How Much Does Website Maintenance Cost in the UK?
UK website maintenance costs explained with real figures: our £495 (Cyber Shield), £1,850 (Unlimited Growth) and £3,450 (Scale) monthly tiers, what each includes, and when you can safely pay far less.
Three public numbers: £495 (Cyber Shield), £1,850 (Unlimited Growth) and £3,450 (Scale Pod) a month.
We eliminated traditional “care plans” because passive retainers don’t protect modern digital products. Instead of paying for idle hours and watching timesheets, our clients get active Cyber Shield & SLA protection (£495/mo with 100% free hack restoration) or continuous Unlimited Growth engineering (£1,850/mo) that ships real features and upgrades every week.
The short answer: what UK businesses actually pay
Here is the table we put on the service page and stand behind.
| Tier | Monthly | What you get |
|---|---|---|
| Cyber Shield & SLA | £495 | Zero-liability uptime guarantee, sub-60s form & conversion monitoring, daily cloud backups, 100% free hack recovery, managed edge hosting |
| Unlimited Growth | £1,850 | Unlimited feature requests & iterations, active backlog queue, UI/UX sprints, AI features, CRO improvements, pause or cancel anytime |
| Scale Pod | £3,450 | Dedicated senior pair pod, 2 concurrent active requests, 2-hour priority SLA, full architectural roadmapping & technical debt elimination |
Work outside the tier is transparent fixed change bands, scoped before it starts. New builds we ship carry a 90-day warranty; Support & Growth is how the product stays healthy after that.
That is the agency end of the market. Below £495 you are usually buying hosting-plus-hope, a freelancer’s leftover Friday, or DIY. Above £3,450 you are often paying for account management theatre, not more engineering. The right answer depends on how painful downtime is and how often the site needs to change - we unpack that below and on Support & Growth.
How to read the table without a sales call:
- Choose Cyber Shield & SLA (£495/mo) when your site is commercially critical and you want active zero-liability protection: sub-60s automated form & conversion testing, edge hosting, daily cloud snapshots, and 100% free hack restoration.
- Choose Unlimited Growth (£1,850/mo) when you want an active, continuous engineering team in your repo every week shipping UI/UX upgrades, AI integrations, CRO tests, and new features without counting hours or logging timesheets.
- Choose Scale Pod (£3,450/mo) when you need a dedicated senior engineering pair pod managing concurrent active development tracks with a 2-hour priority SLA.
One more framing that helps buyers: the monthly fee is insurance plus capacity. Insurance is hosting, monitoring, security and a restore path. Capacity is the investigation or maintenance hours. Cheap plans often sell insurance theatre without capacity. Expensive plans often sell capacity you never use, wrapped in status meetings. Match the tier to both pain of downtime and how often the product actually changes.
Sibling cost pieces sit nearby: WordPress maintenance cost, website development cost, and website redesign cost.
What website maintenance includes (and what it never does)
Maintenance keeps a live site healthy. It is not a redesign, not a marketing retainer, and not an unlimited feature factory.
Usually included on a proper plan:
- Hosting management or hosting oversight
- Uptime and performance monitoring
- Security scanning, malware response paths, SSL renewal
- CMS, plugin/theme or dependency updates on a schedule
- Backups and restore drills
- A named route for “something is broken”
- A small block of investigation or maintenance hours (tier-dependent)
Not maintenance:
- New page templates, redesigns, or brand refreshes - that is project work or continuous development hours
- Content writing at volume (unless the tier explicitly buys content time)
- Guaranteeing Google rankings
- Unlimited same-day feature builds
When people say “we need maintenance” and then list a backlog of new features, what they actually need is Enhanced/Gold hours or a scoped build. Calling feature work “maintenance” is how retainers sour.
A practical split we use with clients after 20 years and 350+ projects:
| Ask | Maintenance? | Better route |
|---|---|---|
| Plugin / dependency update | Yes | Inside the tier |
| SSL renewal / cert watch | Yes | Inside the tier |
| ”Site is down / form broken” | Yes | Investigation hours |
| New landing page template | No | Hours or project |
| IA / conversion redesign | No | Redesign or CRO work |
| ”Make us rank #1” | No | SEO programme, not a retainer promise |
| Copy for 40 new pages | No | Content project |
Clarity here protects both sides. You know what the monthly fee buys. We know when to stop and quote. Est 2005 taught us that fuzzy retainers create quiet resentment; published tiers create adult conversations.
Agents help our small senior team stretch further on monitoring triage and repetitive update checks. Humans still own release decisions, especially on payment-adjacent or high-traffic sites. That is the same senior-directed agent pattern we use on builds, including the 5x pace / half-cost framing for comparable project scope. Maintenance is calmer work; the accountability rule does not change.
