Website maintenance is everything that keeps a site online, current, fast, and working after launch: technical updates, backups, outage monitoring, fixes, and small content changes. The word is vague because vagueness suits everyone, some providers included.
The standard reflex among small business owners is simple: the site is delivered, it looks good, it’s live, job done. Except a website is not a printed brochure. It is software plugged into the internet around the clock, dependent on a server, a domain name, a certificate, plugins written by third parties, and a search engine that keeps coming back to see what has become of it.
Which leaves the real questions: what the word actually covers, what it costs in France, what degrades when nobody is watching, and whether you are better off handling it yourself or handing it over.
What is website maintenance?
Website maintenance covers four families of work: technical maintenance (updating the CMS, the plugins, the server, the SSL certificate), corrective maintenance (fixing what breaks), security maintenance (backups, monitoring, patching vulnerabilities), and editorial maintenance (updating text, hours, prices, photos). By default, it does not include a redesign or new features.
Three mix-ups show up in quotes over and over, and they are expensive.
Maintenance is not hosting. Hosting is rent on a server. Maintenance is upkeep on what runs there. A host guarantees the machine answers; it does not guarantee your site works. The official WordPress security guide is explicit about that split of responsibility: when a site is compromised, the cause is rarely the infrastructure and most often the application itself. So the hole is almost always on your side of the line.
Maintenance is not new development. Fixing a broken form is maintenance. Adding an online booking module is development. An honest contract draws that line clearly and bills the second one separately.
Maintenance is not SEO. More on that below, but hold on to this much already: one is the foundation of the other, not a substitute for it.
On our end, that split gets settled during project scoping. That is the whole point of our working method, which separates what gets delivered once from what gets maintained over time.
How much does website maintenance cost per year?
In France, for a small business brochure site, budget somewhere between 60 and 230 euros a year in unavoidable costs if you handle everything yourself, and 30 to 100 euros a month if you hand it to a provider. For a heavier site (e-commerce, booking, multilingual), the outsourced range moves up to 100 to 300 euros a month. One-off work outside a contract usually bills at 60 to 120 euros an hour.
These are ballpark figures observed on the French market, not published rate cards. Here is what sits inside them, line by line.
The costs nobody can eliminate, even doing everything themselves:
- Domain name: roughly 10 to 20 euros a year for a .fr or .com, every year, no exceptions.
- Decent shared hosting: roughly 4 to 12 euros a month, so 50 to 150 euros a year.
- SSL certificate: 0 euros in the overwhelming majority of cases. Let’s Encrypt issues free certificates and most hosts renew them automatically. Paying for an SSL certificate on a brochure site has almost no justification left in 2026.
- Off-site backup: anywhere from 0 to about sixty euros a year depending on whether your host includes it.
The low end matches entry-level shared hosting where the host includes backups; the high end, faster hosting paired with a paid backup service.
What you pay on top if you hand it off: someone’s time, and above all their attention. A 40-euro-a-month maintenance plan does not buy 40 euros of work every month. It buys continuous monitoring and the ability to intervene fast the day something gives out. It is insurance, not hourly labor.
The real budget trap is not the size of the monthly plan, it is the build quote that never mentions one. A brochure site billed at 900 euros with no line for ongoing care is not cheaper than an 1,800-euro site with it: the upkeep will exist anyway, it will simply be paid later, under pressure, and usually for more. We ran the numbers on that mechanism over three years in our breakdown of cheap websites.
For reference, and so we are not vague about our own pricing: at Inleven, the first year runs 12 monthly payments of 49, 89, or 169 euros depending on the plan (or 530, 960, or 1,830 euros paid at once), then 180 euros a year all in, hosting, maintenance, and support included. The details are on the pricing page.
What does a website maintenance contract include?
A serious maintenance contract spells out seven things at minimum: the exact scope of updates, how often backups run and how long they are kept, the response time when the site goes down, what is explicitly excluded, how much content editing is included, what reporting looks like, and what happens to your access and your data if you leave. Any contract that stays fuzzy on those seven points is a contract to renegotiate.
Here is what to insist on in writing, and why each item matters.
1. Update scope. CMS core, plugins, theme, PHP version, server: who touches what. WordPress.org’s recommendation leaves no room for interpretation, you should always be running the latest available version of the software. Someone still has to press the button.
2. Backups, and above all their depth. A backup that overwrites the previous one every night is worthless against a problem found late. The WordPress.org security guide uses a telling example: a site compromised on May 1 may not be discovered until May 12, and only a series of successive backups gives you a restore point from before the infection. The documentation does not set a duration; for our part, we recommend at least 30 days of retention, files and database.
