward update work. A detailed practitioner breakdown of a Next.js + Sanity site (prices as of October 2026) lands in the same territory: roughly $0–$65 a month in platform seats and monitoring, $100–$300 a month of developer time for dependency and security updates, plus an annual major upgrade spread across the year.

How to use the model: if a real quote lands far below the model for your platform, find which line was removed — it is usually testing, cleanup, or the hours. If it lands far above, find which line is inflated — usually an hour count you will never use. Either way, you are arguing about scope — the argument worth having.

Included vs upsell: where quotes quietly grow

Normally included in a genuine plan (this is the inclusion list on our own service page, and it matches the market’s mid-tier pattern): CMS/platform and plugin updates, backups, security checks, small content edits, bug fixes, form testing, and technical support.

Commonly extra — legitimate, if priced in advance: malware cleanup per event ($200–$500+, per FatLab’s published extras), emergency support per incident ($150–$300+), developer hours beyond the included block ($150/hour at WebFX and FatLab), hosting and premium plugin/app licenses billed separately, and staging-based workflows at higher tiers.

Padding, not upsells: “SEO included” with no named deliverable; social media posting bundled into a technical plan; “optimization” with no baseline or report; and hour blocks sized for a store when your site is a brochure. The test: an honest upsell has a unit price and a trigger (“cleanup, if needed: $X per event”); padding has adjectives.

Red flags in a maintenance quote

• A single lump sum with no line items at all
• “Unlimited” updates, support, or revisions
• Response time given verbally but absent from the document
• Malware cleanup excluded and unpriced — you learn the cost during the incident
• No monthly report, so the work is unverifiable
• A long auto-renewing term with no cancellation route
• Updates “included” with no mention of testing
• A price far outside your platform’s model range with no scope explanation

Questions to send back before you sign

1. Which of the six jobs — hosting/renewals, updates, security and backups, fixes, content changes, tracking checks — are excluded?
2. Are updates tested before or immediately after they reach the live site?
3. If my site is hacked next month, exactly what do I pay, and how fast do you start?
4. How many human hours are included, what counts against them, and do they roll over?
5. What is the hourly rate when I exceed them?
6. What will your monthly report show me?

A provider who answers these in writing has probably written a real quote. Evasions are answers too.

FAQs

Is hosting included in website maintenance?
Sometimes — and the quote must say which. Some providers bundle hosting; others pass it through or leave it with you. Also ask whether backup storage and SSL renewal are extras (PageSimple’s comparison flags both). Bundled hosting is not automatically better: holding your own hosting account means you keep control of the site if you ever change providers.

How many support hours does a small site actually need?
For a mostly static brochure site, possibly none — FatLab’s budget tier includes zero developer hours and suits low-stakes sites. For an active lead-generation or ecommerce site, FatLab’s business tier (2–4 hours a month) and the models above (2 hours a month) are reasonable planning figures. Buy hours against your actual change frequency, not against a tier name.

My site is on Shopify. Do I still need maintenance?
Yes, but a different kind. Shopify handles hosting, platform security, and core updates inside your subscription. What remains yours: app and theme updates, compatibility when Shopify changes its platform, checkout testing after changes, and fixes to any custom code.

Can I just maintain my site myself?
You can, and for a simple site the automated tier (hosting tools, scheduled updates, backups) may be enough. Price it honestly: the labor lines in the model above are the hours you would spend, plus the two disciplines DIY setups skip most often — testing updates, and verifying a backup can actually be restored.

The short version

A maintenance quote is a scope document, not a price tag. Score it with the worksheet, compare it with the model for your platform, and make the provider put cleanup, hours, overage, and response time in writing. If you would rather have that review done for you, AI Dev Expert’s maintenance plans are published as inclusion lists — Essential, Business, and Advanced Care — so the scope can be checked before any price is discussed. Send us your site URL and platform through the website maintenance page or request a custom quote, and we will tell you which scope your site actually needs — including if it is less than you were quoted. Related: our performance optimization service, our guide to speeding up a small-business website, and our website security service.

— AI Dev Expert. Market figures come from the third-party sources cited inline (AgencyPartner Interactive; WebFX and FatLab as summarized by PageSimple; Apexure; The ShopNinjas; a Next.js practitioner breakdown on dev.to), checked November 2026. The cost model is illustrative, with assumptions stated so you can substitute your own. Researched and drafted with AI assistance; reviewed against those sources.