Quick answer
UK website maintenance in 2026 costs from £20/year for managed domain and hosting to £20 to £90/month for a care plan (software updates, backups, security and small changes), and £100 to £150+/month for retainers that include development time and SEO. The right tier depends on how much your website earns — not how big it is.
Why “finished” websites still cost money
A website is software running on a server, and both halves age. WordPress core, themes and plugins ship security releases constantly; PHP versions are retired; SSL certificates renew; backups need testing before you need them. Neglect none of this and nothing visibly happens for months — then a plugin conflict takes the checkout down on a Friday night, or Google quietly starts serving a “not secure” warning where your homepage used to be.
The real cost of zero maintenance is not the emergency fix (£50 to £150/hour at short notice). It is the slow leak beforehand: a hacked site serving spam links tanks the rankings you spent months earning; a 12-second load time halves your enquiries without ever throwing an error. Maintenance is cheap because it is insurance priced before the accident.
The three tiers, honestly compared
| Tier | Typical UK cost | Covers | Right for |
|---|---|---|---|
| Managed domain & hosting | from £20/yr | Fast UK hosting, SSL, daily backups, uptime monitoring | Brochure sites that rarely change |
| Care plan | £20 to £90/mo | Everything above + core/plugin updates, security hardening, malware scanning, small content changes | Any site that generates enquiries or sales |
| Growth retainer | £100 to £150+/mo | Care plan + development hours, speed work, SEO and reporting | Sites that are a primary revenue channel |
Questions that expose a bad care plan
- “When did you last test a restore?” Backups that have never been restored are hopes, not backups.
- “What’s included before hourly billing starts?” A plan that bills every 10-minute text change is hosting in a trench coat.
- “Do you monitor uptime and who gets woken up?” If the answer is “you do, when customers phone”, keep shopping.
- “What happens if the site is hacked?” Cleanup included or £300 emergency invoice; get it in writing first.
What we include at £20/month
Our website management & hosting starts at £20/month: UK NVMe hosting, free SSL, daily off-site backups, all core and plugin updates, security monitoring, and small content changes handled for you. Because we also build websites, problems get fixed by people who understand the code, not ticket-shufflers reading the same knowledge base you can.
When maintenance is the wrong answer
- The site is over ~5 years old and underperforming. Maintaining a slow, dated site is polishing a depreciating asset; a redesign or rebuild decision pays back faster.
- You’re paying £100+/mo but nothing improves. Retainers should show a change log and a metric. If three months of invoices produce neither, downgrade to a care plan and put the difference into speed optimisation or content.
- Traffic died suddenly. That is a diagnosis job first (a proper SEO audit), not a standing order.
The honest rule: match the tier to what the website earns. A site producing £2,000/month of work deserves a £50 care plan without hesitation; a static brochure site does not need a retainer, however persuasive the sales call.
The monthly checklist to hold any provider to
“Maintenance” is only worth paying for if specific things actually happen. This is the checklist we work to. Use it to audit whatever you currently pay for:
| Task | Frequency | Why it matters |
|---|---|---|
| Core, theme and plugin updates | Weekly | Most WordPress compromises exploit patched-but-not-applied vulnerabilities |
| Off-site backup + restore test | Daily backup, monthly restore test | An untested backup is a hope, not a plan |
| Uptime and SSL monitoring | Continuous | You should hear about downtime from your provider, not a customer |
| Malware scan | Weekly | Hacked sites lose rankings fast and quietly |
| Speed spot-check | Monthly | Plugin bloat degrades gradually; nobody notices until enquiries dip |
| Broken-link and form test | Monthly | A silently broken contact form is lost revenue with no error message |
If your provider can’t show evidence of these (a change log, a restore date, an uptime report), you’re paying for hosting with a maintenance label on it.
