How Much Does Website & App Maintenance Cost in 2026? Complete Guide

You buy or build a website. Then you leave it. Six months later, PHP is two major versions behind, a plugin has been removed from the repository, and the SSL certificate has expired. Maintenance is not an optional cost. It's the difference between a site that works and one that costs you customers. This article breaks down the four real price tiers, what each includes, and what happens if you pay nothing.

TL;DR: four maintenance price tiers

The figures above are local market rates, delivered from Romania. If you're talking to an agency in Western Europe, multiply by 2-3x. If someone promises «free lifetime maintenance» after construction, read below why that's a trap.

What maintenance actually includes, component by component

The word «maintenance» covers eight distinct things. If a provider gives you a price without detailing them, you don't know what you're buying.

1. Hosting and infrastructure

The server your site runs on. Cost: €5-€30/month for decent shared hosting (Hostinger, SiteGround), €40-€200/month for managed VPS (Hetzner, DigitalOcean), €200-€1,000+/month for clustering or dedicated. Maintenance includes correct resource allocation, control panel license renewals (cPanel, Plesk), and scaling when traffic grows.

2. CMS, framework, and plugin updates

WordPress releases 4-6 major versions per year. Premium plugins (WPML, WP Rocket, Elementor Pro) push updates weekly. Next.js every two weeks. Laravel a major version annually. Each update can fix a vulnerability or break existing functionality. Maintenance means: you test in a staging environment, apply, verify nothing broke.

Without this, in 6 months you have abandoned plugins, version incompatibilities, and a site that can no longer be updated without a partial rewrite.

3. Security patching

Vulnerabilities don't wait for your update schedule. Critical CVEs (Remote Code Execution, SQL Injection) require patching within 24-72 hours of disclosure. Active maintenance includes automated scans (WPScan, npm audit, Dependabot) and manual patch application when code changes are needed, not just clicking «update».

4. Automated and tested backup

A backup you've never restored is a hypothesis, not a backup. Maintenance includes: daily incremental + weekly full backup, off-site storage (S3, Backblaze, not on the same server), and, critically, a test restore once a month to verify the backup actually works.

We've seen clients with corrupted backups discovered only when they needed them. The test restore prevents that.

5. Uptime and performance monitoring

Tools: UptimeRobot (free, checks every 5 min), Better Stack (€20/month, every 1 min), Pingdom (€15/month). For applications: Sentry for errors, PostHog for front-end performance, Grafana + Prometheus for server metrics. Maintenance includes configuring alerts and reacting when something goes down, not just installing the tool.

6. SSL and domain management

Expired SSL certificate = site marked as «not secure» in Chrome = customers leaving. Let's Encrypt auto-renews (if configured correctly), but EV/OV certificates or paid CAs require manual renewal annually or biennially. Domains renew annually: forget and it drops.

7. Bug fixes and minor improvements

A visitor reports the contact form doesn't work on Safari. A button shifts after an iOS update. Google changes the Core Web Vitals algorithm and your INP turns yellow. Active maintenance includes hours allocated for fixes like these, without opening a separate ticket for each one.

8. Technical support and SLA

SLA = Service Level Agreement. It defines: how fast you respond to a support email (4 hours? 24 hours?), how fast you fix a critical issue (site down: 1 hour? 4 hours?), what communication channel you use (email, phone, Slack). Without a written SLA, «support» means «I respond when I can».

How to choose the right tier: three questions

What happens if the site goes down Friday at 8 PM?

If the answer is «wait until Monday», tier 1 or 2 is enough. If the answer is «I lose customers / orders / credibility», you need tier 3 or 4 with a written SLA.

How often does content change?

Static site untouched for months? Tier 1. Active blog, new products weekly, monthly promotions? Tier 2-3. Application with features evolving continuously? Tier 3-4.

What data do you store?

If the site only has contact forms, a weekly backup is enough. If you have a database with orders, customers, payment history, daily backup + tested restore are mandatory. Financial or health data? Tier 4 with periodic security audits.

Hidden costs you don't see in the offer

• Hosting migration: if the current provider becomes unbearable or expensive, migration costs €200-€800 one-time, plus inevitable downtime.
• Recovery after compromise: site hacked (malware, defacement)? Cleanup costs €500-€2,000 + fixing the vulnerability that allowed entry. Cheaper to prevent with active maintenance.
• Forced rewrites: plugin or framework abandoned with no more security updates? Replacement costs €1,000-€5,000 and takes 1-4 weeks. Active maintenance identifies the risk early.
• Audit certificate: some maintenance plans include automated security scans; others bill them separately at €150-€500/scan.
• Hours over retainer: the retainer covers X hours/month. Beyond that, you pay hourly (€50-€120/h). Clarify what's in the retainer before signing.

Why «free lifetime maintenance» is a trap

You hear this from freelancers or small agencies trying to win the construction project. Real translation: they update WordPress when you remind them, respond to emails in 3-5 days, and at the first serious incident they say «it's not covered by warranty».

Maintenance costs real money: hosting, monitoring tools, human time. Someone offering it «free» either under-dimensions it (and your site suffers), or will stop doing it after 6-12 months when the relationship cools. Ask for a separate maintenance contract with a clear price and written SLA, not a verbal promise included in the construction price.

WordPress vs custom app maintenance: real differences

WordPress is cheaper to maintain day-to-day, but more fragile: a single unsupported plugin can compromise the entire site. Custom apps cost more to maintain, but the risk is controllable: you know exactly what code runs.

How to get a comparable maintenance quote

1. Ask for the list of included components: hosting, updates, backup, monitoring, support, remediation hours. If the list is vague («everything is included»), it isn't.
2. Ask for a written SLA: response time to critical incidents, resolution time, contact channel, included support hours.
3. Ask who owns access: hosting, domain, source code must be in your accounts. Maintenance is done with delegated access, not hostages.
4. Check what tools they use: a serious provider uses staging, CI/CD, automated monitoring. «I update directly on production» is a risk signal.
5. Ask what happens if you leave: access transfer, documentation, handover. A provider who hesitates here is holding you hostage.

Frequently asked questions

How much does website maintenance cost?

On the market, €30–€80 per month for basic upkeep (hosting, SSL, backup) and €100–€350 per month for standard maintenance with updates, uptime monitoring and security patches. Our website care plan costs 300–800 RON per month, with backups, security updates and monitoring included.

What does web app or SaaS maintenance include?

Dependency and framework updates, security patches, uptime and performance monitoring, automated backup with tested restores, hosting management, bug fixes and technical support with a written SLA.

Monthly retainer vs. hourly: which is better?

A monthly retainer suits live sites and apps that need consistent updates and predictable support. Hourly billing (€50–€120/h) works for rare interventions but gets slower and more expensive when issues come up often.

What happens if you do no maintenance at all?

Within a few months you get unpatched security vulnerabilities, PHP/Node.js incompatibilities with hosting, abandoned plugins, expired SSL certificates and slower performance. WordPress sites without updates become common targets for defacement and malware.