Website maintenance costs depend on what the fee includes and who does the work. Compare hosting, software, support and optional improvements as separate lines. Then build a twelve month total that counts each charge once. A low monthly fee only helps when the scope, GST and exclusions are clear.
What website maintenance costs
There's no single national price, because plans cover different work. Site complexity matters more than page count. So does how much the business relies on the site. Response cover and existing bundles matter too.
Here are two advertised Australian packages, from our own market check in October 2026. They aren't Elev8d prices, endorsements or a full market survey. We've labelled the providers A and B.
Advertised example | Monthly price | What it includes |
|---|---|---|
Provider A starter plan | $89 plus GST ($97.90 with) | Hosting extra, from $25 plus GST |
Provider B starter plan | $165 with GST ($150 without) | Hosting, SSL, backups, 30 min |
Provider A's plan lists updates, weekly backups and firewall and malware protection. It adds uptime monitoring, a monthly health report and a monthly enquiry form test. Hosting is billed separately, from $25 plus GST a month.
Provider B's plan bundles managed hosting, an SSL certificate and daily cloud backups. It adds weekly updates and 30 minutes of work a month.
Provider A's plan plus its starting hosting comes to $114 a month excluding GST, or $125.40 with GST. It still isn't like for like, because the scopes differ. Don't call one better value on that sum alone.
The terms differ too:
Provider A's plans run month to month
Provider B asks for 30 days' notice to cancel
extra work is $150 plus GST an hour at Provider A
Provider B charges $165 an hour with GST ($150 without) on its starter plan
A common mistake is comparing monthly fees before checking whether hosting sits inside them.
What the site must do drives the work more than its size. Write down your requirements first:
Requirement | What to write down |
|---|---|
Essential journeys | The tasks that must always work |
Impact of interruption | What an hour or a day offline would cost |
Change frequency | How often prices, content or stock change |
Expected checks | Which tests prove those tasks still work |
Support coverage | The hours and response you actually need |
Here's how the essential tasks differ by site type:
Site type | Tasks that must work | Checks that add work |
|---|---|---|
Brochure site | Contact details and a form | Form delivery, content accuracy |
Lead site with bookings | Bookings and enquiry routing | Integration and calendar tests |
Online store | Checkout, payments and stock | Order, payment and app checks |
A booking integration alone can make a small site complex to look after.
The six maintenance buckets
Maintenance work falls into six buckets. One provider can bundle them. Each one still needs an owner. The schedule and tools can differ for each.
Bucket | Evidence to ask for |
|---|---|
Hosting and availability | Resource limits, alerts and an escalation contact |
Security | An access review and how vendor notices were handled |
Updates and testing | A change log, a recovery point and task tests |
Backups and recovery | A successful restore test and its known exclusions |
Performance and faults | Comparable speed evidence and functional tests |
Content and small changes | The approved request and the published change |
Hosting and availability
Hosting keeps the site reachable. Scope the capacity, the supported server software and the monitoring. Note who renews the domain and the TLS certificate. TLS is the modern name for SSL, the certificate behind the browser padlock.
A host that's up doesn't prove your enquiry form or checkout works. A cheap host isn't automatically slow. An expensive plan doesn't prove you're getting enough resources or support. Our guide to choosing website hosting covers capacity and what hosts take on.
Security
Security is broader than buying a plugin. It covers who can log in and whether logins need a second check, called multi factor authentication. It also covers supported software and who responds to an alert.
The Australian Cyber Security Centre's small business guide recommends multi factor authentication and automatic updates. It also says to back up regularly, including the website. Ask for an access review and how recent vendor notices were handled. Keep passwords and sensitive logs out of reports. Our guide to WordPress security covers updates, access and incident preparation.
Contracts differ, so read your own agreement. Whoever does the work, each task needs one named owner.
Updates and testing
Updates cover core software, themes and extensions. Anything they depend on counts too. Who updates what depends on the platform and your agreement.
WordPress applies minor and security core updates in the background on capable sites. It suggests a backup before you update. Plugin and theme auto updates are opt in, one at a time. WordPress also suggests making sure you can roll back first.
Judge each update by its severity and the vendor's notices. Check supported versions and compatibility too. A pending update count says little. An urgent patch shouldn't wait for the next monthly slot.