Hosting, monitoring, security, updates: the line items broken down
Buyers often mix four different bills into one anxiety.
Hosting. Storage, compute, CDN, email deliverability basics. Can be cheap alone. Cheap hosting without eyes on it is how quiet sites get quietly owned. Managed hosting inside our tiers means someone owns the environment, not only a login you never open. DNS, SSL, backups and deploy paths sit in one place. For multi-brand programmes - we have shipped 100+ branded sites in one rollout - shared hosting discipline matters more than a fancy brochure stack for a single brochure site.
Monitoring. Uptime checks, error rates, Core Web Vitals budgets, certificate expiry. This is the difference between “we found out from a customer” and “we fixed it before lunch”. Monitoring without a human path is a dashboard hobby. Our Standard tier packages those line items with one investigation hour so someone can actually look when a check fails. Enhanced and Gold add maintenance hours and faster response because most commercial sites need change capacity, not only alarms.
Security. Scans, hardening, access control, patch cadence. WordPress gets the headlines; every stack needs the discipline. See the WordPress-specific sibling if that is your CMS. Security is boring when it works: least-privilege access, dependency hygiene, malware response paths you have rehearsed, and no “shared admin password in a spreadsheet”. It is expensive when it fails - cleanup, reputation, sometimes rebuild.
Updates. Dependencies move. Plugins conflict. Node packages deprecate. Updates without a staging check are how Friday evenings disappear. Update cadence is where DIY usually dies. People skip a month, then three, then a major version jump becomes a project. A retainer exists so the jump never becomes a surprise.
How the tiers map to those line items in practice:
| Line item | Cyber Shield (£495) | Unlimited Growth (£1,850) | Scale Pod (£3,450) |
|---|---|---|---|
| Managed hosting | Included | Included | Included |
| Monitoring + security scanning | Included | Included | Included |
| Investigation / maintenance hours | 1 hr investigation | 4 hrs maintenance | 10 hrs maintenance |
| Response | Email support | Four-hour priority | Slack + priority base |
| Rhythm | Reactive + scans | Monthly health check | Quarterly reviews too |
new deliverables are priced as transparent fixed additions when you blow past the block. We quote before we spend, so “support” does not become an open tab.
We also run seven of our own marketplaces (Costhetix, Kinurture, BigSleep, WorkVans, Sponsorfy, Away Pubs, Jollee). That operator seat is why we treat webhook monitoring, backup restores and dispute-adjacent downtime as first-class, not optional add-ons sold after an incident. Client sites get the same bias: care for the path that makes money, not only the homepage.
DIY vs freelancer vs agency: honest trade-offs at each price point
DIY. Fine for a personal site or a brochure you barely touch. You own the risk: missed patches, no on-call, backups you never tested. Cost can sit far below £495. Cost of a hack cleanup or a week of downtime usually does not. DIY works when the site is not a lead engine, forms are low-stakes, and someone on your team will actually open the hosting panel monthly. It fails when “we’ll get round to updates” becomes the whole plan.
Freelancer. Good when the site is simple and the person already knows it. Risk concentrates in one human’s calendar and bus factor. Pricing varies wildly; ask what happens when they are on holiday. Ask who holds the credentials, who tested the last restore, and whether updates land on staging first. A strong freelancer with documented process can beat a lazy agency. A silent freelancer with the only deploy key is a single point of failure wearing a friendly smile.
Agency retainer (our model). You pay for coverage, process and a team that already ships on the stack. £495-£3,450 is the band we publish. Agents stretch a small senior team further on monitoring and triage; humans still own release decisions. After 20 years running support for client sites and our own products, the failure mode we fear most is a retainer that looks calm while restore drills have never been run and access lives in one person’s head. Process beats personality when something breaks at scale.
Decision cues we give prospects:
- Brochure, rare edits, low form value → DIY or light freelancer can be rational.
- Lead-gen site with CRM forms, ads spend, or compliance content → Standard is usually the floor.
- Trading site, membership, marketplace-adjacent tooling, or frequent change → Enhanced or Gold.
- Continuous product work every week → Gold hours plus scoped projects, not a pretend “unlimited” plan.
Proof matters when you pick a partner. We stand on 60+ five-star Google reviews, 350+ projects and two decades of Thames Valley and UK client work. Reviews do not patch your site; they tell you whether the people answering the ticket tend to finish the job.
If the site is a lead engine or a trading platform, DIY savings are false economy. If it is a rarely updated brochure with no forms worth stealing, you can safely pay far less than our Standard tier and sleep fine.
