Website Maintenance in 2026: What It Costs and What Must Be In It

An unmaintained website does not get slowly worse. It runs quietly for months and is then gone on a Tuesday morning, because a dependency carried a hole that had been publicly documented for months and an automated scanner found it. That is why the common question - "would we even notice?" - is the wrong one. Until the outage, you notice nothing. That is the whole point.

Why outages do not announce themselves

Security holes in frameworks, libraries and plugins are published once they are closed. That publication is necessary, but it has a side effect: from that moment, everyone also knows what to look for. What then sweeps across the web is not a targeted attack on your business, it is automated scanners working through addresses one by one, checking whether a known hole is still open. Your website is not selected. It is found.

So the risk does not depend on how well known you are, it depends on how long a known hole stays open. And it does not stop at security. Certificates expire. Runtime versions on the server reach end of support. Payment providers change their interfaces. Browsers retire behaviour a site relied on three years ago. A website nobody has touched for two years is not the same website it was: its surroundings moved, and it did not.

What a maintenance contract must contain to deserve the name

• Security and dependency updates, applied and then checked in a browser, not merely triggered automatically
• Backups held away from the production server, with a restore path that has genuinely been tested at least once
• Round-the-clock uptime monitoring whose alert reaches the provider, not you
• Certificate and domain renewals that happen before any reminder notice arrives
• A written response time for incidents, with a reachable human behind it
• A regular record of what was actually done in the period, even when that means 'nothing out of the ordinary'

The most important item on that list is the second one, and it is the one least often verified. A backup that has never been restored is not a backup, it is an assumption. If it also sits on the same server as the website, it fails to protect against precisely the scenario it exists for.

The empty maintenance contract

There is a form of contract that costs money every month and delivers nothing when it matters. It is rarely dishonest by intent - it is usually just written vaguely. The deliverable reads "care and support for your website", and nowhere does it say what that includes.

The most honest test is a single question to the provider: what happens if the site is unreachable on a Sunday morning? If the answer is "raise a ticket and we will come back to you on Monday", you are paying for text edits, not for maintenance. That can be perfectly fine - but then it should be called that.

What maintenance costs on the market

The published prices of German providers for business sites, mostly WordPress-based, fall into three recognisable bands in 2026. Treat them as orientation, not as a tariff.

Those ranges apply to sites with a conventional plugin stack. A site built without third-party modules has a far smaller maintenance surface and sits correspondingly lower. In our website subscription, hosting and maintenance are included from the start: 349 EUR net a month on a 12-month term, then 49 EUR net a month for hosting and maintenance. The website belongs to you from the day it goes live. How that compares with a one-off project fee is covered in what a website costs, and what technically travels along in a rebuild in website relaunch in 2026.

The uncomfortable part: not every website needs the same contract

A static site with no forms, no login and no plugin stack has an attack surface close to zero. A three-figure monthly maintenance fee is hard to justify there, and anyone selling one anyway is selling a feeling. Conversely, a WordPress installation with twenty extensions, a shop and customer accounts needs noticeably more than a monthly update run.

So the deciding question is not how big the website is. It is two other questions: how much third-party code runs inside it, and what does a week of downtime cost? A trades business whose phone rings anyway survives three days offline. A practice with online appointment booking does not. Maintenance should follow that calculation, not a package tier.

Technically, a serious maintenance scope covers more than updates. The numbers Google uses to measure user experience shift after every substantial change, as the article on Core Web Vitals sets out. And transport security is not finished once a certificate is valid, as HTTPS is not enough explains. What else belongs to running a site is summarised on our page on maintenance and security.

Concrete steps for the next 90 days

• Days 1-30: check your existing contract against the six points above and ask in writing when a backup was last restored as a test
• Days 1-30: establish where the backups sit. On the same server as the website, they do not count
• Days 31-60: ask the Sunday question and insist on a written answer, including a response time
• Days 31-60: set up uptime monitoring if none is running. A free one beats none
• Days 61-90: weigh the fee against the damage: a week unreachable, how many enquiries is that
• Days 61-90: decide whether you need a baseline package or real support, and adjust the contract accordingly

Conclusion

Maintenance is the easiest line to cut, because its success is invisible. That is exactly why it should be the line you read most carefully. A good maintenance contract is short and specific, and it names three things: what happens on a schedule, where the backups sit, and who responds how quickly when something breaks. Everything else is packaging.

Where your website runs and who owns the domain is the second half of the same question - we cover it in website hosting for businesses. And what a clean setup has to deliver on the privacy side is in our GDPR website check.