How Much Does Website & App Maintenance Cost in 2026 — Complete Guide
You buy or build a website. Then you leave it. Six months later, PHP is two major versions behind, a plugin has been removed from the repository, and the SSL certificate has expired. Maintenance is not an optional cost — it's the difference between a site that works and one that costs you customers. This article breaks down the four real price tiers, what each includes, and what happens if you pay nothing.
TL;DR — four maintenance price tiers
| Tier | Monthly cost (EUR) | What it covers | Best for |
|---|---|---|---|
| Basic monitoring | €30 – €80/month | Hosting, SSL, automated backup | Static brochure site, no frequent updates |
| Standard maintenance | €100 – €350/month | CMS/plugin updates, uptime monitoring, security patches, tested backup | Brochure site with blog, small online store, low-traffic app |
| Active maintenance + SLA | €400 – €1,200/month | Framework and dependency updates, performance monitoring, bug fixes, support with guaranteed response time | Mid-size online store, SaaS, app with payment or tax integrations |
| Enterprise / 24-7 maintenance | €1,500 – €5,000+/month | Dedicated team, full-stack monitoring, on-call response under 1 hour, security audits, continuous optimization | High-traffic platforms, fintech, high-volume e-commerce |
The figures above are local market rates, delivered from Romania. If you're talking to an agency in Western Europe, multiply by 2-3x. If someone promises «free lifetime maintenance» after construction — read below why that's a trap.
What maintenance actually includes — broken down by component
The word «maintenance» covers eight distinct things. If a provider gives you a price without detailing them, you don't know what you're buying.
1. Hosting and infrastructure
The server your site runs on. Cost: €5-€30/month for decent shared hosting (Hostinger, SiteGround), €40-€200/month for managed VPS (Hetzner, DigitalOcean), €200-€1,000+/month for clustering or dedicated. Maintenance includes correct resource allocation, control panel license renewals (cPanel, Plesk), and scaling when traffic grows.
2. CMS, framework, and plugin updates
WordPress releases 4-6 major versions per year. Premium plugins (WPML, WP Rocket, Elementor Pro) push updates weekly. Next.js — every two weeks. Laravel — a major version annually. Each update can fix a vulnerability or break existing functionality. Maintenance means: you test in a staging environment, apply, verify nothing broke.
Without this, in 6 months you have abandoned plugins, version incompatibilities, and a site that can no longer be updated without a partial rewrite.
3. Security patching
Vulnerabilities don't wait for your update schedule. Critical CVEs (Remote Code Execution, SQL Injection) require patching within 24-72 hours of disclosure. Active maintenance includes automated scans (WPScan, npm audit, Dependabot) and manual patch application when code changes are needed — not just clicking «update».
4. Automated and tested backup
A backup you've never restored is a hypothesis, not a backup. Maintenance includes: daily incremental + weekly full backup, off-site storage (S3, Backblaze — not on the same server), and — critically — a test restore once a month to verify the backup actually works.
We've seen clients with corrupted backups discovered only when they needed them. The test restore prevents that.
5. Uptime and performance monitoring
Tools: UptimeRobot (free, checks every 5 min), Better Stack (€20/month, every 1 min), Pingdom (€15/month). For applications: Sentry for errors, PostHog for front-end performance, Grafana + Prometheus for server metrics. Maintenance includes configuring alerts and reacting when something goes down — not just installing the tool.
6. SSL and domain management
Expired SSL certificate = site marked as «not secure» in Chrome = customers leaving. Let's Encrypt auto-renews (if configured correctly), but EV/OV certificates or paid CAs require manual renewal annually or biennially. Domains renew annually — forget and it drops.
7. Bug fixes and minor improvements
A visitor reports the contact form doesn't work on Safari. A button shifts after an iOS update. Google changes the Core Web Vitals algorithm and your INP turns yellow. Active maintenance includes hours allocated for fixes like these — without opening a separate ticket for each one.
8. Technical support and SLA
SLA = Service Level Agreement. It defines: how fast you respond to a support email (4 hours? 24 hours?), how fast you fix a critical issue (site down — 1 hour? 4 hours?), what communication channel you use (email, phone, Slack). Without a written SLA, «support» means «I respond when I can».
How to choose the right tier — three questions
What happens if the site goes down Friday at 8 PM?
If the answer is «wait until Monday» — tier 1 or 2 is enough. If the answer is «I lose customers / orders / credibility» — you need tier 3 or 4 with a written SLA.
How often does content change?
Static site untouched for months? Tier 1. Active blog, new products weekly, monthly promotions? Tier 2-3. Application with features evolving continuously? Tier 3-4.
What data do you store?
If the site only has contact forms — a weekly backup is enough. If you have a database with orders, customers, payment history — daily backup + tested restore are mandatory. Financial or health data? Tier 4 with periodic security audits.
Hidden costs you don't see in the offer
- Hosting migration — if the current provider becomes unbearable or expensive, migration costs €200-€800 one-time, plus inevitable downtime.
- Recovery after compromise — site hacked (malware, defacement)? Cleanup costs €500-€2,000 + fixing the vulnerability that allowed entry. Cheaper to prevent with active maintenance.
- Forced rewrites — plugin or framework abandoned with no more security updates? Replacement costs €1,000-€5,000 and takes 1-4 weeks. Active maintenance identifies the risk early.
- Audit certificate — some maintenance plans include automated security scans; others bill them separately at €150-€500/scan.
- Hours over retainer — the retainer covers X hours/month. Beyond that, you pay hourly (€50-€120/h). Clarify what's in the retainer before signing.
«Free lifetime maintenance» — why it's a trap
You hear this from freelancers or small agencies trying to win the construction project. Real translation: they update WordPress when you remind them, respond to emails in 3-5 days, and at the first serious incident they say «it's not covered by warranty».
Maintenance costs real money: hosting, monitoring tools, human time. Someone offering it «free» either under-dimensions it (and your site suffers), or will stop doing it after 6-12 months when the relationship cools. Ask for a separate maintenance contract with a clear price and written SLA — not a verbal promise included in the construction price.
WordPress vs custom app maintenance — real differences
| Aspect | WordPress | Custom app (Next.js, Laravel) |
|---|---|---|
| Update frequency | Weekly (plugins) | Monthly-quarterly (framework) |
| Incompatibility risk | High (plugin vs plugin) | Low (depends only on your code) |
| Security tools | Wordfence, WPScan | npm audit, Dependabot, Snyk |
| Typical maintenance cost | €50-€300/month | €200-€1,200/month |
| Main vulnerability | Abandoned plugins and themes | Unupdated npm/composer dependencies |
WordPress is cheaper to maintain day-to-day, but more fragile — a single unsupported plugin can compromise the entire site. Custom apps cost more to maintain, but the risk is controllable: you know exactly what code runs.
How to get a comparable maintenance quote
- Ask for the list of included components — hosting, updates, backup, monitoring, support, remediation hours. If the list is vague («everything is included»), it isn't.
- Ask for a written SLA — response time to critical incidents, resolution time, contact channel, included support hours.
- Ask who owns access — hosting, domain, source code must be in your accounts. Maintenance is done with delegated access, not hostages.
- Check what tools they use — a serious provider uses staging, CI/CD, automated monitoring. «I update directly on production» is a risk signal.
- Ask what happens if you leave — access transfer, documentation, handover. A provider who hesitates here is holding you hostage.