What website maintenance really is
Website maintenance is the same as taking your car to the mechanic. A line I repeat in every discovery call: do you take your car in every year, or did you buy it eight years ago and never changed the oil? People laugh. Then they look away and admit their site hasn't been touched in two years.
A website is not a poster. It's software running inside a server connected to the internet 24 hours a day. The server is hit by automated attacks every single day. Third-party plugins release security patches every week. The SSL certificate expires. Your company email stops passing Gmail's filters because of an SPF change. Your Christmas menu has been live since February. This happens whether you pay for maintenance or not.
Maintaining a website is not magic and it's not optional. What is optional is doing it well in advance, or doing it badly in a panic after the first crash.
"Do you take your car to the mechanic, or did you buy it and never change the oil?"
In practice, a month of serious maintenance includes these tasks: reviewing and applying CMS and plugin security updates, testing them first in a staging copy, verifying that the last backup actually restores, reviewing the server error log, checking uptime monitoring, watching Core Web Vitals if Google changed something, and resolving whatever the client asks via WhatsApp within the plan's hours pool. If your agency doesn't do any of this, you're not paying for maintenance. You're paying to have your site hosted.
What it costs: honest market ranges in 2026
In Spain, web maintenance prices fall into four tiers. Each has its trap and its logic.
The €15 to €29 per month tier is the most sold and almost always the most suspect. For that money you're not paying anyone to look at your site. What you're buying is shared hosting, almost always the one that same agency was already paying with a discount. Nobody logs in. Nobody updates. Nobody warns you when the SSL expires. You find out yourself the day a client tells you Chrome says "Not secure" when they visit.
The honest professional tier runs from €30 to €100 a month for static sites or WordPress without too many plugins. Here someone is actually reviewing updates, doing verified backups, and answering when something breaks. It's the range most SMBs fit in.
From €100 to €300 per month you're in WooCommerce territory or sites with a large catalogue. More attack surface, payment gateway, more updates that can break things. Paying more makes sense because there's more real work.
Above €300 a month we're talking corporate maintenance: tight SLAs, 24/7 monitoring, dedicated teams. If your business doesn't move serious money online, that tier isn't for you.
The trick is to look at both extremes. If someone offers €15/month for a WordPress with WooCommerce, that's smoke. If they charge €250/month to maintain a static five-page corporate site, that's smoke too.
WordPress vs custom code: why one costs more to maintain
The price of maintenance doesn't depend so much on the provider as on what has to be maintained. An average WordPress install has 20 to 40 plugins. Each was written by someone who isn't you, in their spare time or in a company that might shut down one day. Each releases patches every week. Each can break the site when it updates.
The theme is on its own track. WordPress core too. If you happen to use WooCommerce, add another 80 hours of updates a year between extensions, payment methods, and translations. Honest maintenance of a WordPress with a shop doesn't go under €80-120 per month because there's €80-120 of work per month.
A custom-coded site doesn't have plugins. What's inside, you wrote or your dev wrote. There's no random Akismet that updates itself and leaves you a fatal error at two in the morning. There's no Envato theme that in version 4.3 changes the checkout HTML and breaks your SEO. What you maintain is server PHP updates, certificates, backups, and not much else.
That's why my three maintenance plans start at €16 a month for small custom sites. It's not magic or dumping. It's that custom sites have less to maintain. If I had to maintain WordPress with WooCommerce at that price I'd be losing money or not doing the work. The latter, by the way, is what many people do. I cover it more in the Wix vs custom website post.
What happens if you don't maintain it (three real stories)
This is not theory. Three situations I've seen in clients who came to me with their site blown up.
Case A: the WordPress full of Chinese casinos. A client called me because when he googled his company, the results showed his site next to descriptions in Chinese and Mandarin with links to online casinos and adult sites. What had happened is textbook: WordPress with a plugin not updated for two years, an automated bot found the hole, came in through a known vulnerability, and uploaded a PHP file to wp-content/uploads/. From there it injected SEO spam links into every page. Google indexed it. The site looked normal to a human visitor, but Google's bot was seeing another version full of garbage. Three months of normal maintenance would have stopped that. Cleaning it costs €400 to €800 in technical hours, depending on how deep it goes. Recovering SEO, three months minimum.
Case B: the plugin that updates itself on a Friday at 19:00. An SMB with WooCommerce. They had automatic updates turned on because someone told them it was the safe option. On a Friday at 19:00 a payment gateway plugin updated itself. The new version changed a function signature. Checkout broke. Nobody noticed until Monday at 9. Three days of no sales for a business that runs entirely online. Automatic updates without staging are Russian roulette. And that plugin had been installed two years earlier by a cousin's cousin. That month they paid €19 for maintenance to an "agency" that had never even looked at what plugins they had.
Case C: the backups that don't exist. Restaurant in Mallorca. The site went down on a Saturday at noon because of a hosting fault. They called maintenance. Relax, we'll restore the backup. When they tried to restore, the last full backup was eight months old. The "automatic hosting backups" that were supposedly running every night existed in the contracted plan but weren't actually executing due to a server incompatibility. Nobody had ever tested them. We had to rebuild eight months of menu, bookings, and reviews by hand. Scheduling a backup is trivial. Testing that it restores is what separates real maintenance from paper maintenance.
