How much does website maintenance cost, and what does it cover?
What website maintenance costs: what updates, backups and monitoring cover, what drives the price, Oxtren plans from €149/mo and how to choose a plan.
In short
The cost of website maintenance depends on the monthly hours of work, the response time, and how complex and business-critical the system is. Oxtren Labs plans: Essential – €149/mo (up to 1 h of work, response within 2 business days), Business – €299/mo (up to 3 h, within 1 business day), Priority – €599/mo (up to 6 h, critical incidents within 4 business hours). All include updates, backups, monitoring and a monthly report.
Key takeaways
- Maintenance means updates, backups, monitoring, hours of work and a report – not just “we fix it when it breaks”.
- The price is driven by hours, response time and system complexity; response time is not the time to resolve a problem.
- In 2025, 11,334 new vulnerabilities were found in the WordPress ecosystem, 91% of them in plugins.
- Oxtren Labs plans cost €149, €299 and €599 a month; maintenance is optional and work can also be ordered as needed.
- We only take over a website we didn't build after a technical audit.
What website maintenance is
A launched website isn't a finished object. Its system, plugins and server software change, certificates expire and new security holes appear. If nobody keeps an eye on it, the site can look fine for a long time – until one day it stops sending enquiries or doesn't load at all.
- Website maintenance
- Regular work that keeps a website secure, working and up to date: system and plugin updates, backups, uptime monitoring, small changes and a report. It differs from building new features, which is estimated separately.
This article covers why maintenance is needed, what drives its price, what our plans include and how to decide whether you need a plan at all.
Why maintenance is needed
11,334
New vulnerabilities found in the WordPress ecosystem in 2025 – 42% more than in 2024. 91% of them were in plugins and 9% in themes.
Source: Patchstack, 20261
46%
Share of 2025 vulnerabilities not fixed in time for public disclosure – the hole became known before a patch existed.
Source: Patchstack, 20261
That's why updating isn't enough on its own – monitoring matters too: when there's no patch yet, a plugin sometimes has to be switched off or access restricted for a while. The same goes for the server. WordPress currently recommends PHP 8.3 or newer, and older branches are gradually losing security fixes.
31 Dec 2026
PHP 8.3+
The PHP version WordPress recommends for a site's server, together with MySQL 8.0 or MariaDB 10.11 (or newer) and HTTPS support.
Source: WordPress.org, 20263
398 → 47 days
The CA/Browser Forum approved reducing the maximum validity of TLS (SSL) certificates in stages from 398 to 47 days, between March 2026 and March 2029. Certificates will need renewing ever more often, so renewal has to be automatic and monitored.
Source: CA/Browser Forum, 20264
What most often breaks without maintenance
Website failures are rarely dramatic. Usually they're quiet things someone notices weeks later – when it turns out there haven't been any enquiries for a while.
- A plugin update breaks the contact form or a checkout step, and nobody sees the error
- Form emails stop arriving because mail settings or sender verification changed
- The SSL certificate expires – browsers warn visitors that the site isn't secure
- Someone forgets to renew the domain
- The server runs out of space as logs or old backups pile up
- Backups are made, but nobody has checked whether the site can be restored from them
- Spam floods in through the forms and real enquiries get lost in it
What to check now if you have no maintenance
- Fill in your own contact form and check the email arrived
- See when the system, theme and plugins were last updated
- Find out where backups are stored and when a restore was last tested
- Check the domain and certificate expiry dates
- Make sure someone gets an alert if the site goes down
What drives the cost of maintenance
Maintenance plans differ not in whether updates happen, but in how much time goes to your site and how quickly we respond. Four things decide which plan fits.
Hours of work
Plan hours are for small jobs: changing a piece of text or a photo, a new block, fixing a form, checking updates. If you change the site often, you need more hours; if almost never, the smallest plan is enough.
Response time
- Response time
- How soon work starts on your request or incident. It is not the time to resolve the problem: a complex fault can take longer to fix.
If a few hours of downtime means lost orders, a short response time matters. If the site is a digital brochure, a response within a few business days is enough.
System complexity
A one-page site, a business website with a CRM integration and an online store with payments and shipping need different amounts of work. The more integrations, plugins and third-party services, the more can break after an update and the more has to be checked.
How critical the site is to the business
Ask yourself: what would happen if the site were down for a day? If almost nothing, basic maintenance is enough. If orders would stop or customer service would be disrupted, you need a plan with a shorter response time and more hours.
