Website Maintenance for Small Businesses: What It Includes and What It Costs

A website is not finished on launch day. The software underneath it keeps changing, certificates expire, payment cards on file expire, and your opening hours change. None of this is hard, but someone has to do it. This guide explains what the jobs are, which ones matter most, and what it costs to do them yourself or hand them off.

What is website maintenance?

It is the regular work that keeps a live website safe, working and accurate. Think of it like servicing a van: a few small jobs on a schedule prevent the expensive breakdown.

Maintenance falls into four groups:

• Security: updating the site’s software, keeping the padlock (SSL certificate) valid, and using strong passwords.
• Backups: keeping copies of the site so you can restore it if something goes wrong.
• Checks: making sure forms send, pages load quickly, and links work.
• Content: keeping hours, prices, staff, photos and contact details correct.

How much of this you do yourself depends on how your site is built. If you are not sure what “hosting” covers, domain vs hosting explained is a quick primer.

Does my kind of website need maintenance?

Every site needs some. On Wix, Squarespace or a similar builder, the platform handles the software and security, so your part is mostly content and renewals. On a self-hosted WordPress site you are responsible for everything, and updates are the job you cannot skip.

A builder costs more per month partly because it does the first three rows for you. The website cost guide compares the totals over three years.

Why are updates such a big deal?

Because attackers move fast. Security firm Patchstack counted 11,334 new security flaws in WordPress add-ons and themes during 2025, and found that about half of the high-impact ones were being attacked within 24 hours of becoming public. An add-on you have not updated in months is an open door.

The numbers from Patchstack’s 2026 report are worth knowing because they show where the risk actually is. 91% of the new flaws were in plugins, 9% in themes, and only 6 in WordPress itself, all of them low priority. So the core software is rarely the problem. The add-ons are.

The same report found that 46% of flaws had no fix from the developer by the time they became public. Updating cannot help when no update exists, which is why fewer plugins is safer. Every plugin you delete is one less thing to patch.

There is one more update coming up for WordPress sites. The programming language WordPress runs on is called PHP, and PHP 8.2 stops getting security fixes on December 31, 2026. If your host’s control panel shows 8.2 or older, ask them to move you to 8.3 or newer, after taking a backup.

What does website maintenance include, and how often?

Backups run daily on their own. Updates and a quick look at the site happen weekly or monthly. Renewals, a full content review and a test restore happen once or twice a year.

Google Search Console is free and shows you problems Google has found on your site, including a security issue such as hacked pages. If you have not set it up yet, this guide walks you through it.

How should I back up my website?

Use automatic daily backups, and keep at least one copy somewhere other than your web host. A backup stored only on the same server as your site disappears with it if the account is hacked or closed.

The US Cybersecurity and Infrastructure Security Agency recommends the 3-2-1 rule for business data: three copies, on two different types of storage, with one kept off-site. For a website, that can be as simple as the live site, your host’s nightly backup, and a backup plugin that sends a copy to cloud storage you control.

A backup you have never restored is a guess. Once a year, ask your host or developer to restore a copy to a test address, or do it yourself, and check the pages load.

Why does my SSL certificate need attention now?

Certificates now expire faster than they used to, so they have to renew automatically. The industry body that sets the rules agreed in 2025 to cut the maximum lifetime from 398 days to 47 days in steps between March 2026 and March 2029.

The SSL certificate is what puts the padlock in the browser and lets your site load over https. When it expires, visitors see a full-page warning saying the site is not secure, and most leave. The CA/Browser Forum vote means a certificate bought by hand once a year is no longer practical. Most hosts and all major builders renew certificates automatically. Ask your host to confirm yours does, and put a reminder in your calendar to glance at the padlock once a month.

How much does website maintenance cost?

Doing it yourself costs about $100 to $500 a year for the domain, hosting and a backup tool, plus your time. Freelancers and agencies commonly charge $50 to $200 a month for a care plan. On a website builder, most maintenance is already inside the subscription.

Prices for care plans vary widely, and the name on the plan tells you little. Two plans at the same price can include very different work. Before you sign up for one, ask:

1. How often do you install updates, and do you test the site afterwards?
2. Where are backups stored, how long are they kept, and have you ever restored one?
3. If my site is hacked, is the cleanup included or extra?
4. How many small content changes a month are included, and how fast are they done?
5. Do I keep ownership of the domain, hosting account and all logins if I cancel?

The last question matters most. Your domain should be registered in your name, with your login, whoever looks after the site.

Can I do website maintenance myself?

Yes, if your site is small and you can set aside half an hour a month. Turn on automatic updates and automatic backups first, then follow a short monthly checklist. The automation does most of the work.

Here is a 30-minute monthly routine for a five-page business site:

1. Log in and install any waiting updates. Delete plugins and themes you do not use.
2. Check that last night’s backup exists.
3. Fill in your own contact form and confirm the message arrives.
4. Open the home page and contact page on your phone. Tap the phone number and the map link.
5. Look at Google Search Console for new warnings.
6. Read your hours, prices and staff list. Fix anything that changed.

If that list feels like a chore you will skip, hand it off. A site that was last updated two years ago is a bigger risk than paying someone. Sites we build come with hosting and care after launch, and an optional plan lets you text us changes instead of logging in. Here is how that works.

Frequently Asked Questions

What happens if I never maintain my website?

On a builder like Wix or Squarespace, the platform keeps the software patched, so the main risk is outdated information and broken links. On a self-hosted WordPress site, skipped updates leave known security holes open. Hacked sites can be used to send spam or redirect visitors, and Google may show a warning to people who try to visit.

How many hours a month does website maintenance take?

For a five-page small business site, about 30 minutes to an hour a month once everything is set up, plus a longer check once or twice a year. Sites with an online shop, bookings or many plugins take more.

Should I turn on automatic updates in WordPress?

For most small sites, yes, as long as you also have daily automatic backups you know how to restore. Automatic updates close security holes quickly. Once in a while an update breaks something, and the backup lets you roll back in minutes.

Is website maintenance the same as SEO?

No. Maintenance keeps the site working, secure and accurate. SEO is work aimed at ranking higher in search results, such as writing new pages. Maintenance does support SEO, because Google is less likely to show slow, broken or hacked pages, but a maintenance plan alone will not move your rankings much.

Sources