·April 21, 2026 9 min read

Website Maintenance Cost: Retainer vs SLA vs Hourly

What website maintenance includes, how hourly, retainer and SLA models compare, what a support SLA should define, and what really drives the monthly cost.

Website maintenance cost depends less on the size of the site than on how the work is bought. With hourly billing you pay only for tasks that get done. A monthly retainer buys reserved capacity plus routine care, and an SLA adds guaranteed response and resolution times. Most small and mid-sized businesses with a marketing site or online store find that a modest retainer covering updates, backups and monitoring is the cheapest option over a year, because it prevents the expensive emergencies that hourly-only clients end up paying for.

What website maintenance actually includes

"Maintenance" is one of the vaguest lines on any proposal. Before you compare prices, make sure you are comparing the same scope. A complete maintenance scope usually covers:

Updates and security patches for the CMS, themes, plugins, apps and server software, tested on a staging copy before they reach production.
Backups on a schedule, stored off the server, with restores actually tested rather than assumed to work.
Uptime and error monitoring, so someone knows the site is down before a customer emails about it.
Performance: Core Web Vitals, image weight, caching, and the third-party scripts that pile up over time.
Small content and design changes: new landing pages, banners, team bios, price updates, a new section on an existing template.
Bug fixes: broken layouts after a browser update, a checkout step that fails, a form that stops delivering leads.
Renewals of hosting, domains and SSL certificates, plus the DNS and email records that depend on them.
Accessibility and legal updates: WCAG fixes, cookie consent, privacy policy changes and making sure the tracking setup matches them.

Renewals deserve a special mention. Under the CA/Browser Forum schedule, public SSL certificates issued on or after March 15, 2026 are valid for at most 200 days. The limit drops to 100 days in 2027 and 47 days in 2029. Certificate renewal is becoming a frequent recurring task, so automating it is now part of basic upkeep.

Hourly, retainer or SLA: the three engagement models

Almost every maintenance offer fits one of three models, or a mix of them.

Hourly or a block of hours. You pay for time spent, either as you go or by prepaying a bank of hours that gets drawn down. It works well for stable sites with rare, predictable changes. The weak spots are that nobody is responsible for anything between requests, urgent work goes into the vendor's general queue, and each request starts with the developer re-learning the site.

Monthly retainer. A fixed monthly fee covers a defined set of routine tasks (updates, backups, monitoring, reporting) plus a number of hours for changes. You get a team that knows the codebase, a predictable budget, and proactive work instead of firefighting. The risks are paying for unused hours if the retainer is too large, and arguing over scope if "small changes" is never defined.

SLA (service level agreement). An SLA is a contract layer that turns "we'll take care of it" into measurable commitments. It sets how fast the vendor responds, how fast incidents are resolved, which hours are covered and what uptime the site should achieve. It is usually attached to a retainer rather than sold on its own. It costs more because the vendor has to keep people available. For a store or a lead-generation site, where an hour of downtime costs real money, that availability is what you are buying.

Criteria	Hourly / block of hours	Monthly retainer	SLA
What you pay for	Time actually spent	Reserved capacity and routine care	Guaranteed availability and response
Budget predictability	Low	High	High
Proactive updates and monitoring	Only if requested	Included	Included and reported
Speed in an emergency	Best effort	Priority queue	Contractual response times
Knowledge of your site	Rebuilt each time	Kept by a steady team	Kept and documented
Best fit	Simple, rarely changed sites	Active marketing sites	Revenue-critical sites and stores

What a website support SLA should define

An SLA that only says "response within 24 hours" is close to useless. A workable website support SLA spells out the following:

Severity levels. A typical split: critical (site down, checkout or lead forms broken, security breach), high (a key feature degraded), normal (a bug with a workaround) and low (cosmetic issues and change requests). Each level gets its own targets.
Response time vs resolution time. Response means a qualified person has acknowledged the issue and started on it. Resolution means it is fixed or a workaround is live. Some vendors promise fast responses and say nothing about resolution, so ask for both.
Coverage hours. Business hours in which time zone, plus weekends and holidays. A 2-hour response that only runs Monday to Friday does not help when your store breaks during a Saturday sale.
Uptime target and how it is measured. Which monitor, which URLs, how often it checks, and whether planned maintenance windows count as downtime.
Exclusions. Outages at the hosting provider or a third-party service, problems caused by changes your own team made, new feature work. Exclusions are normal as long as they are written down.
Reporting. A monthly summary of updates applied, incidents and their timelines, uptime, backups and hours used, so you can see what the fee bought.
Escalation and remedies. Who to contact when a target is missed, and what happens next, such as service credits or a formal review.

The hidden costs of no maintenance

The real comparison is not "retainer vs nothing". It is "retainer vs the cost of what goes wrong without one".