All three stories have the same thing in common: someone was charging for monthly maintenance and not doing the work.
How to spot the ones charging you for nothing
If you've been paying for monthly maintenance for more than six months and can't remember the last time someone did something concrete on your site, pay attention. Five signals you can audit yourself.
- No monthly report. Honest maintenance delivers a monthly summary of what got done. Updates applied, hours used, incidents, next steps. If all you get is the invoice, that's bad.
- No update log. Ask them to show you what updates were applied last month. Plugin X, version Y to Z, date. If they take two weeks to reply or give generic answers, there's no log because there are no updates.
- They've never tested a restore. Ask when they last restored your latest backup, even to a test server. If they never have, you don't know if your backup works.
- No direct human contact. If all you have is a generic support email or a ticket that takes 48 hours, that's not maintenance, that's a complaints desk. Ask for the WhatsApp number of the person in charge.
- Annual lock-in with no monthly option. Locking you in a year upfront with a discount is not bad on its own. But if they don't also offer a monthly option with 30-day notice, they're shielding themselves against you discovering they do nothing.
I've seen too many agencies charging €50/month to 40 clients for years without logging into WordPress once. €2,000 a month for keeping an Excel with the access details and, in the best case, a shared hosting account where all the sites live. It's a comfortable business. When something breaks, they tell you it's the client's problem because they didn't sign up for the higher plan.
What I charge and why (my three real plans)
No mystery here. The maintenance plans I offer are listed on the service page with exact price and scope. They are:
- Essential · €190/year (about €16/month). For small custom sites. Includes hosting, domain, verified daily backups, security updates tested in staging, 24/7 monitoring with alerts to my phone, and WhatsApp support during working hours.
- PRO · €390/year (about €33/month). Everything above, plus 2 hours per month for small changes (uploading text, a photo, tweaking a block), WhatsApp with 24-hour business response time, monthly report on what was done, and a quarterly Lighthouse audit.
- Elite · €990/year (about €83/month). PRO plus 4 hours per month and a 4-hour SLA including weekends. For sites that move money on a Sunday.
Why they're cheap compared to the market average: because my maintenance is for sites that I or someone with the same philosophy built. Custom-coded sites, no thirty third-party plugins, no inherited theme, none of WordPress's traps. There's less surface to maintain. I'm not using your monthly fee to offset the risk of some random plugin breaking your checkout on a Saturday.
If your site is WordPress with WooCommerce and many plugins, these plans don't apply. I'll tell you on the first call and recommend people who do WordPress and do it well. I don't sell maintenance I know I can't deliver.
How to choose maintenance without getting fluff
Four rules you can apply before signing anything, even if you don't hire me.
- The plan has to translate into concrete, checkable things. If you can't list what they deliver each month, there's no plan, there's an invoice.
- No hidden annual lock-in. Annual payment with a discount, fine. No option for monthly with 30-day notice, bad sign.
- Backups with tested restore. Ask in the first meeting that they show you how they restore a backup. If they've never done it outside theory, keep looking.
- Human on WhatsApp or the phone. Not a support email. A specific person with a name you can message on a Friday at 19:30 when your booking form breaks.
If your provider passes all four, you have serious maintenance even if it costs more than you expected. If they pass none, you're paying for nothing even if it's €15 a month.
Web maintenance isn't an expense, it's insurance. The cheap option is the €15-20 that sounds like nothing, but that's the premium of an insurance policy that covers nothing. When something happens, you find out you weren't covered.
Questions I get the most
Hosting and domain configured, verified daily backups with tested restore, CMS and plugin security updates tested first in staging, uptime monitoring with alerts to the technician, and human support for incidents and small changes. If your plan doesn't include at least that, it's not professional maintenance.
The honest market range for SMB sites runs from €30 to €100 a month. WordPress with WooCommerce climbs to €100-300/month due to the real update load. Corporate sites with 24/7 monitoring scale to €300-600/month. Below €30 is usually just hosting with no active work behind it.
No. An average WordPress has 20-40 third-party plugins plus core, theme, and sometimes WooCommerce. Each updates separately and can break things. A custom-coded site has no external plugins. That's why honest WordPress maintenance starts at €50-80/month and custom maintenance can start at €16/month. Less surface to maintain.
The typical scenario: an automated bot finds a known vulnerability in an outdated plugin, uploads a malicious PHP file, and uses your site to inject SEO spam links (online casinos, adult content, counterfeits). Your site keeps working normally to visitors, but Google sees another version full of garbage. Cleaning the infection costs €400-800 in technical hours. Recovering lost rankings takes three months minimum.
For a custom-coded site of 3 to 7 pages with no shop, €15-35/month is reasonable. For an equivalent WordPress, €40-70/month. Below those ranges you're almost always just paying for hosting. Above, they're loading you with a big plan your site doesn't need.
Ask for four things. Last month's report with hours used and actions. The log of updates applied to your site. A screenshot of the last tested backup restore. The name and WhatsApp of the technician handling your account. If those four are slow or don't come, there's no real work behind the fee.
With me, yes. My three plans are annual but with no hidden lock-in: with 30 days' notice you cancel and take your hosting, your domain, and your code with you. If your current provider doesn't offer that option, they prefer trapping you to keeping you by merit.
