Website Maintenance: What It Covers and What Costs Extra

In the narrow sense, website maintenance is the technical upkeep after launch: updating software, taking backups, watching whether the site is up and closing security holes. There is no standard definition of what a maintenance contract contains. Every provider sets its own scope.

Hosting, content edits and new features are separate services. They are often billed on top, or not part of the agreement at all, and that is where most disappointments start.

Whether you need maintenance depends mainly on how your site is built. A self-hosted WordPress site needs regular updates. On a hosted website builder, the platform usually handles most of that for you.

What maintenance can include, and what usually sits outside it

The table separates typical maintenance tasks from neighbouring services. The last column is the question to put to your provider for each row.

Treat this as orientation. Your contract may handle any row differently. What matters is that every row is handled somewhere.

Why updates are not optional

Many sites run on a content management system (CMS), software that lets you edit pages without writing code. Germany's Federal Office for Information Security (BSI) notes that widely used CMSs attract attackers because vulnerabilities are regularly found in the systems and their plugins, and an outdated CMS can let an attacker change the site at will.

The BSI's recommendations for website operators include:

• update the operating system, CMS, plugins and extensions regularly, using automatic security updates where possible,
• uninstall software, plugins and extensions you do not need,
• change default logins, use strong passwords and consider multi-factor authentication,
• take regular backups of site content and database, and check that they actually work.

For web applications in general, the BSI calls adequate vulnerability and patch management particularly important. WordPress's own hardening guide says the same in practical terms: keep core and plugins updated, delete plugins you do not use and back up regularly.

A recent case shows why timing matters. On 20 July 2026 the BSI updated a warning about two WordPress vulnerabilities that, combined, allowed unauthenticated attackers to run code. WordPress had announced an update on 17 July 2026, and the BSI reported first signs of exploitation. Sites with nobody responsible for updates were exposed.

Do you actually need a maintenance contract?

It depends less on the size of your business than on the technology behind the site.

With a website builder, technical upkeep is part of the monthly plan, so an extra contract is rarely needed. With a self-hosted or custom site, the responsibility is yours: either you do it, or you agree it with someone. For the bigger choice between these routes, see Website builder or web developer?.

What typically costs extra

Even with a maintenance contract, some work is billed separately. Budget for it:

• hosting and domain, unless explicitly included,
• content edits beyond any agreed allowance,
• new pages, new features and redesigns,
• major version changes, when a system or plugin is fundamentally rebuilt,
• recovery after an attack, unless agreed in advance,
• relaunch or migration to new technology or new URLs. What matters for search visibility during that step is covered in planning a website redesign.

How build costs and running costs fit together over the first year is covered in How much does a small business website cost in Germany?.

Checklist: review a maintenance agreement

Go through these points before you sign. Every "not sure" is a follow-up question.

• Which software is updated, and how often?
• Is the site checked after updates (forms, navigation, layout)?
• How quickly are critical security holes closed?
• How often are backups taken, where are they stored, and is restoring tested?
• Who notices an outage, and how will you be told?
• Is hosting included, or is it a separate contract?
• Are content edits included, and how many?
• How is work outside the scope billed?
• What happens in an emergency, such as after an attack?
• How long does the contract run, and how do you cancel?
• Do you keep the logins for hosting, domain and CMS if you switch provider?
• In which language is the agreement, and can you read it fully?

If you want to maintain the site yourself

A small site can be maintained in-house if you set aside the time. Pick a fixed date each month, install updates, then check the key pages and the contact form, and confirm that the latest backup is complete. Subscribe to your system's security announcements, or to the CERT-Bund warning service that the BSI points to.

Technical maintenance at Ichii

Ichii offers technical maintenance from €29 per month. It is charged separately from the build, and the scope is agreed individually with you.

Next step

Run the checklist against your current agreement or quote and note the gaps. If you want to arrange technical maintenance for your site, the details are on the technical maintenance page. If you use a website builder and are happy with it, you usually do not need an additional contract.