Test on a staging copy where it suits. That's a private copy of the site for testing. It won't behave exactly like the live site, so verify after release too. Keep real customer data, live payments and marketing sends out of test copies.
A common mistake is treating an update count as proof the site works.
Backups and recovery
A backup only counts if someone can restore it. Scope what's covered and how often copies run. Then check how long they're kept and where they're stored. Ask for a successful restore test, how long it took and what it left out. Our guide to website backups and recovery covers restore scope and testing.
Performance and faults
Performance work means fixing real slowdowns. Watch key pages and tasks to spot them. It isn't a monthly ritual of clearing every cache or deleting database records. Keep sessions, orders and records you need.
PageSpeed Insights shows lab and field data. Google notes the two can differ. A score alone isn't the service outcome. Our guide to diagnosing a slow website covers the fixes.
Content and small changes
Keep prices, contact details and opening hours accurate. That's operational work, even when new marketing pages are optional. Agree where a small edit ends and new work starts. Then ask for the approved request, the published change and your sign off.
Baseline duties and optional work
Some work is necessary whoever does it. Necessary functions can already be bundled into another fee. Here's how the example budget below splits:
Function | Supplied by, in this example | Extra invoice? |
|---|---|---|
Domain registration | Domain registrar | Yes, yearly |
Hosting | Host | Yes, monthly |
Secure connection (TLS) | Host | No, included |
Backups and monitoring | Care plan | No, inside care |
Updates and security work | Care plan | No, inside care |
Plugin licences | Plugin vendors | Yes, yearly |
Website email | Email provider | Yes, per user |
Count each row in this table once. Count an agency licence only if it's charged separately. Ask what happens if that supply stops. Necessary work still needs an owner when the platform supplies it or you do it yourself.
Let's Encrypt issues free certificates. A provider can still charge for installing, monitoring or managing one, so ask what the fee covers. Shopify provides free TLS for domains added to a store. Our guide to SSL and TLS certificates covers included certificates and renewal.
Optional work covers things like:
new features and functions
bigger design changes
extra landing pages
conversion experiments
marketing retainers
Fixing a wrong price isn't optional growth work. Neither is repairing a broken enquiry route or renewing an expired certificate. Payment processing, advertising and SEO belong in the wider budget, not the care plan. So do business software and optional content production.
A common mistake is counting the same certificate or backup under two headings.
Service and supplier: [name]
Account owner and payer: [names]
Included in another fee: [which fee, or no]
Invoice and renewal: [amount, currency, tax and dates]
Commitment and excess: [term, allowance and rate]
Owner and exit dependency: [person and replacement need]
Build a twelve month budget
Build costs and running costs belong in separate budgets. Our guide to website build and ownership costs covers the upfront project. This section covers what runs after launch.
Here's an example service site budget in Australian dollars, excluding GST. It matches our build cost guide and isn't an Elev8d quote or market benchmark.
Recurring item | Assumption | Annual cost |
|---|---|---|
Domain | Paid once a year | $35.00 |
Hosting | $50 a month, outside care | $600.00 |
Care | $120 a month, backups and security | $1,440.00 |
Plugin licences | Yearly, outside care | $240.00 |
2 users × $11.80 × 12 | $283.20 | |
Total | The five items above | $2,598.20 |
The budget leaves out the build, first content and new features. It also leaves out payment processing and marketing. Your own time and any incident sit outside it too.
Divided by twelve, the total is about $216.52 a month. That's a planning average, not an invoice. Don't multiply the rounded figure back up to replace the exact annual total.
The actual cash timing looks different:
monthly: hosting, care and email, $193.60 together
on their due dates: the domain and licences, $275 between them
If every supply carried 10% GST, tax of $259.82 would make the cash total $2,858.02. Real tax treatment depends on each supplier. A GST credit, if you can claim one, doesn't stop you paying the cash first. Keep GST inclusive and exclusive figures clearly labelled.
Drop the care plan and the other subscriptions total $1,158.20. That isn't a DIY plan. Someone still has to do the backups, security and labour the care plan covered.
Keep an incident reserve outside the ledger. Money set aside isn't spent until something uses it. Show price rises only on the lines they affect. Note when any introductory rate ends, and any commitment that runs past the year.