3. Restore testing. A backup that has never been restored is a hypothesis, not a safety net. Ask how often it gets verified.
4. Response time. Within 4 business hours or within 5 days is not the same promise, or the same price. Get the number written down.
5. Exclusions. Visual redesign, new features, copywriting, ad campaigns: fine that they are excluded, not fine that they go unnamed.
6. Reporting. A summary, however short, however quarterly. With nothing in writing, you are paying for monitoring you cannot verify.
7. The exit. Who owns the domain, the hosting, the code, and the backups, and how fast do you get them back. It is the most important question in the contract and the one people ask least. Our commitment on that point is public, on the portability page.
What happens if you do no maintenance at all?
A site with no maintenance does not go dark all at once: it degrades. In order of frequency: the content goes stale, a form quietly stops working, Google rankings erode, an outdated plugin opens a hole. The dramatic hacking scenario does exist, but it is rarer than the slow loss of commercial effectiveness, which is close to universal.
Let’s start with the least dramatic, because it is the most common.
Stale content. Closing hours from two summers ago, prices you no longer charge, a team member who left eighteen months back, a phone number that changed. No technical alert ever fires for any of it. And yet it is the number one reason a brochure site loses customers.
The dead form. A change of host, an updated plugin, or a forwarding email address that got shut off, and messages vanish into nothing. Nobody tells you: your prospects think they wrote to you, you think nobody is asking. Hence the monthly test, more reliable than blind faith.
The expired SSL certificate. It renews automatically with most hosts, right up until the day renewal fails silently (a DNS change, a migration, a domain pointing to the wrong place). Visitors then hit a full-screen security warning. The site is not broken, but nobody is getting in anymore.
SEO erosion. It runs on two tracks. On one side, Google has to be able to reach your site exactly the way your visitors’ browsers do, as its SEO starter guide points out (“Google needs to be able to access the same resources as the user’s browser”). Blocked CSS, intermittent server errors, or URLs duplicated by a bad configuration all degrade crawling. On the other, a frozen site stops sending signals: Google explains that the vast majority of new pages it discovers each day reach it through links. An abandoned site feeds nothing anymore, no content, no links.
Vulnerabilities. This is the part that makes people anxious, so let’s stick to published numbers. The 2023 Sucuri hacked website report, published in June 2024 and built from the 39,594 sites its teams cleaned, found that 39.1% of the CMS applications analyzed were out of date at the time of infection, and that 13.97% of compromised sites still had at least one vulnerable component when remediation happened. In other words, missing updates are not the only cause of infection, but they are a huge and entirely avoidable factor.
Two numbers from the same report deserve a business owner’s attention more than the ones about exotic malware. First, 49.21% of compromised sites contained at least one backdoor: an untreated infection leaves a permanent way in, it is not a one-off incident. Second, 20.30% of infected sites contained SEO spam, and 38.3% of compromised databases contained it as well. That is the direct link between security and search: a hacked site does not just become dangerous, it starts hosting pages that tank its credibility in Google’s eyes.
On the fundamentals, the WordPress documentation frames it better than anything else we have read: security is risk reduction, not risk elimination. Nobody can promise you zero risk. The Google Threat Intelligence Group counted 75 zero-day vulnerabilities exploited in the wild in 2024, after 98 in 2023: holes used before a patch even exists. The goal of maintenance, then, is not to make a site unbreakable, but to shrink the attack surface and, above all, to be able to roll back cleanly.
Website maintenance: do it yourself or hand it off?
Doing it yourself is perfectly defensible for a simple brochure site, on three conditions: having an automatic backup you can actually restore, knowing how to get the site back online after a failed update, and keeping a steady rhythm. Handing it off makes sense as soon as downtime costs you business the same day, as soon as the site takes payments, or simply when you would rather this not be your problem. It is not a question of competence, it is a question of trade-offs.
What doing it yourself really costs. The main line item is not money, it is attention. On a WordPress brochure site, a serious routine runs about one to two hours a month: check available updates, apply them after backing up, confirm nothing shifted visually, test the contact form, check Search Console. That is not much. The problem is that it is never urgent, so it is always pushed back, and the decay only shows up several months later.
What handing it off does not buy you. A monthly plan does not replace your knowledge of your own business. Nobody on the outside will know your prices changed, that you no longer take Saturday callouts, or that your new partner needs to appear on the team page. Editorial maintenance stays a conversation, not an automation.
Three questions to settle it, honestly:
- If your site goes down on a Tuesday morning, how long can you wait before it becomes a money problem? If the answer is measured in hours, hand it off.
- Could you restore a full backup, files and database, without help? If not, hand off at least the backup side.
