BusinessHow much does it cost to maintain a website in 2026, line by line
A .es domain renews at €6.99 and email costs €6.80 a user: fixed costs are small. Hours are the bill. Three site profiles, priced line by line.
Website maintenance cost is the money a site needs after launch to stay online, secure, legal and current: the domain, the hosting, email, software updates, backups, compliance and the hours of whoever does the work. In 2026 the fixed part is small. For a small company it can stay under €80 a month. The part that decides the bill is the hours, and the hours depend on how the site was built.
This brief is for the person who pays for a website and wants to know what a fair yearly budget looks like: a founder, a shop owner, the marketing lead of a company that already has a site and a provider sending a monthly invoice. It lists what maintenance includes, what each line costs at public 2026 prices, how many hours three common kinds of site need, and what to ask before you sign a maintenance plan. The examples use Spanish prices and Spanish law; the lines of the budget are the same in any EU country.
What does maintaining a website include?
Seven lines cover almost every maintenance budget. Four are fixed and arrive whether or not anyone touches the site. Three are work.
- Domain. The yearly renewal of the address.
- Hosting. The server or platform that serves the pages.
- Email and certificate. Mailboxes on your domain and the HTTPS certificate.
- Paid software. Premium plugins and themes, a cookie consent tool, a form service.
- Updates and security. Keeping the CMS, the plugins, the server language and every library on a supported version.
- Backups and monitoring. Copies you can actually restore, and an alert when the site goes down.
- Compliance and small changes. Cookie consent, privacy texts, accessibility where the law asks for it, and the edits a business makes every month.
What do the fixed costs add up to in 2026?
The fixed lines are the easy part, because providers publish their prices. Every price below is before VAT.
- A .es domain costs €5.99 the first year and €6.99 a year to renew at OVHcloud.
- The HTTPS certificate costs nothing for most sites. Let's Encrypt is a free, automated certificate authority, and most hosts install its certificates for you. A yearly "SSL" line on the invoice for a standard site deserves a question.
- Email on Google Workspace Business Starter costs €6.80 per user per month in Spain, according to Google's price list. Three mailboxes come to about €245 a year.
- Hosting has the widest range. Shared hosting for a small WordPress site starts at a few euros a month. Managed platforms cost more and take work off your hands: Vercel's Pro plan, which we use for sites built on Next.js, costs $20 a month per developer seat and includes $20 of usage credit, with traffic above the credit billed on top.
- Paid plugins and tools are the line that grows without anyone deciding it. Each premium plugin is a yearly licence, and consent platforms price by pages and domains. Count them before you count anything else.
Add it up for a small company with a .es domain, three mailboxes, a modest host and a couple of licences, and the fixed part lands between roughly €30 and €80 a month. That figure is easy to check. The hours are harder to check, and in two of the three profiles below they are most of the bill.
Why are updates the expensive part?
A website is software, and software keeps moving after launch. The figures on WordPress show how fast.
Patchstack's report on the state of WordPress security counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 42% more than in 2024. 91% were in plugins and 9% in themes; WordPress core had six, all low priority. For the most heavily exploited flaws, the weighted median time to the first attack was five hours after disclosure.
Two things follow for the budget. The cost of updates follows the number of plugins: a ten-page site with 30 plugins needs more care than a hundred-page site with five. And a plan that applies updates once a quarter was written for a slower world. A site with logins, payments or forms needs a weekly rhythm and a check after each update, because an update can also break the layout or the checkout.
The server language moves too. On the official PHP supported versions page, PHP 8.1 lost security support on 31 December 2025 and PHP 8.2 loses it on 31 December 2026. A WordPress site still running 8.2 needs an upgrade before the end of this year, and an old theme or plugin that fails on PHP 8.3 turns that upgrade into a small project. It is maintenance work as well, and it tends to arrive as an unplanned quote.
Which legal costs belong in the maintenance budget?
Compliance is a running cost, because the rules and the tools on the site both change. We are not lawyers, and whether a rule applies to your business is a question for a legal advisor. What a buyer should know is where the obligations come from.
- Cookies and privacy. In Spain the reference is the AEPD's guide on the use of cookies. Every analytics or marketing tool added to the site changes what the consent banner has to declare, so the banner needs upkeep as the site changes.
- Accessibility. Ley 11/2023 transposes the European Accessibility Act into Spanish law. Its requirements apply from 28 June 2025 to services such as online shops. Microenterprises that provide services are exempt, and the law defines one as a company with fewer than 10 employees and an annual turnover or balance sheet of no more than €2 million.
An accessibility check after each major change takes a few hours. A finding fixed a year later takes longer, because the same fault has been copied into every page built since. We covered how that happens in six reasons products that are compliant on paper fail audits.
How much does maintenance cost for three kinds of site?
The ranges below are our working estimate, not a market average. Fixed costs come from the public prices above. The hours are what we would plan for each profile. To turn hours into money we use €50 an hour as an example rate; replace it with the rate your provider quotes, and the totals move with it.
