Website Maintenance Cost & Checklist for Indian Businesses

Website maintenance in India costs Rs 2,500-10,000 per month for a typical WordPress business site, Rs 8,000-25,000 for an ecommerce store and Rs 10,000-30,000 for a custom-coded web application, before 18% GST and excluding hosting. Those ranges come from comparing five Indian agency price guides published in 2026 (Aarav Infotech, Prateeksha, Crisant, Redpulse Software and SJ Online Solutions) against what we quote at Codingclave in Lucknow, where we have built and looked after websites since 2017.

The price is the easy part. The harder questions are what the money should buy, which tasks need doing weekly versus yearly, and what breaks when you skip it. This guide answers all three, with a component-level cost table you can use to check any quote you receive.

What website maintenance actually includes

Maintenance is the recurring human work that keeps a finished website secure, fast, accurate and reachable. It is separate from hosting (the server) and from redesign (new build work). A complete plan covers six areas:

1. Software updates: CMS core, plugins, themes, framework packages, PHP or Node runtime.
2. Backups: automated, off-site, retained for at least 30 days, and test-restored.
3. Security: malware scanning, firewall rules, login hardening, SSL/TLS renewal.
4. Monitoring: uptime checks, form-delivery checks, error logs, Search Console alerts.
5. Performance: Core Web Vitals, image compression, caching, database cleanup.
6. Content and compliance: text and image edits, legal page updates, broken-link fixes.

Most cheap plans cover items 1, 2 and 4 with automation and nothing else. Most expensive plans bundle in things that are not maintenance at all (SEO content, ad management, redesign hours). When you compare quotes, map each one against these six areas first.

How much does website maintenance cost in India in 2026?

The table below is the range I see across the Indian guides named above and our own quoting. The spread inside each row is driven by how many content-edit hours are included and how fast the provider promises to respond.

Website type	Monthly cost (ex GST)	Annual (AMC) equivalent	What is usually included
Static brochure site (5-10 pages, no CMS)	Rs 1,500-5,000	Rs 18,000-60,000	Hosting checks, SSL, backups, 1 hour of edits
WordPress business site	Rs 2,500-10,000	Rs 30,000-1,20,000	Core/plugin updates, security scan, backups, uptime, 2-3 hours of edits, monthly report
WooCommerce or Shopify store	Rs 8,000-25,000	Rs 96,000-3,00,000	Above plus payment gateway and checkout testing, product updates, speed work
Custom Next.js / React / Laravel app	Rs 10,000-30,000	Rs 1,20,000-3,60,000	Dependency updates, server patching, error monitoring, bug fixes, developer hours
Enterprise / high-traffic	Rs 50,000-1,20,000+	Rs 6,00,000+	Dedicated engineer, 24/7 response SLA, staging pipeline, compliance reporting

Two things the table does not show. First, GST: every figure above attracts 18% on the invoice, so Rs 6,000 becomes Rs 7,080. Second, hosting, domain and third-party tools are billed separately in almost every plan; the next section prices those.

If you are also budgeting for a new build rather than upkeep, our website cost guide for India covers the one-time side.

What each component of maintenance costs, with named vendors

Here is where the money inside a plan actually goes. Prices are from each vendor's public price list in 2026; USD items are billed in dollars and move with the exchange rate.

Component	Typical 2026 price	Source and notes
Shared or business hosting	Rs 249-649/month	Hostinger India Unlimited plan: Rs 249/month on a 48-month term, renews at Rs 649/month (hostinger.com/in price list, October 2026). Budget for the renewal price, not the headline.
Managed WordPress hosting	USD 30-35/month	Kinsta single-site plan: USD 35/month, or USD 30/month on annual billing (kinsta.com/pricing, October 2026); WP Engine is in the same band
Domain renewal (.in)	Rs 899/year	Hostinger India renewal price, October 2026
Domain renewal (.com)	Rs 1,499/year	Hostinger India renewal price, October 2026
SSL/TLS certificate	Free	Let's Encrypt, 90-day certificates with automated renewal
CDN and WAF	Free to USD 20/month	Cloudflare Free plan is USD 0; Pro is USD 20/month billed annually
Uptime monitoring	Free	UptimeRobot Free: 50 monitors at a 5-minute interval
Off-site backup service	USD 70-99/year	UpdraftPlus Premium Personal USD 70/year for 2 sites (teamupdraft.com, October 2026); BlogVault Personal USD 99/site/year list price, often discounted
WordPress firewall and scanner	USD 149/year	Wordfence Premium per site; the free version does the same scan with a 30-day delay on new rules
Business email	Rs 99-270/user/month	Google Workspace Base and Starter plans, India price list October 2026, plus GST; Zoho Mail Lite is the usual cheaper alternative
Developer or admin time	Rs 800-2,500/hour	Indian freelancer to agency rates; this is the line that varies most