WordPress-specific realities in 2026
Two changes make maintenance more important than it was five years ago. First, PHP versions retire faster: sites parked on old PHP eventually hit a forced upgrade, and an unmaintained theme or plugin that breaks on modern PHP takes the site down with it. Planned upgrades cost an hour; forced ones cost a weekend. Second, form spam and card-testing bots industrialised: an unwatched contact form or checkout gets probed constantly, which is a security exposure and a data-quality mess. Managed sites absorb both quietly; unmanaged ones meet them as emergencies.
The good news: none of this argues for expensive retainers. It argues for the right tier, which for most small-business sites is a modest care plan, not a growth contract. Match the spend to what the site earns, review annually, and put savings into things that grow revenue, like a marketing budget with a plan behind it.
Worked example: what neglect actually costs
A real pattern we see repeatedly, anonymised: a trades business launches a £500 website, pays nothing for upkeep, and everything is fine for fourteen months. Then a payment-form plugin ships a security release nobody applies; six weeks later the site is quietly serving spam pharmaceutical links to Google while looking normal to the owner. Rankings that took a year to earn drop over three weeks — the owner notices only when the phone goes quiet. Recovery: £250 of emergency cleanup, a Google reconsideration cycle, and four to six months to claw back positions that a £25/month care plan would have protected. The maintenance decision was never really £0 versus £300 a year; it was £300 a year versus a five-figure revenue dip and half a year of recovery.
The reverse example is just as instructive: sites on a proper care plan sail through PHP upgrades, plugin conflicts and WordPress majors as non-events. The owner hears about them, if at all, in a monthly summary line. Boring is the product. Spreading the build cost rather than paying upfront is what the £79 a month website subscription is for.
Questions owners actually ask
“My nephew can update plugins, isn’t that enough?” Updates are the easy 80%. The hard 20% is what happens when an update breaks the checkout at 9pm: diagnosis, rollback, and knowing which of 30 plugins conflicted. You are not paying for clicking “update”; you are paying for the recovery path.
“Do I need maintenance on a brand-new site?” Yes, immediately. New sites run the same update treadmill from day one, and the launch month is when misconfigurations surface. Most builders (ourselves included) bundle the first period; check what happens after it ends rather than discovering the answer by outage.
“What about e-commerce?” Everything here, doubled. A broken brochure site loses enquiries; a broken checkout loses orders per hour and risks card-data incidents. WooCommerce stores should sit at the care-plan tier as a floor, with staging-site testing before major updates, which is exactly how we run the stores we build.
Get the UK Website Project Brief Template (free)
A two-page template for briefing any UK web designer: sitemap, integrations, audience and deliverables. Cuts revision rounds in half.
No spam. UK GDPR compliant. We only use your email to send this resource, unless you tick the box to hear from us.
Sources & Further Reading
- Small Business Guide: Cyber Security, National Cyber Security Centre
- Cyber Security Breaches Survey, GOV.UK / DSIT
- WordPress security release process, WordPress.org
Frequently asked questions
How much does website maintenance cost in the UK? +
In 2026: managed domain and hosting from £20/year, care plans (updates, backups, security, small changes) £20 to £90/month, and growth retainers with development and SEO time £100 to £150+/month.
What does a website care plan include? +
A good plan covers hosting, SSL, daily tested backups, WordPress core/theme/plugin updates, security monitoring and malware response, uptime monitoring, and a monthly allowance of small content changes.
Can I maintain my website myself? +
You can apply updates and run backups yourself if you are comfortable troubleshooting when an update breaks something. The risk is not the routine weeks; it is the Friday-night conflict that takes the site down when no one is on hand.
Is website maintenance worth it for a small brochure site? +
A brochure site that rarely changes usually only needs managed hosting with SSL, backups and updates, from around £20/year. Move to a monthly care plan once the site generates enquiries you would miss.
What happens if I don't maintain my website? +
Typically nothing for months, then a security compromise, plugin conflict or expired certificate. Hacked sites lose rankings quickly and emergency cleanup costs more than years of maintenance.