Security incidents. Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025. 91% were in plugins, and 46% had no patch available when they were disclosed. For heavily targeted flaws, Patchstack puts the weighted median time to first exploit at about five hours. A site that gets updated "whenever someone remembers" stays exposed for weeks. Cleaning up after a breach almost always costs more than a year of preventive work: malware removal, restoring from a clean backup, and dealing with blacklists and spam warnings in search results.

Broken forms losing leads. This is the most common silent failure we see. A form keeps showing "Thank you", but the email notification, CRM integration or webhook behind it stopped working. Typical causes are an update, an expired API key or a change in an email provider's authentication rules. Nobody notices until sales asks why inquiries dried up. Monitoring that submits a test lead and checks that it reaches the CRM catches this within hours instead of weeks.

Plugin and app conflicts. Unmaintained sites accumulate outdated extensions until a single update breaks the layout or the checkout. The longer updates are postponed, the bigger and riskier the eventual jump, and the more likely it turns into a paid rebuild of part of the site.

Slow decay. Pages get heavier, tracking scripts pile up, content goes stale and accessibility issues accumulate. None of it is an emergency, but together it wears down conversion and search visibility.

What drives website maintenance cost

Published price ranges for website maintenance vary widely and come mostly from vendors' own estimates, so they make poor benchmarks. It is more useful to understand what moves the price up or down:

Platform and stack. A hosted builder or a Shopify store needs less server-level work than a self-hosted WordPress site with dozens of plugins. A custom application needs more.
Number of integrations. Every connection to a CRM, payment provider, ERP or marketing tool is another thing that can break when either side changes.
Revenue at risk. A store or lead-generation site justifies faster response and wider coverage hours than a brochure site.
Change volume. How many content and design requests your marketing team produces each month.
Response expectations. 24/7 coverage and short resolution targets require on-call staff, which is the biggest cost driver in any SLA.
Technical debt. Outdated versions, no staging environment and no documentation slow down every task until they are fixed.

When you compare quotes, line them up by scope, included hours, response targets and reporting, not just by the monthly number.

Taking over a site from a previous vendor

Many businesses start looking for maintenance after their developer disappears or the relationship ends. A clean handover protects you, and a good new vendor will insist on one:

Access. Make sure you, not the vendor, own the domain registrar account, hosting, DNS, CMS admin, code repository, analytics, tag manager, email sending service and every third-party integration. Keep credentials in a password manager and revoke the previous vendor's access once the transfer is complete.
Documentation. Ask for a list of plugins and custom code, deployment steps, integrations and where their API keys live, scheduled jobs and known issues. If none of this exists, writing it becomes the first task.
Audit. Before committing to a fixed fee, a new vendor should review versions, security, backups, performance, forms and integrations. The output should be a prioritized list of what is urgent, what can wait and what a fair monthly scope looks like after cleanup.

The Itelmen team handles this as a separate step through project takeover: access transfer, a technical audit and a stabilization plan, after which the site moves into regular maintenance.

How to choose: a practical decision rule

Start from what an outage would cost you, not from the price list.

Hourly or a block of hours if the site is simple, changes a few times a year, has no checkout or critical integrations, and a day of downtime would be an inconvenience rather than a loss.
A monthly retainer if marketing changes the site regularly, forms feed a CRM, or you rely on several plugins and integrations. Most small and mid-sized businesses land here, and a website maintenance plan with updates, backups, monitoring and a monthly hours allowance usually pays for itself.
A retainer with an SLA if the site takes orders, runs paid traffic or is your main source of leads, so every hour offline has a measurable cost. Get severity levels, response and resolution targets and monthly reports in writing. Our support and maintenance engagements are built around exactly these terms.

Whatever model you pick, review it after three to six months. If hours consistently go unused, scale the retainer down. If you keep buying extra hours, the scope is too small, and a larger plan will usually cost less than the overage.

FAQ

Questions & answers

There is no reliable industry-wide figure: published ranges come mostly from vendors' own estimates and differ by an order of magnitude. The price is driven by the platform, the number of integrations, how much content changes each month and how fast you need incidents handled. Compare quotes by scope, included hours and response targets rather than by the headline fee.

A retainer defines what work is done and how much capacity is reserved each month. An SLA defines how fast and how reliably that work happens: response and resolution times by severity, coverage hours and an uptime target. In practice an SLA is usually layered on top of a retainer.

It depends on the contract, so ask before signing. Some vendors allow a limited rollover into the next month, others treat the hours as reserved capacity that expires. If you regularly leave hours unused, the better fix is a smaller plan rather than a growing balance.

Yes, though less at the server level. The platform handles hosting and core security, but apps, theme code, integrations, tracking, content and checkout customizations still change and break. Monitoring of forms, payments and key pages is just as relevant as on a self-hosted site.

The number matters less than how it is measured and what is excluded. Make sure the SLA names the monitoring tool, the pages checked and whether planned maintenance and hosting provider outages count. Remember that the uptime of a managed host is often outside your maintenance vendor's control.

Services