Website maintenance: what it covers, what it costs and why no site is ever free

Website maintenance is everything a site needs after launch to stay online, safe and accurate: software updates, backups, security checks, renewals and content changes. A website is closer to a car than to a printed brochure. It runs on software that keeps changing, on a domain and a plan that renew every year, and on details such as prices and opening hours that go out of date.

Every client who has called me in an emergency called about a WordPress site, the platform that needs the most upkeep. Upkeep also sits behind one of the early mistakes I warn founders about: building a website for free for a friend or a relative, with no plan for who will look after it.

This guide covers what maintenance includes on each platform, what it costs, what changes in 2026 and 2027, and a schedule you can follow. It is part of my guide to small business websites.

What website maintenance covers

Website maintenance comes down to five jobs. The platform decides who does each one, but none of them disappears.

Google helps with part of the checking. Search Console warns you when Google finds a security issue on your site (Google’s help on the Security issues report), and its Pages report lists the pages Google has not indexed, with the reason.

Website maintenance on WordPress, Squarespace and custom-coded sites

What changes from one platform to another is how many of them land on you.

WordPress: the platform that needs the most upkeep

WordPress itself is free and solid. The upkeep comes from what sits around it: a theme, often a page builder, and plugins for forms, SEO, caching or security, each updated by a different developer. Patchstack, a company that specialises in WordPress security, counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 42 per cent more than in 2024, and about 91 per cent of them were in plugins (Patchstack’s 2026 report). Every plugin you add is one more thing to update.

Updates carry their own risk: one can clash with the theme or with another plugin, and the layout breaks. All my WordPress clients came to me wanting to switch, because of the learning curve and the plugins to keep up with. People who edit their own site should not have to fear that changing one letter will bring the whole page down.

WordPress does part of the work: by default, it installs minor core releases (maintenance and security) by itself, and on the Plugins screen each plugin has an Enable auto-updates link. Tools > Site Health flags problems such as an outdated PHP version or inactive plugins you should delete. Automatic updates save time; they do not replace the check afterwards.

When a WordPress site does break, the bill arrives all at once. Pilotech, an HVAC installer near Paris, called me in an emergency when its WordPress site was hacked: I recovered it and built a new one, and two years on I still build its websites, such as the site that brings its three product lines together. WordPress remains a sound choice when the budget is there: my clients in that position keep it and can hire a specialist to look after it every month. If yours has already been hacked, follow my checklist for a hacked WordPress site.

Squarespace: the platform does the heavy lifting

On Squarespace, the hosting, the SSL certificate, the security patches and the platform updates are included in the subscription. With no plugins to update, most of the software side disappears. My Squarespace vs WordPress comparison goes through the other differences.

What remains is yours: the content, the renewals, a strong password with two-step verification, and any custom code. I usually add some code to the Squarespace sites I build: clients call me for that part, and nothing I add is destructive. Everything else they change whenever they want, without calling anyone, which is why I move owners who run their own site to Squarespace.

The trade-off is control. Squarespace is closed: you have no access to the source code, and you cannot move the site to another host.

Custom-coded and AI-built sites

A custom-coded site has no plugins to patch, but it still has code libraries, a host and a domain, and every change to the layout or the features needs someone who can edit the code. The clients I build custom sites for pay me every month, or now and then when they want something changed.

A simple brochure site that you build with AI and host on GitHub Pages costs very little to run, but it makes you the maintainer: the code, the domain and every change are yours. GitHub Pages has limits too: it suits a brochure site, not a shop.

Two changes to plan for in 2026 and 2027

SSL certificates now expire sooner

Your site’s HTTPS connection, the padlock some browsers show next to your address, depends on an SSL certificate (strictly speaking, a TLS certificate). Since 15 March 2026, a newly issued public certificate can be valid for at most 200 days, down from 398. The limit falls to 100 days on 15 March 2027 and to 47 days on 15 March 2029, under a schedule agreed by the CA/Browser Forum, the body of certificate authorities and browser makers that sets these rules (its Baseline Requirements, section 6.3.2).