- In the last six months, have you kept up any monthly routine at all on something that pays nothing in the short term? Answer honestly, it is the best predictor there is.
For a tradesperson out on job sites all day, the third question usually settles itself; that is exactly why we treat website design for tradespeople separately, where ongoing care matters more than the design.
What are the signs a site needs maintenance?
The signals are not subtle. A piece of information on a page that is now false, a form you are no longer sure delivers, a security warning shown by the browser, a site visibly slower than it used to be, pages that no longer come up in Google, a dashboard buried in pending updates, a wave of spam in comments or signups, a last content edit more than twelve months old: any one of those symptoms is enough to trigger a look, and none of them requires an expert diagnosis. You just have to check.
Three simple checks, ten minutes, no paid tools.
Test your form for real. Send yourself a message from your own site, using an address outside your company, and check both the inbox and the spam folder. Once a month. It is the highest-return check on this list.
Confirm your pages are indexed. Google explicitly recommends the site: operator for this: type site:yourdomain.com into search. If your main pages do not show up, you have a technical problem, not a content problem.
Open Search Console. The tool is free and it is Google’s own reference, presenting account setup as the way to track and improve a site’s performance in search. Crawl errors and click drops show up there before you feel them commercially.
Does maintenance include SEO?
No, not by default. A standard maintenance contract covers the technical health of the site, which is the foundation of SEO, but not the SEO work itself: keyword research, content creation, link building, page optimization. Some providers fold in a minimal SEO layer (indexing monitoring, technical fixes); that is good practice, but it needs to be written down, not assumed.
The line is easy to draw. Maintenance: 404 errors after a page change, load times getting worse, a broken robots.txt file, duplicate URLs. SEO: deciding which queries to target, writing the pages that answer them, and earning links.
One clarification that heads off a lot of misunderstandings with providers: the effects of a fix are never immediate. Google says some changes show up within hours and others take several months, and recommends waiting several weeks before judging the impact of a change. Anyone promising you a jump in rankings ten days after a technical fix is selling something other than SEO. If the topic interests you beyond maintenance, it has its own page: SEO and GEO.
WordPress maintenance: different needs than other CMS platforms?
Yes. WordPress demands more active maintenance than other solutions, for a structural reason: it is software you host yourself, whose core, theme, and every plugin update separately. On a hosted platform like Wix, Squarespace, or Shopify, the vendor applies technical updates for you; on a custom static site, the attack surface is far smaller.
The most-quoted number deserves context: in that same Sucuri report, WordPress accounts for 95.5% of detected infections, ahead of Joomla (1.7%) and Magento (0.6%). That does not prove WordPress is inherently more fragile: the CMS powers an overwhelming share of the web, so it mechanically absorbs the attacks. What it does prove is that maintaining a WordPress site is not optional.
The specific checkpoints, all documented by WordPress.org:
- Plugins. Keep them updated, and above all delete the ones you no longer use. A deactivated plugin is still code sitting on the server. The Sucuri report notes, for that matter, that 4.18% of compromised sites were hosting at least one fake plugin.
- The admin account. Avoid generic usernames like “admin” or “webmaster,” target number one for brute-force attacks.
- Two-factor authentication. The documentation explicitly recommends it as an added security measure.
- The admin file editor. Add
define( 'DISALLOW_FILE_EDIT', true );to wp-config.php, which per the documentation is the equivalent of removing the ability to edit themes, plugins, and files from the back end. - File transfers. Use SFTP rather than FTP: your password never travels in the clear.
- Permissions. 644 for files, 755 for folders, and wp-config.php at 400 or 440.
- Backups. Regular snapshots covering both the WordPress core files and the database.
None of this is beyond a methodical user. All of it requires remembering to do it.
What we do about it, and what you can do
There is no single right answer. Someone technically comfortable, with a simple brochure site and a reliable automatic backup, can absolutely handle maintenance alone for the price of a domain and hosting. Someone whose site brings in quote requests every week is better off having somebody else handle it, and knowing exactly what that covers.
Our stance at Inleven is to have removed the question: the build and the ongoing care are not two contracts, they are the same one. Year one is the project: you pay it in 12 monthly installments or all at once. After that, 180 euros a year, renewed automatically each year and cancellable by written notice, effective at the end of the current annual term. Updates, hosting, backups, and routine content changes are in there. It is one option among others, not the only good one: the upside is a predictable total cost, the downside is that year one is owed in full, even when paid in 12 installments.
To go further depending on what concerns you: the details of the plans and what they cover are on the pricing page, the full walkthrough of a project on the method page, and the exact contents of our ongoing care on the website maintenance page. If your issue is budget first, start instead with our analysis of the cheap website.