How the platform changes the work
The platform decides which jobs the vendor does and which stay with you. Sort out those duties before you compare fees.
Platform | Platform or host supplies | You or your specialist scope |
|---|---|---|
Self hosted WordPress | The contracted hosting services | Core, plugins, recovery, tasks |
Shopify | Platform, hosting and TLS | Apps, theme edits, settings, data |
Webflow | Hosting under your plan | Content, code, forms, connections |
On self hosted WordPress, the host supplies what its contract says. Managed hosting isn't automatically full application care. Someone still keeps core, themes and plugins supported. The same goes for server software. Accounts, content and recovery need owners too.
On Shopify, apps are services the vendor generally maintains. You don't update them in place like WordPress plugins. You do review vendor notices, permissions and changed charges, then test the store. For backups, Shopify documents CSV exports, theme downloads and apps from its App Store. Orders can't be imported back through the admin.
On Webflow, you own the content and design changes. Access, custom code and connected tools are yours too. Webflow backs up automatically as you work, with unlimited backups on paid Site plans. A restore has side effects, such as turning off bot protection.
Don't assume any platform backs up your connected customer database (CRM), email, payment or fulfilment data.
After a relevant change, someone checks the whole customer task. That means checking:
the browser action and the confirmation
the notification the business receives
the CRM record
payment and fulfilment, where they apply
Use authorised test data and a proper payment test method. A page that loads doesn't prove the enquiry reached a monitored inbox. Still choosing a platform? The website platform comparison can help.
Platform and email prices
Shopify's Australian plans in AUD, from its pricing page in October 2026. GST is added unless the ABN exemption below applies:
Plan | Pay monthly | Annual billing |
|---|---|---|
Basic | $56 a month | $42 a month ($504 a year) |
Grow | $149 a month | $114 a month ($1,368 a year) |
Advanced | $575 a month | $431 a month ($5,172 a year) |
The annual rate isn't a month to month offer. Apps, domains and payment fees are extra. Promotions can change the price. Shopify charges GST on the subscription unless you're registered for GST and add your ABN to the account. Only invoices issued after that are exempt.
Google Workspace Business Starter, per user a month, checked in October 2026:
Flexible plan: $11.80
annual commitment: $9.90, which can still be billed monthly
The page doesn't say whether tax is included. This guide treats it as excluding GST, so check your invoice.
Two Flexible users cost $283.20 a year. On the annual plan, they'd cost $237.60. Not every address needs a paid user. Each user can have up to 30 free aliases. An alias is an extra address that delivers to the same inbox.
In October 2026, Webflow listed Basic at US$15 a month and Premium at US$25, both billed yearly. Prices are per site, in US dollars, plus applicable taxes. Workspace plans are a separate charge, so check which combination your team needs. Your card provider may add a foreign transaction fee, so check the Australian dollar charge.
A common mistake is reading a US dollar price as Australian dollars.
DIY or managed maintenance
DIY or managed is a capacity question. Plugin count alone doesn't decide it.
DIY can suit a simple site when a named person has the access, skill and time. They also need a recovery route. Managed support can suit limited internal time, frequent changes or costly interruptions. A five page booking site can depend on more systems than a large static site.
Question | DIY owner answers | Managed buyer answers |
|---|---|---|
Who acts? | Named owner, plus leave cover | Named contact and a decision maker |
What's done? | Written routine and urgent tasks | Listed inclusions and exclusions |
When does help arrive? | Your hours, plus an escalation | Hours, severity and response terms |
How is recovery proven? | A safe restore and retest | Test evidence and reconciliation |
What time is left? | Work, learning and coordination | Approvals, content and acceptance |
Put a value on your own time too. Say DIY takes two hours a month, valued at $50 an hour. That's $1,200 of time a year. It isn't a $1,200 invoice or necessarily lost profit. Swap in your own estimates.
A managed plan doesn't remove every owner task either. You still approve changes, keep content accurate and report problems.
Not sure what your team can handle? Start with a scoped health check and handover review. A neglected site may need paid onboarding or fixes before routine care starts. An already compromised site shouldn't be folded quietly into a standard monthly fee.