A company site with a few pages
Five to fifteen pages, a contact form, content that changes a few times a year, built on a static stack or a lean WordPress install with few plugins. One to two hours a month covers updates, a backup check and an uptime alert. That is €50 to €100 of work plus €30 to €50 of fixed costs: roughly €80 to €150 a month, €1,000 to €1,800 a year.
A site with a blog, a CMS and 20 to 30 plugins
The usual small-business WordPress site: a page builder, an SEO plugin, forms, a cookie tool, a few premium licences. Weekly updates with a check after each, a monthly test restore of the backup, the PHP upgrade when it falls due, small content edits. Four to eight hours a month: €200 to €400 of work plus €40 to €80 of fixed costs, roughly €240 to €480 a month, €2,900 to €5,800 a year.
An online shop, or a site with logins and payments
Here a broken update costs sales. Every update goes to a staging copy first, monitoring watches the checkout as well as the home page, and the accessibility law applies unless the business is a microenterprise. Ten to twenty hours a month: €500 to €1,000 of work plus €60 to €150 of fixed costs, with payment fees outside this count. Roughly €560 to €1,150 a month, €6,700 to €13,800 a year.
Within each profile, one variable explains most of the spread: how much code and how many third-party pieces the site carries. Two sites that look the same to a visitor can sit at opposite ends of the same range.
What makes a website cheaper to maintain?
The maintenance bill is largely decided when the site is built. Four choices keep it low for years.
- Fewer dependencies. Every plugin, theme and library is a line on the update list. A feature written once in the site's own code, or dropped, is one less thing to patch every week.
- Pages served as files where possible. A page generated ahead of time and served from a CDN has no database for an attacker to reach and nothing to update between deploys. Sites built this way need fewer hours of security work.
- A staging copy and automated checks. An update tested on a copy costs minutes. An update tested by your customers can cost a weekend.
- Accounts in your name. Register the domain, the hosting and the analytics to the business, with the provider as a user. It costs nothing at launch and avoids a dispute if you ever change provider.
Speed is part of maintenance too. Plugins and scripts added over the years slow a site down, and Google measures the result in Core Web Vitals; our guide to keeping Core Web Vitals green covers the checks. The riskiest moment in a site's life is the relaunch, which is why we wrote about what to check when a site drops out of Google after a redesign.
What should a maintenance plan say before you sign it?
A monthly fee is easy to compare and hard to evaluate. Ask for these six answers in writing.
- How often are updates applied, and is each one tested before it goes live?
- Where are backups stored, how long are they kept, and when was a restore last tested?
- How fast does the provider act on a published vulnerability that affects the site?
- Which hours are included each month, and what happens to the ones you do not use?
- Who owns the domain, hosting and analytics accounts?
- What is excluded: new pages, PHP upgrades, design changes, legal texts?
The last answer matters most. A cheap plan that excludes the PHP upgrade, the accessibility fixes and every content edit is a monitoring subscription. For a site that rarely changes, that can be the right choice, as long as it is priced as one.
One more comparison is worth making once a year. Add up 24 months of maintenance, licences and the quotes for fixes that keep coming back, and set the total against the cost of rebuilding the site on fewer moving parts. When the rebuild comes out lower, it deserves a real quote. Our pricing guide for a new website covers the other side of that comparison.
Sources
Frequently asked questions
A monthly plan suits a site that needs the same work every month: weekly updates, backups, monitoring, a few edits. Paying by the hour suits a site that rarely changes and carries few plugins, where a fixed fee would pay for idle time. Both models share the same trap, which is the work that falls outside the agreed scope. Ask for the list of exclusions before you compare prices, and check whether unused hours roll over to the next month.
Yes, for a small site with few plugins, as long as someone applies updates every week, checks the site after each one and knows how to restore a backup. WordPress can apply core, plugin and theme updates automatically, but it does not check that your forms or your checkout still work afterwards. The step people skip is the restore: test it once, before the day you need it. A site that takes payments or stores customer data is usually worth a professional's hours.
Nothing visible for a while, which is why maintenance gets postponed. Then one of three things happens. The host moves to a newer PHP version and old plugins stop working, a known flaw in an outdated plugin gets exploited, or the domain lapses because the card on the renewal expired. Patchstack measured a weighted median of five hours between disclosure and first attack for the most exploited WordPress flaws in 2025, so a site left alone for a year carries every flaw published in that year.
It usually needs fewer security hours, because pages generated ahead of time expose no database and no plugins to visitors. It still has dependencies to update, a hosting bill that grows with traffic, and content edits that need a developer if the site has no CMS. The saving is real for a site that changes little and shrinks for a site where every edit goes through a developer. Compare total hours a year, not the hosting price.
Related services
Related articles
Business
BusinessConsumer cloud app developer: 10 checks before you sign
Ten checks before you hire a studio for a consumer cloud app: sync model, store billing while the US rate sits at zero, Texas age signals, cost per user.
Business