What maintenance costs at Oxtren Labs
Our website maintenance plans differ by hours of work and response time. Prices are final – VAT not applicable.
| Plan | Price | Work per month | Response |
|---|---|---|---|
| Essential | €149/mo | Up to 1 h | Within 2 business days |
| Business | €299/mo | Up to 3 h | Within 1 business day |
| Priority | €599/mo | Up to 6 h | Critical incidents – within 4 business hours |
Included in every plan
- System, plugin and dependency updates
- Daily database backups; files daily or as often as they change
- Backups kept for 30 days; an extra backup before risky deployments
- Uptime monitoring and a response within your plan's response time
- Hours of work: up to 1, 3 or 6 h a month
- Monthly report
Critical systems are backed up more often. The monthly report shows uptime, incidents, work done and updates, backup status, and security and speed notes. For monitoring and infrastructure we use tools such as Uptime Kuma, Better Stack, Cloudflare, Coolify, Docker and S3 storage for backups.
What maintenance doesn't include
Maintenance keeps what already exists running. Anything that extends the site is estimated separately, so the plan price stays clear and predictable.
- New features, pages and integrations – estimated and agreed in advance
- A redesign or rebuild – a separate project with its own proposal
- Third-party services (domain, hosting, paid licences) – their prices are set by the providers
How to choose a plan
The situations below are illustrative, not actual clients. They show how hours and response time relate to what the website does for your business.
| Situation | What matters most | Plan |
|---|---|---|
| A landing page or brochure site changed a few times a year | Updates, backups, monitoring | Essential – €149/mo |
| A business website with a CRM integration and regular content changes | More hours, response within 1 business day | Business – €299/mo |
| An online store or system where downtime costs orders | Fast response to critical incidents | Priority – €599/mo |
A maintenance plan or work as needed
Work as needed
- You pay only when something is needed
- We estimate each job in advance
- You have to arrange updates, backups and monitoring yourself or through another provider
- You usually hear about an outage from visitors
Maintenance plan
- A fixed monthly price
- Hours for small jobs are already included
- Updates, daily backups and monitoring run continuously
- We see an outage and respond within the plan's response time
Work as needed suits a site that rarely changes and where a short outage costs the business nothing. If the website brings in enquiries or orders, a plan is usually the calmer choice: we find out about an outage, not your customers.
If someone else built your website
Before taking over a third-party system, we carry out a technical audit. After the audit we confirm whether we can take on its maintenance and on what terms. What such an audit checks is covered in technical website audit. If the audit shows the site's foundations no longer fit your needs, we'll say so plainly – then read when to rebuild your website.
Methodology
- Date
- Criteria
- Plan prices, hours, response times, backup frequency and report contents – from the Oxtren Labs maintenance service page on 1 October 2026
- Security and system facts – from the Patchstack 2026 report (2025 data), php.net, WordPress.org and the CA/Browser Forum
- Plan-choice situations are illustrative, based on the hours needed and the cost of downtime
- Limitations
- The Patchstack data covers the WordPress ecosystem; risks differ for other systems. The situations are not client projects.
How to get started
Tell us what your website is, who built it and how often you change it: ask for maintenance. We reply within 1 business day. If your site is still being built, see how much a website costs to build – it covers the costs after launch too.
Frequently asked questions
Is maintenance mandatory?
No. You can choose a plan from €149/mo, or skip maintenance and order work when you need it – we estimate each job in advance.
What is the difference between response and resolution?
Response time is how soon we start working on your request. It is not the time to resolve the problem: a complex fault can take longer to fix.
How often are backups made?
Database – daily, files – daily or as often as they change; backups are kept for 30 days. An extra backup is made before risky deployments, and critical systems are backed up more often.
Do you maintain websites you didn't build?
Before taking over a third-party system, we carry out a technical audit. After the audit we confirm whether we can take on its maintenance and on what terms.
What's in the monthly report?
Uptime, incidents, work done, updates, backup status, and security and speed notes. You receive it once a month.
Does maintenance include new features?
Plan hours are for small jobs. New features, pages or integrations are separate work: we estimate and agree them in advance.
Sources and methodology
- PatchstackState of WordPress Security in 2026accessed
- PHPSupported Versionsaccessed
- WordPress.orgRequirementsaccessed
- CA/Browser ForumBallot SC081v3: Introduce Schedule of Reducing Validity and Data Reuse Periodsaccessed