Website maintenance is the most confusing service I know of on the Estonian market. One provider charges €29 a month, another €320, and both call it maintenance. The client only finds out what they actually paid for when something breaks. By then, it’s too late.
I often see clients who have signed a maintenance contract without reading it. They assumed maintenance meant that someone keeps an eye on the site and fixes it if something happens. In reality, the contract meant one automatic backup a month that nobody had ever tried restoring from. When malware hit the site, the same partner sent a quote of €1,800 for cleanup work.
Next step: If you want someone to keep an eye on your site, take a look at our website maintenance service or request a free quote.
Why this hits your wallet
Let’s look at the numbers. Patchstack’s 2026 security report reported 11,334 new vulnerabilities in the WordPress ecosystem, 42% more than the year before. 91% of them were not in WordPress core but in plugins. Core itself had six low-risk bugs.
One more number from the same report: for the most actively attacked vulnerabilities, the median gap between disclosure and the first attack attempt was five hours. About half of them were attacked within the first 24 hours. And 46% of the bugs disclosed last year had not been fixed by the developer at all at the time of disclosure.
Five hours. That’s how much time you have for someone to update that plugin or take it down.
Sucuri’s hacked website report adds the other half: 39.1% of the sites sent in for cleanup were running an outdated CMS at the time of infection. The average cleanup bill lands somewhere around $1,500, and the site is down for three to seven days.
Now for some simple common-sense math. If your online store does €40,000 in revenue a month, five days of downtime means roughly €6,500 in lost sales. Add the cleanup bill, add Google’s security warning in the search results, add the customers who got the “This site may be harmful” screen and will head to a competitor next time. Maintenance that costs €150 a month comes to €1,800 a year. One proper incident eats up that amount in a single week.
And that’s only the security side. An unmaintained site also gets slow, forms break, and the PHP version reaches end of life. You won’t know about these things until you look at the numbers. I explained how to check this yourself in the post website audit: how to check it yourself and what to measure.
What a maintenance contract must include
A maintenance contract doesn’t have to be long. It has to be specific. These five points decide whether you’re buying a service or a feeling of reassurance.
- Demand a written update schedule. Not “we keep the software up to date,” but “security advisories are reviewed every business day, modules are updated as needed once a week, a major version upgrade with testing once a year.” The difference is that, in a dispute, the first sentence can’t be measured against anything.
- Ask where the backups are stored and when they were last restored. A backup sitting on the same server as the site itself is not a backup. And a backup that has never been tested is just a file. Demand at least one restore test a year, in writing.
- Have the response time written into the contract. Four hours for a critical failure, one business day for a routine issue. Without a number, the promise “we respond quickly” means in practice that your site stays down until the partner has time.
- Separate maintenance from development. Building a new landing page, integrating new modules, or changing the design is not maintenance. We tell our clients this straight away: work that falls outside maintenance is billed at an hourly rate. That’s honest. Far worse is a provider who promises “everything is included” and then starts explaining, with every request, why this particular one isn’t.
- Find out who is responsible for the licenses. Licenses for paid plugins and themes expire. A plugin with an expired license doesn’t get security updates. A great many Estonian websites are in exactly this situation: there is a maintenance contract, but the license expired two years ago and nobody noticed. License management is not part of our ongoing maintenance, and we say so in the quote. Check what your contract says.
How much website maintenance costs
Internationally, according to Codeable’s market overview, WordPress maintenance packages mostly fall between $100 and $1,000 a month, with online stores and more complex systems costing considerably more. The Estonian market is cheaper, but the logic is the same: the price depends on how many moving parts you have.
Among our own clients, ongoing maintenance for a typical website runs between €75 and €320 a month. Below are the ranges you can use to compare quotes.
If maintenance for your online store costs €39 a month, you’re not buying maintenance. You’re buying an automatic update bot that tests nothing after an update. You’ll learn the difference on the day an update breaks the shopping cart and nobody notices for three days.
Maintenance isn’t only about security
Most talk about maintenance revolves around hackers. That’s only half the picture. An unmaintained site loses money even when nobody attacks it.
Three places where this happens most often. First, speed: every new plugin and every unoptimized image gallery adds load time, and a slow site sells worse no matter how good your offer is. Second, forms: the contact form quietly breaks after an update, notifications stop arriving, and for three weeks you think the market is just quiet. I’ve seen this happen at a client more than once, and it’s the most expensive failure I know of, because it gives no sign of itself.