A practical maintenance schedule
Here's an example schedule to adapt. It isn't a legal deadline or a universal minimum. Automated checks can run often. A person still has to respond. Urgent vulnerabilities and broken key tasks override the next routine review.
When | Suggested checks | Useful record |
|---|---|---|
Continuously | Uptime, TLS and backup alerts | Who gets and acknowledges them |
After a change | Recovery point and task tests | Version, approval, tests, rollback |
Weekly example | Notices, updates and open faults | Prioritised actions and an owner |
Monthly example | Form test, key journey and billing | Observed results and open issues |
Quarterly example | Access, integrations and a restore | Restore evidence, access removed |
Yearly, before renewal | Scope, support hours and renewals | Approved budget and renewal dates |
The monthly check should include a real enquiry and a comparable speed review. The quarterly one should also cover content and licences.
Plan for recovery in business terms
Back up as often as the site changes. A daily copy could lose almost a day of new records. That happens if it's the latest copy you can restore. A platform being up also doesn't mean it can undo your own accidental changes.
Agree in plain words how much data you could lose and how long the site can be down. Some providers call these RPO and RTO. On a busy store, don't restore an older database straight over live data. Reconcile orders, payments and enquiries against their source systems first.
Record what a restore leaves out and who holds recovery access. Decide how you'll test afterwards. Keep backups protected from anything that could compromise the site, for a suitable period. Restoring an infected copy isn't a finished incident response. Neither is leaving the original cause in place.
Review the plan when scope changes
Don't wait for the anniversary. Costs can climb after launch when:
you add a new integration
data or traffic grows
more staff need accounts or support
a link between two systems expires
a vendor changes how its software connects
software reaches the end of its support
The cycle doesn't mean urgent findings wait a month.
Compare plan scope and support
Plan names vary, so compare what's included and how support works. Use these as comparison categories, not industry packages or price bands:
baseline care: routine updates, backups and monitoring
care plus an edit allowance: for regular content changes
business critical support: complex journeys and faster response
For an edit allowance, ask:
what counts toward the time, and the minimum billing increment
how requests get approved
whether unused hours expire or roll over
the excess rate, and any urgent rate
which tasks are excluded
The details vary between providers. Provider A bills extra work in 15 minute increments with a 30 minute minimum. Provider B's higher tier rolls forward up to two unused hours. Unlimited requests can still have scope, queue and fair use limits.
Response isn't resolution
An incident service has stages. A two hour response target isn't a two hour fix.
Stages can overlap. The commitment depends on business hours and time zone. Weekends, severity and dependencies matter too. Define after hours routes and approval limits before an incident, not during one.
Ask what the cleanup work covers:
problems that existed before you signed
malicious changes and third party outages
changes you made and unsupported plugins
payment issues and data reconciliation
Record who can approve emergency spending. Note any limit agreed in advance. A hosting service credit won't necessarily cover lost enquiries or sales.
A useful monthly report shows completed changes and successful tests. It covers backup status, incidents and support time used. It ends with unresolved work and next actions. Bot and update counts don't prove savings.
What an incident can cost
This example shows the cost categories. It doesn't show the chance of a hack or prove a care plan works. All amounts are AUD excluding GST. It isn't an Elev8d client result.
Item | Calculation | Amount |
|---|---|---|
Investigation and cleanup | 6 hours × $150 | $900 |
Recovery and validation | Scoped separately | $300 |
Direct incident invoices | 900 + 300 | $1,200 |
Lost contribution (assumed) | 3 jobs × $200 | $600 |
Example business impact | 1,200 cash + 600 contribution | $1,800 |
Contribution is what a job earns after its direct costs. Business Victoria's breakeven guide uses the same subtraction, price minus unit cost.
An example $1,200 incident invoice is called $1,800 of cash spending
$1,200 is direct spending and $600 is separately assumed lost contribution
The three lost jobs are an assumption. Lost website revenue isn't automatically lost profit. Some customers come back later. Jobs won through another channel aren't lost at all.
Privacy response and other consequences can add costs. Only count the ones you can support.
Compare the $1,440 care assumption with the $1,200 invoice carefully. One is a year of routine work. The other is a one off bill for a different scope. Routine care can reduce some risks and improve readiness. It can't guarantee no incident, free cleanup or a net saving.
