Website maintenance cost per month in 2026

People hiring a website usually ask how much it costs to build. Few ask how much it costs to maintain. The answer shows up months later, in a hosting bill, an expired plugin warning, or a site that woke up offline.

Maintaining a site isn't a luxury. It's what keeps it secure, fast, and working after the agency hands it over. In this guide I show, with numbers from public sources as of October 2026, what goes into a website's monthly maintenance cost, what changes the price, and what needs to be in the contract.

What you pay every month to keep a site live

The bill has two parts, like any digital product.

Fixed costs, which arrive as bills:

• hosting;
• domain, renewed every year;
• company email;
• paid plugins and themes, if the site uses them;
• services connected to the site: forms, chat, email delivery, maps, scheduling.

Labor costs, which depend on people:

• updating the platform, plugins, and theme;
• testing the site after every update;
• running and checking backups;
• monitoring security and fixing what broke;
• small changes to text, photos, and pages.

The first part is easy to predict. The second varies the most from site to site, and it's the one most people leave out of the budget. I wrote about the same split for systems and apps in what it costs to keep a system or app live. Websites follow the same logic, with risks of their own.

Your site's platform drives much of the bill

The biggest cost factor is how the site was built. And the most common platform is WordPress. According to W3Techs, as of October 16, 2026 it runs 39.7% of all websites in the world and holds a 58.4% share among sites that use a content management system.

WordPress is popular because it's easy to get started. But every plugin you install is software from another vendor, with its own update schedule and its own flaws. A site with 5 plugins is one job. A site with 40 is another, much bigger one.

In short, what weighs most on maintenance:

1. Number of plugins and integrations. Each one has to be updated and tested.
2. Off-the-shelf or custom theme. A purchased theme that's been heavily modified tends to break on updates.
3. Store, members area, or forms with payment. Anything that stores customer data needs more care.
4. Volume of content changes. A site that changes every week needs hours set aside for it.
5. Static site or CMS. A site with no database and no admin panel has fewer pieces to update.

That's why there's no single maintenance price. Two sites that look the same can have very different costs underneath.

Unsupported PHP: the cost nobody sees

WordPress runs on a programming language called PHP. Every PHP version has a date when it stops getting security fixes. According to the official PHP page, as of October 2026 only versions 8.2, 8.3, 8.4, and 8.5 receive fixes. Version 8.1 lost support on December 31, 2025, per the list of unsupported versions.

Now the worrying part. The public WordPress.org statistics, checked on October 16, 2026, show that 36.7% of WordPress sites run PHP 8.1 or older. PHP 7.4 alone, unsupported since November 2022, shows up on 16.3% of sites.

And the list will grow in two and a half months. PHP 8.2, used by about 24% of WordPress sites, loses security support on December 31, 2026. Added up, close to 6 in 10 WordPress sites will start 2027 on a version with no fixes, if nobody updates.

Updating PHP isn't a push of a button. Old plugins and heavily modified themes tend to break in the switch. Someone has to test the site on a copy, fix what stopped working, and only then publish. That work is maintenance, and it needs to be in the budget.

An outdated site is the most common entry point for attacks, as I showed in what to do when your site gets hacked. Cleaning up a hack always costs more than updating ahead of time.

Security certificates now expire faster

The browser padlock, HTTPS, depends on a certificate with an expiration date. In April 2025, the CA/Browser Forum, which brings together the companies that issue certificates and the browser makers, approved a gradual cut to that validity, from 398 days to 47 days by March 2029.

The first step is already in effect. According to DigiCert, one of the largest issuers in the world, certificates issued since March 15, 2026 are valid for 200 days at most.

For you, this means one thing: renewing a certificate by hand once a year no longer works. Renewal has to be automatic, and someone has to check that it ran. An expired certificate makes the browser show an unsafe site warning, and visitors leave before reading the first line.

When maintenance costs more than a rebuild

There's a point where maintaining gets too expensive. The most common signs:

• every update breaks some page;
• the site depends on a plugin its vendor abandoned;
• nobody can upgrade PHP without redoing half the theme;
• monthly maintenance adds up, over two or three years, to more than a new site.

In these cases, it's worth putting both numbers side by side. I listed other signs in rebuilding your company website: 7 signs it's time.

What a website maintenance contract must include

Before you sign, check that the contract answers in writing:

• What's included: platform, plugin, and theme updates, backups, certificate renewal, downtime monitoring.
• What's not: new pages and layout changes are usually billed separately.
• Frequency: how often updates are done and tested.
• Backups: where they're stored, how often, and whether anyone has tested a restore.
• Response time: how quickly they start working on it if the site goes down.
• Versions: who tracks end of support for PHP and other components, and who tells you.
• Accounts and access: domain, hosting, and site admin in your company's name.
• Report: what was done that month, in plain language.

If the contract says nothing about tested backups and access, you're paying for something you can't verify.

How we do it at the Studio

At the Studio, the cost of maintaining the site is part of the conversation before it goes live. The price is fixed after discovery, and the deadline is written into the contract. The code, files, and access, including domain and hosting, are in the client's name. Our in-house dev team uses Claude Code and Figma for design and build.

Every system we deliver ships with an AI agent that runs daily, flags failures, suggests improvements, and checks that the data makes sense. It's the kind of daily check that catches a pending update or a certificate about to expire before a visitor sees the problem.

If your site is live and you don't know what version it runs on, when the certificate expires, or who handles updates, that's the job of our maintenance and ongoing evolution service.