Third, visibility. AI search engines and Google pull content from your site in machine-readable form. If the site is broken, slow, or partially unreachable, it quietly disappears from there. Getting back takes months, not days. In that sense, maintenance is also a marketing cost, not just an IT cost.
Three red flags when choosing a partner
Talking to other digital agencies, I get the impression that the quality of maintenance services on the market has diverged more than ever before. Some providers do the work, others sell a sense of security. Three things that set off alarm bells for me right away.
The provider can’t say what they did last month. Ask directly: what did you do on my site last month? If the answer is vague, then vagueness is the answer.
Only the partner holds the access credentials. Your domain, hosting, and WordPress administrator account must be in your company’s name. I saw a client who paid for maintenance for three years and, when switching partners, discovered that the domain was registered in the agency’s name. The negotiations got expensive.
The price is suspiciously low. There have always been shady operators on the market. If a quote is three times cheaper than the others, ask what has been left out. Something definitely has.
I’ve laid out the same logic for evaluating a partner in general in the post how to evaluate the quality of a web developer.
What to do if you have no maintenance right now
Don’t start requesting quotes right away. Take stock first, otherwise you won’t know what you’re requesting a quote for.
- Check which WordPress and PHP versions the site is running. If PHP is older than 8.1, you’re not getting security fixes, and your host can force you onto a newer version at any moment.
- Count the plugins. Every plugin is a door. If there are 40 of them and half haven’t been updated in years, the work starts with cutting them down, not with maintenance.
- Request the latest backup and have it restored to a staging environment. This one test tells you more about a partner than the entire contract.
- Review who has administrator rights. Former employees and long-ended partnerships are a typical find.
- Write down what an hour of downtime costs you. This number determines how much maintenance it makes sense to buy. Without it, every price debate comes down to gut feeling.
If this list seems like a lot of work, it is. But it’s a one-time job. After that, maintenance is an ordinary recurring cost that you budget for the same way you budget for accounting.
Frequently asked questions
How often does WordPress need to be updated?
Security advisories need to be reviewed every business day, because for the most attacked vulnerabilities the median time to the first attack attempt is five hours. Modules don’t have to be updated every time an update is released: updates are done as needed, because some updates break more than they fix. A major version upgrade with a backup, testing, and going live usually happens once a year.
Isn’t the hosting provider’s maintenance enough?
No. The hosting provider takes care of the server, not your plugins, theme, or forms. Patchstack’s 2026 security report specifically points out that hosting-level protection blocks only a portion of real attack attempts. The server can be perfectly fine even when your site is already infected.
What’s the difference between website maintenance and website management?
Maintenance is the technical side: updates, security, backups, performance. Management is the content side: new texts, images, product pages, campaign pages. They are often sold together, but in the contract they must be separate line items, otherwise you won’t understand what you’re paying for.
Can I do the maintenance myself?
For a small site, yes. You only need three things: the discipline to check security advisories every week, a place to store backups, and the skill to restore the site after a crash. In my experience, the first two months are done properly, and then a busy period comes along. If your site brings in inquiries or sales, buy the service.
What happens if I don’t buy maintenance?
Usually nothing. Until one morning the site is down or Google shows a security warning next to your name. According to Sucuri’s hacked website report, 39.1% of infected sites were running an outdated CMS, and a typical cleanup takes three to seven days. It’s not maintenance that gets expensive, it’s the lack of it.
Is a maintenance contract fixed-term?
Be sure to ask about this. A reasonable arrangement is a month-to-month contract with a notice period of one to three months. If the provider demands a 24-month commitment and an exit fee, they’re not selling you maintenance, they’re securing their own cash flow.
How much of a website’s cost should maintenance account for?
Rule of thumb: the annual maintenance cost is usually 10 to 20% of the site’s original cost. If your site cost €12,000, then €1,200 to €2,400 a year is normal. I wrote about the pricing logic in more detail in the post website pricing.
My recommendation
My recommendation is simple: don’t buy maintenance by price, buy it by contract. Pull out your current maintenance agreement and look for the five things listed above. If the update schedule, backup location, response time, the line between maintenance and development, and license responsibility are all written down, you have a partner. If they aren’t, you have an invoice.
And if you don’t know which one you have, take a look at our website management and maintenance service and compare it point by point with your current contract. If you’re planning a new site, also see our website development page, because maintenance needs to be factored into the price before the build, not a year later.
Order a free digital marketing audit. We’ll review your site’s technical condition, speed, and visibility, and tell you straight what’s critical and what can wait. Request your free audit here.
You can read more about why monitoring is part of maintenance in the post why website maintenance and monitoring matter.
