Website maintenance contract: what's a fair price?

A maintenance contract should do more than install updates. It should reduce risk, restore service fast, and keep performance within agreed limits. You pay for certainty, not just for time spent clicking update buttons.

This article explains what a fair maintenance package typically includes, indicative price ranges in euros, and what you can reasonably do yourself to keep costs down. There’s a checklist and a decision plan you can use when comparing offers.

What a fair contract includes

At minimum a practical contract contains:

• scheduled software updates (CMS, plugins, libs)
• a backup and restore policy with test restores
• security monitoring and incident handling
• uptime checks and alerting
• performance monitoring (Core Web Vitals) and small optimizations
• regular reporting (monthly or quarterly)
• agreed response times for incidents

For e-commerce and custom apps add database maintenance, payment gateway checks, and data integrity tests.

Note: updates without a tested restore plan are a false sense of security. WordPress backup best practices are a good reference if you use that platform: https://developer.wordpress.org/advanced-administration/security/backup/.

Typical service levels and cost ranges

You usually see three tiers: basic, standard, and premium. Indicative costs (per month, excl. VAT, varies per project):

The spread is large. A small brochure site sits at the low end; a high-traffic webshop with integrations sits at the high end.

What you actually pay for

• labour: time for updates, testing, and issue resolution
• tools: uptime and security scanners, performance monitoring
• storage: backups and offsite retention
• SLA: guaranteed response and prioritization
• contingency: budget for emergency fixes or small improvements

Providers charge fixed monthly fees, or fixed fee plus hourly rates for work beyond the included hours. Some work with credit packs.

Do-it-yourself tasks to lower costs

You can safely take on several tasks yourself:

• Monitor contact form submissions and payments daily.
• Maintain basic backups and perform a restore test every quarter.
• Use a password manager and enable two-factor authentication.
• Limit installed plugins/extensions to reduce attack surface.

If you perform updates, always test first on a staging environment and document changes. WordPress hardening guidance is useful if that’s your stack: https://developer.wordpress.org/advanced-administration/security/hardening/.

Security focus areas

Security is the main justification for paying maintenance. Concrete items:

• Weekly security scans and rapid patching when a vulnerability is disclosed.
• Rate-limiting and monitoring of login attempts.
• Offsite backups with at least 30-day retention and tested restores.
• Awareness of common web-app risks such as those in the OWASP Top 10: https://owasp.org/www-project-top-ten/.

Performance and SEO signals

Page speed affects conversions and can influence search visibility. Maintenance should include monitoring Core Web Vitals and basic fixes like image optimization, caching, and minimizing render-blocking resources. Background on Core Web Vitals is here: https://web.dev/articles/vitals.

Checklist to compare offers

• Is there a documented restore procedure and how often is it tested?
• What are the guaranteed response times for production outages?
• How many support hours per month are included and what is the overage rate?
• What is explicitly out of scope (new feature development, content updates)?
• Which monitoring tools and reporting will you receive?
• Backup retention policy: how long and where are backups stored?
• Can they show examples of similar sites they maintain?

• If you plan to do parts yourself, ask for a smaller package focused on security and backups.

Decision steps

• Step 1: assess risk (payment flows, traffic levels, legal needs).
• Step 2: select a service level according to risk and budget.
• Step 3: request comparable quotes with identical scopes and retention policies.
• Step 4: verify recovery time objectives (RTO) and recovery point objectives (RPO).
• Step 5: sign a concise SLA that lists responsibilities and escalation paths.

When to keep maintenance in-house

Keep in-house the low-risk, low-effort tasks. Outsource when:

• uptime is critical and downtime costs are high
• you have payment processing and compliance requirements
• you lack time or skills for staging tests and restore drills

DevCru is a senior-led web and app development studio that also offers maintenance and support for websites and webshops. If you want help choosing the right level of support, see our maintenance page: /onderhoud-en-support.

If you want a concrete, written quote with clear scope and price ranges, request one here: /quote