A cash reserve isn't insurance. Cover depends on the actual policy and incident. If personal information might be affected, use your incident response route with the responsible team. Our website compliance checks cover that escalation.
Questions before signing or leaving
Get quotes against the same scope. Plan the exit before you sign.
Start with the service:
Ask about | A clear answer includes |
|---|---|
Platform and scope | Every system covered, and what isn't |
Hosting | Whether it's included or billed separately |
Software versions | Who keeps core and extensions supported |
Backups | Coverage, frequency, retention and a restore test |
Change controls | Staging or an equivalent safe release |
Task tests | Real enquiry or checkout tests after changes |
Support hours | Hours, time zone, severity and response terms |
Then the money and the terms:
Ask about | A clear answer includes |
|---|---|
Licences | Who owns them and what happens if they stop |
Incidents | What's excluded and the emergency rate |
Allowance | What counts, increments, rollover and excess rate |
Onboarding | Any setup or remediation charge |
Renewals and GST | Price rises, tax basis and commitment |
Cancellation | Notice period, exit help and fees |
Don't assume every fixed term is unfair. Compare the commitment and renewal terms. Check cancellation and minimum charges too. Get advice where a term is unclear.
The ACCC's contracts guidance covers unfair terms in standard form contracts. It protects small businesses with fewer than 100 employees or under $10 million turnover. Only a court decides whether a term is unfair.
A managed platform's limits are a disclosed trade off, not automatically unfair. Check export limits early. Webflow's code export needs a paid Workspace plan. CMS content, forms and ecommerce stop working after export.
Keep control without sharing passwords
Control should be recoverable without sharing a master password. Use named accounts with suitable permissions. Owning the domain doesn't mean everyone needs full admin access. Keep recovery contacts current and record who can approve transfers.
Budget for the exit
Leaving a provider costs money too. Budget for replacement licences and overlapping services. Allow for export limits, account recovery and transfer help. Before you leave, ask:
which functions will need rebuilding elsewhere
which export formats you'll get, and what they leave out
whether you can reuse the theme, templates and images
how the old provider deletes any copies it keeps
Test the replacement before you cancel. Keep the domain and email working through the switch. Forms, tracking and records need the same care. Then revoke access and confirm what happens to retained copies. Our guide to moving your website to a new developer covers the handover steps.
Our platform and key tasks: [details]
Services we already pay for: [list]
Work and support hours needed: [scope]
Recovery and incident expectations: [details]
Please itemise: [recurring fees, onboarding, exclusions, tax and exit charges]
A provider doesn't have to accept every term you ask for. The template just makes quotes comparable.
Our free audit checks what your site actually needs looked after, and what you could stop paying for.
What we recommend at Elev8d
Pay for the work your site actually needs, not a bundle you can't see inside. Start with what you already pay for, then fill the gaps.
Our web design page keeps hosting, the domain and maintenance separate from the build. You can take a care plan or look after the site yourself.
Our care plan covers updates, backups and speed checks. It also covers changes and support, with no lock in. Our care plans start from $120 a month excluding GST. See our ongoing website support for the wider service.
Frequently asked questions
How much does website maintenance cost?
It depends on scope. Add up the subscriptions and labour, then compare them with the dated examples and the worked budget above. A few advertised packages can't support a national average.
Can I skip a care plan?
Yes, if the necessary work is assigned and funded another way. Ignoring the work is a different thing.
Is hosting the same as maintenance?
No, hosting is a service with its own boundaries. Confirm updates, restores and support separately.
Do hosted platforms need maintenance?
Yes, even though the vendor manages the infrastructure. Accounts, content and integrations still need owners. So do customer tasks and recovery.
Can I update everything once a year?
No, because urgency depends on the issue. Critical fixes and broken tasks can't wait for an annual appointment.
Are backups and certificates free?
Sometimes, because some services include them and Let's Encrypt certificates are free. Confirm backup scope, restore charges and who manages renewal.
Next steps
List what you pay
Put every running charge in one record, using the template above.
Assign each task
Name an owner for every necessary job, including the ones a platform does. Our small business website guide covers the wider launch and running context.
Get comparable quotes
Send the same scope to each provider. No care plan can promise rankings, leads or complete security.