Add it up for a typical WordPress business site: hosting Rs 649, domain Rs 75 (amortised), backups and firewall around Rs 1,600 (USD 219/year amortised), email Rs 198 for two users, and 3 hours of skilled time at Rs 1,200. That is roughly Rs 6,000/month, which is why a credible Indian quote for this kind of site lands between Rs 5,000 and Rs 8,000 and not at Rs 999.

Website maintenance checklist: weekly, monthly, quarterly, annual

This is the checklist we run. Times are what the task takes when done properly, not when skimmed.

Weekly

Task	Time	Why
Check uptime report and error logs	5 min	Catch outages and PHP errors before a customer does
Submit the contact form and confirm the email arrives	5 min	Form delivery is the most common silent failure
Confirm the automated backup ran and is off-site	5 min	A backup job that fails quietly is the same as no backup
Apply security releases for CMS core and plugins	15-30 min	Patchstack recorded a median of about five hours from disclosure to mass exploitation on the most-abused 2025 flaws
Review Search Console for new crawl or security issues	10 min	Google flags hacked content and indexing drops here first

Monthly

Task	Time	Why
Apply feature updates for plugins, themes and core on staging, then live	45-60 min	Updates break things; staging catches it
Run PageSpeed Insights on the home page and top landing page	15 min	Core Web Vitals thresholds: LCP 2.5s, INP 200ms, CLS 0.1
Full malware scan plus file-integrity check	10 min	Wordfence or Sucuri; compare core files against the official hash
Test every form, checkout and payment flow end to end	20-30 min	Gateways retire old integration methods and SDK versions; the checkout that worked last month is not guaranteed to work this month
Review analytics for traffic drops or spam referrals	20 min	A sudden drop often means a technical fault, not a marketing one
Make queued content edits	1-3 hours	Prices, team, hours, offers
Broken-link crawl	10 min	Screaming Frog free tier covers 500 URLs

Quarterly

Task	Time	Why
Restore the latest backup to a staging server and click through it	1-2 hours	An untested backup is a hope, not a plan
Remove unused plugins, themes and admin users	30 min	Every inactive plugin is still attack surface
Review PHP or Node version against the vendor support calendar	15 min	PHP 8.2 reaches end of security support on 31 December 2026 (php.net supported versions)
Audit image sizes and compress anything over 200 KB	1-2 hours	Images are the usual LCP culprit
Review privacy policy and consent flow against DPDP Rules	30 min	Rules notified November 2025; full compliance due 13 May 2027
Cross-browser and real-device check	1 hour	New iOS and Android releases change rendering

Annual

Task	Time	Why
Confirm domain and registrar contact details, renew for 2+ years	15 min	Expired domains are the most expensive mistake on this list
Rotate all passwords and API keys; enforce 2FA on every admin	1 hour	Includes hosting, CMS, DNS, gateway, email
Full content audit: outdated pages, dead offers, old team members	4-8 hours	Stale pages cost trust and rankings
Hosting right-sizing review	30 min	Traffic grows and shrinks; so should the plan
Full disaster-recovery drill from a cold backup to a new server	2-4 hours	Proves you can survive losing the host entirely
Design and conversion review	2-4 hours	Decide whether next year is maintenance or a redesign

What skipping maintenance costs you

The honest answer is that skipping maintenance works fine for a while, and then costs more in one month than it would have in two years. Three mechanisms drive that.