If your site is on Squarespace, or on a host that installs free Let’s Encrypt certificates automatically, nothing changes for you: those certificates already last well under 200 days and renew on their own. If someone installed a paid certificate by hand, ask your host or your developer to automate its renewal. An expired certificate shows visitors a full-page security warning instead of your site.

PHP 8.2 loses its security fixes on 31 December 2026

WordPress runs on PHP, the programming language your host installs on the server. Each PHP version gets two years of full support, then two years of security fixes only. PHP 8.1 reached its end of life on 31 December 2025, and PHP 8.2 stops receiving security fixes on 31 December 2026 (PHP’s supported versions page).

On WordPress, the version shows in Tools > Site Health, on the Info tab under Server; your hosting control panel shows it too. Before you switch to a newer version, take a backup and check that your theme and plugins support it, because one old plugin that fails on the new version can take the whole site down.

What website maintenance costs

I found no independent survey of maintenance prices: the figures that come up online are agencies’ own price lists. So rather than an average, here is what you actually pay for.

Running costs come back every year whatever you do: the domain name, the hosting or builder plan, and business email. My guide to how much a website costs in the UK gives current prices for a domain, a Squarespace plan and a business mailbox. Watch the renewal prices more than the introductory offers.

The work costs your time or someone else’s, and there are three ways to pay for it:

The risk is the cost of skipped maintenance: an emergency repair or a rebuild, the enquiries lost while the site is down, and Google’s “This site may be hacked” label under your search result. It is the one line you cannot budget for, which is why the first two are worth paying.

Before you sign a maintenance plan, ask:

1. Which updates are included, how often, and is the site checked afterwards?
2. Where are the backups stored, for how long, and when was a restore last tested?
3. How quickly do you answer when the site is down?
4. How many content changes are included each month?
5. Is repairing a hack included, or billed separately?
6. Whose name are the accounts in, and what happens if I stop the plan?

Why a free website is never free

Building a website for a friend or a relative looks like a generous gift. But a website is not a one-time gift: if you give one, you give maintenance for life, unless you agree in advance that upkeep will cost something. And because the work is free, the requests never stop: a new photo, a new page, a different colour, one small change on a Sunday evening.

There is one exception: a Squarespace site without heavy custom code. It is the easiest website builder I know, and the person you build it for can change things themselves. Because Squarespace is closed, custom-coded, Webflow or WordPress sites might rank higher. Yet the Squarespace site I built for Pilotech ranks first or second on Google: with the right keywords and careful metadata, you give yourself every chance.

If you build a site for someone anyway, put three things in writing before you start:

1. What is included at launch, and what counts as a change afterwards.
2. What upkeep costs: a price per change, a monthly fee or a yearly allowance.
3. Who pays the renewals, and whose name the domain and the accounts are in (theirs).

If you are on the receiving end, ask the same questions now. If the person who built your site still holds the logins and no longer answers, my guide on how to regain access to your website explains how to get them back.

Your website maintenance checklist

For passwords, two-step verification and the rest of the security side, my guide to website security for small businesses goes further. When your tools change, check what your privacy policy must say and what your cookie banner must do.

When to do it yourself and when to hand it over

You do not need me, or anyone, to maintain a Squarespace site you edit yourself. The monthly and yearly lines of the checklist are enough, and you can call someone for custom code or when something breaks.

Hand it over when:

• the site runs on WordPress, brings in business, and nobody has time to update it every week;
• it is custom-coded and you need changes to the layout or the features;
• it has been hacked, or the same problem keeps coming back;
• you no longer know who holds the domain, the hosting or the logins.

When something goes wrong on a client’s site, I help first and they pay me later. Rescue requests get an answer the same day or within 24 hours. And if someone else would suit you better, or you do not need help at all, I will tell you so.