When maintenance is not enough: the upgrade-vs-maintain call
Maintenance assumes the product shape is still right. It is the wrong tool when:
- Conversion is stuck and the IA is the leak - start with conversion rate work or a redesign conversation
- The CMS is fighting every content change
- Performance cannot be patched into compliance
- You need a new catalogue, portal or membership model
Then you are in project territory: Blueprint, fixed quote, 90-day warranty on the new work, then back onto a retainer. We would rather tell you that on day one than burn three months of Gold hours polishing a dead template.
Signals we look for on a health check:
- Editors avoid the CMS because every change is fragile.
- Core templates cannot express the offers you actually sell.
- Performance budgets fail after honest update work, not only after neglect.
- You are paying for ads into a funnel the IA breaks.
- Security debt is structural (ancient platform), not a missed plugin.
Maintenance can buy time. It cannot rewrite information architecture, replace a dying CMS, or invent a client portal. For those, we quote a fixed band after Blueprint, fixed change scopes priced before work starts, with agentic delivery at roughly half a traditional agency bench for comparable scope, then Support & Growth again after go-live.
WordPress-specific decay patterns - plugin conflict piles, theme lock-in, multisite surprises - get their own treatment in WordPress maintenance cost. Broader build pricing lives in website development cost. Redesign ranges sit in website redesign cost. Use maintenance money for health. Use project money for shape change.
Do not try to smuggle a redesign through “a few extra maintenance hours”. It creates bad software and a worse relationship.
A clean handoff looks like this: health check finds structural debt, we say so, you choose Blueprint for a rebuild or redesign, we ship under warranty, then you land back on Cyber Shield, Unlimited Growth or Scale for care. The retainer stays honest because the project did the heavy lift. That is how we prefer to work across the 350+ projects behind the studio - not by stretching Gold hours until everyone is annoyed.
How much does it cost to hire someone to maintain a website?
In the UK, a proper agency maintenance hire typically lands between a few hundred and around a thousand pounds a month for commercial sites - our published tiers are £495 (Cyber Shield), £1,850 (Unlimited Growth) and £3,450 (Scale). Freelancers can sit lower; DIY can sit near hosting cost alone. Price should track response time, update discipline and whether real developer hours are included.
Ask three questions before you sign: what happens when the primary contact is away, are updates staged before production, and are investigation hours explicit? If the answer is vibes, you are buying hope with a monthly direct debit.
What is website maintenance cost?
Website maintenance cost is the recurring spend to keep a live site secure, updated, monitored and recoverable - hosting oversight, patches, backups, security and a support route when something breaks. At Code23 that cost is packaged as £495 (Cyber Shield), £1,850 (Unlimited Growth) and £3,450 (Scale) a month depending on hours and response priority.
It is not the cost of new features, SEO rankings or a redesign. Those are adjacent spends. Mixing them into one vague “digital retainer” is how buyers lose track of what they bought.
How much does it cost to maintain a website in the UK?
For a commercial UK site with managed care, budget from £495/month on our Cyber Shield plan upward to £500 (Enhanced) or £1,000 (Gold). unlimited requests sit on our continuous subscription or fixed add-ons. Lighter brochure sites can cost less with DIY or light freelancer cover if you accept the risk trade-off.
UK VAT, agency vs freelancer norms and “managed WordPress” productised hosting all muddy comparison shopping. Compare inclusions, not stickers. A cheap plan that excludes monitoring and restore drills is not cheaper; it is incomplete.
How much should I pay someone to host my website?
Hosting alone is usually a smaller line item than full maintenance - you are paying for infrastructure, not investigation hours. If “hosting” is sold as a synonym for care, ask what monitoring, updates and support response you actually get. Our retainers include managed hosting inside the £495+ tiers rather than nickel-and-diming it separately.
If a quote is hosting-only, budget separately for updates and incident response, or accept that you own those jobs. Many breaches we see start as “we thought hosting included security”.
Can I hire someone to manage my website?
Yes. That is exactly what a maintenance retainer is: a named team to manage updates, security, monitoring and fixes. Start at Support & Growth if you want the tiers in writing before you book a call.
“Manage” should mean credentials held safely, a ticket path, staged updates and someone who will restore from backup if needed. If management means “we’ll login when you shout”, you still do not have a plan.
if your site needs active engineering and zero-liability protection instead of a passive continuous subscription rather than another vague “we’ll keep an eye on it”, the numbers are already public on Support & Growth - pick the tier that matches how hard downtime would hurt, and we will onboard from there.
