The site is never done
A website is the only piece of equipment many businesses own that they expect to run for years with zero maintenance. Nobody treats a delivery van that way. Yet the site quietly runs on software that ages, connects to services that change, and sits on the public internet where automated attacks probe it around the clock.
Website maintenance is the recurring work that keeps it fast, secure, and current. This article breaks down what that work actually is, what it should cost, and, because I get called after the skipping, what skipping it tends to cost instead.
The line items: what you're paying for
Here's what a real maintenance arrangement includes, whether you do it, your web person does it, or a company does it:
- Software updates. If your site runs WordPress or similar, the core platform and its plugins, the add-on components most sites depend on, need updates roughly monthly. Outdated plugins are the number one way small-business sites get hacked.
- Backups. Automatic copies of the site and its database, stored somewhere other than the hosting account itself, with an occasional test restore. Host-provided backups alone are not enough; if the hosting account is the thing that breaks, they break with it.
- Uptime monitoring. Something checks the site every few minutes and tells a human when it's down or when the contact form stops delivering. Broken contact forms are the silent killer: the site looks fine while leads vanish.
- Security patching and scanning. Applying fixes for known vulnerabilities quickly, and scanning for malware or injected spam links.
- Content changes. Hours, prices, staff, and services change; a site that says otherwise costs you trust and phone calls.
- Performance checks. Sites slow down as images pile up and plugins accumulate. A periodic speed check keeps mobile visitors, meaning most of your visitors, from bouncing.
What it costs: honest ranges
Honest ranges for a small-business site:
- Do-it-yourself: hosting and tools might run 20 to 60 dollars a month, plus a few hours of your time monthly. The real cost is your hours, and the risk of not knowing what you don't know.
- A basic care plan from a freelancer or studio: typically 50 to 150 dollars a month for updates, backups, monitoring, and small fixes.
- A fuller plan with content changes, security scanning, and performance work: typically 150 to 400 dollars a month.
- Sites with e-commerce: more, because more moves and more breaks. I run the online store for a DC flower shop serving over 15,000 customers, and the maintenance load, from payment updates to inventory quirks to order surges, is a different animal from a brochure site. Budget accordingly.
When comparing plans, ask exactly three things: what's included, what counts as extra, and how fast you respond when the site is down.
What skipping it costs: the emergency math
Now the other column of the ledger.
- Emergency cleanup of a hacked site typically runs 1,500 to 5,000 dollars, more if there's no clean backup to restore from. Without a backup, sometimes the honest answer is rebuilding.
- A blacklisted site, one that Google flags as dangerous, can take days to weeks to recover its search standing after cleanup. During that time, searchers see a warning page instead of your business.
- Downtime is easier to compute than people think: your monthly revenue that starts online, divided by 30, is roughly the daily stake. For plenty of DMV service businesses, that's a few hundred to a few thousand dollars a day.
- The quiet one: a contact form that silently failed. I've seen forms that had been broken for weeks. There's no invoice for that loss, which is exactly why it's the expensive one.
Against those numbers, 100 dollars a month stops looking like a subscription and starts looking like insurance with a maintenance crew attached.
The unowned website: the hidden operational cost
The most expensive website state isn't unmaintained. It's unowned. That's the site built years ago by someone no longer reachable, where nobody currently at the business has the hosting login, the domain registrar login, or any idea where the backups are, if they exist.
Unowned sites can't be maintained, can't be fixed quickly, and, the part that surprises owners, can be lost entirely if a domain renewal card expires and the renewal notices go to a dead inbox. Recovering a lapsed domain ranges from annoying to impossible.
The fix costs nothing but an afternoon: get the domain registrar, hosting, and site admin logins into a password manager the business owner controls. Whoever maintains the site should have access; they should never be the only one who does.
What to do next
This week:
- Confirm you can log in, today, to three things: your domain registrar, your hosting account, and your website admin. Fix any gap first; it outranks everything else here.
- Check when your site's software was last updated and when the last backup ran. If you can't tell, that is itself the answer.
- Send a test message through your own contact form and time how long it takes to reach you.
- Decide who owns maintenance going forward: you, a freelancer, or a care plan. Then put the monthly cost in the budget like the utility bill it is.
HashWhales runs maintenance plans for small-business sites across the DMV, and step 1 is something I'll gladly help you untangle by phone even if the site stays wherever it is.