How much should website maintenance cost?
The useful question is what the plan covers rather than what it costs. Most low-cost maintenance plans cover software updates and backups only. Accessibility testing, privacy and consent management, data request handling and written evidence are usually outside scope, and those are the obligations that produce letters.
The longer version
Plans cluster into three kinds. A basic plan updates plugins, takes backups and monitors uptime. A fuller plan adds a content allowance and some monitoring. An operations plan takes on the compliance layer and produces evidence.
The cheapest plan is good value when the risk you are managing is an unpatched plugin. It is poor value when somebody sends you a security questionnaire, because it produces nothing you can send back.
Compare scope line by line rather than by monthly figure. The relevant questions are: what is tested, how often, what is produced in writing, what happens when something breaks at 6pm, and who does the work if the named person is unavailable.
What to do
- Write down what you actually need covered, including the obligations nobody currently owns.
- Ask any prospective provider what they produce in writing each month, and ask to see an example.
- Ask what is explicitly out of scope. The answer is more informative than the inclusions list.
- Check what happens on holidays and after hours, and whether more than one person knows your site.