Quick answer
Maintenance keeps a live website or application secure, fast and working: security updates, dependency and framework upgrades, backups, uptime monitoring, bug fixes and small improvements. A commonly cited budgeting rule of thumb is roughly 15–20% of the original build cost per year, but the real figure depends on how complex the system is and how much change you want. Whatever you pay, get a written SLA that defines response times by severity, coverage hours and what is excluded.
Why maintenance is not optional
Software does not stay finished. Frameworks release security patches, browsers change, third-party APIs deprecate endpoints, SSL certificates expire, and hosting platforms retire old runtimes. A site that nobody maintains does not stay the same — it slowly becomes insecure, slower and more fragile, until something breaks at the worst possible moment.
The cheapest time to maintain a system is continuously. Skipping updates for a year or two often turns routine patching into a risky upgrade project.
What a good maintenance plan covers
| Task | Typical frequency | Why it matters |
|---|---|---|
| Security patches (CMS, framework, server) | As released; critical ones within days | Most compromises exploit known, already-patched vulnerabilities |
| Dependency and library updates | Monthly or quarterly | Prevents large, risky upgrades later |
| Backups and restore tests | Daily backups; periodic restore tests | A backup you have never restored is a hope, not a plan |
| Uptime and error monitoring | Continuous | You hear about problems before your customers do |
| SSL, domain and DNS checks | Ongoing | Expired certificates take sites offline and scare visitors |
| Performance checks | Monthly or quarterly | Speed affects conversions and search rankings |
| Bug fixes and small changes | On request, within an agreed allowance | Keeps the product useful as the business changes |
How much should you budget?
A widely used rule of thumb is to budget roughly 15–20% of the initial build cost per year for maintenance. Treat it as a starting point rather than a quote. A brochure website with few moving parts may need far less; a transactional platform with integrations, user data and compliance obligations may need more.
The main cost drivers are:
- Complexity and integrations — every connected system is something that can change or break.
- Required response times — 24/7 cover for critical incidents costs more than business-hours support.
- Change allowance — how many hours of improvements you want each month.
- Hosting model — managed platforms reduce server work; self-managed servers need more administration.
- Compliance — audit trails, access reviews and security testing add effort.
Retainer, on-demand or time and materials?
| Model | How it works | Best for |
|---|---|---|
| Monthly retainer | Fixed monthly fee for defined tasks plus an hours allowance | Business-critical sites and apps that change regularly |
| On-demand / pay per ticket | Pay only when you raise a request | Simple, stable sites with infrequent changes |
| Time and materials | Billed on actual hours against an agreed rate | Ongoing product development mixed with support |
Even on an on-demand model, make sure someone is responsible for security updates and backups. Those are the tasks that get skipped when nobody owns them.
What your SLA should include
A service level agreement turns "we will look after it" into commitments you can hold a vendor to. Before you sign, check that it covers:
- Severity levels with clear definitions — for example, site down or payments failing versus a cosmetic bug.
- Response and resolution targets for each severity. Response (someone is working on it) and resolution (it is fixed) are different promises.
- Coverage hours and time zone — business hours, extended hours or 24/7.
- How to raise an issue — ticketing system, email, phone or WhatsApp — and who is on call.
- What is excluded — third-party outages, new features, content changes.
- Reporting — monthly summary of updates applied, incidents and time used.
- Access and exit — you keep admin access, code and credentials, with a documented handover if you change provider.
Ownership protects you
Maintain or rebuild?
Maintenance stops being good value when the platform itself is the problem: an unsupported framework version, a codebase nobody can safely change, or performance that cannot be fixed without re-architecture. At that point a phased rebuild usually costs less than patching indefinitely. Our guide to choosing a tech stack covers what to pick when you do rebuild.
Apex IT Solutions offers website maintenance and support, application maintenance and DevOps and server support, scoped to the system and response times you need.
Frequently asked questions
How much does website maintenance cost per year?
A commonly cited rule of thumb is roughly 15 to 20 percent of the original build cost per year. Simple brochure sites can cost much less, while transactional platforms with integrations, user data and compliance needs can cost more. Response-time commitments and the monthly change allowance are the biggest variables.
What is included in a website maintenance plan?
A typical plan includes security patches, framework and dependency updates, backups with restore tests, uptime and error monitoring, SSL and domain checks, performance reviews, bug fixes, and a set number of hours for small changes each month.
What is the difference between response time and resolution time in an SLA?
Response time is how quickly the provider acknowledges an issue and starts working on it. Resolution time is how quickly the issue is actually fixed or a workaround is in place. A good SLA defines both for each severity level.
Do I need maintenance if my website is not changing?
Yes. Even a site that never changes its content relies on software, servers and certificates that need security updates, monitoring and backups. Unmaintained sites become more vulnerable over time.
Can Apex IT Solutions maintain a website it did not build?
Yes. Apex IT Solutions starts with a technical audit of an existing site or application to review the codebase, hosting, security and backups, then proposes a maintenance plan based on what it finds.
Need someone to look after your site or app?
Tell us what you run and the support level you need. We will review it and propose a maintenance plan with clear response times.
Get a free quote Talk to an engineer