Security debt compounds. Patchstack's State of WordPress Security 2026 report counted 11,334 new vulnerabilities across the WordPress ecosystem in 2025, up 42% on the previous year. Ninety-one percent were in plugins, 9% in themes, and only six in WordPress core, all low severity. Forty-six percent had no patch available when they were publicly disclosed. The practical reading: your risk is almost entirely your plugin list, and the only defence is a short list that gets updated fast.

Platforms move underneath you. PHP 8.1 lost security support on 31 December 2025 and PHP 8.2 loses it on 31 December 2026, so hosts are force-moving sites to PHP 8.3 and 8.4 through 2026. WordPress 7.0 shipped on 20 May 2026 with a new admin interface and AI features, 7.1 followed on 19 August 2026 and 7.1.2 was a critical security release on 22 September 2026 (wordpress.org/news). Older themes and page builders needed updates to keep working through that run. On the certificate side, the CA/Browser Forum's SC-081 ballot capped TLS certificate lifetime at 200 days for anything issued after 15 March 2026, dropping to 100 days in 2027 and 47 days in 2029. A site with a manually installed certificate and nobody watching it will go dark on schedule.

Recovery is priced as emergency work. The Indian guides I compared quote Rs 8,000-50,000 for a malware cleanup and more if the server has to be rebuilt. Here is the comparison the way I explain it to clients:

Incident	Typical recovery cost	Typical downtime	Prevented by
Malware injection or spam redirect	Rs 8,000-50,000	1-7 days	Weekly updates, firewall, file-integrity scan
Google "This site may be hacked" warning	Rs 10,000-50,000 plus 2-8 weeks of lost traffic	2-8 weeks	Same as above plus Search Console monitoring
Contact form silently broken after PHP upgrade	Lost leads for weeks, then Rs 2,000-10,000 to fix	Until someone notices	Weekly form test
Plugin conflict takes site down	Rs 2,000-10,000	Hours to 2 days	Staging before live, tested rollback
Domain expiry	Rs 5,000-50,000 in redemption fees and lost email, more if someone else registers it	1-30 days	Multi-year renewal, auto-renew, correct contact email
Data breach under DPDP	Penalty up to Rs 250 crore for failing reasonable security safeguards; up to Rs 200 crore for not notifying	Months	Everything above, plus a breach-notification procedure

Set a year of basic maintenance (Rs 30,000-1,20,000 for a WordPress business site) against one of those rows and the decision makes itself.

What Indian regulations require of a maintained website

Two frameworks matter for a business website in India, and both are maintenance tasks, not one-time setups.

DPDP Act 2023 and the DPDP Rules 2025. MeitY notified the Rules in November 2025, with the final set of obligations taking effect on 13 May 2027, eighteen months after notification, for every organisation processing personal data of people in India, regardless of size. If your website has a contact form, a newsletter sign-up, a checkout or a login, you are a Data Fiduciary. The Rules require reasonable security safeguards, breach notification to the Data Protection Board and to affected individuals, and consent notices that match what you actually collect. The penalty schedule tops out at Rs 250 crore for failing to maintain security safeguards and Rs 200 crore for failing to notify a breach. Our DPDP compliance guide walks through what the website itself needs; for maintenance, the recurring tasks are keeping software patched, keeping the privacy notice in sync with your forms, and knowing where every submission is stored.

CERT-In directions (April 2022). Indian entities must report cyber incidents to CERT-In within six hours of noticing them and retain system logs for 180 days within India. For a small business this means your hosting or maintenance provider must keep access logs for six months and you need a written note of who calls whom when a hack is confirmed.

Neither framework is enforced against small firms every week. Both become expensive the day a customer complains or a breach becomes public, and both are far cheaper to satisfy as part of a monthly routine than as a panic.

WordPress maintenance: what to do and in what order

WordPress runs 40.1% of all websites measured by W3Techs (5 October 2026) and the large majority of Indian SMB sites, so it deserves its own section. If you are weighing whether to stay on it, our WordPress vs custom website comparison covers that decision.

Plugins. Keep the active list under 20 and know what each one does. Update security releases within days (see the Patchstack numbers above), feature releases monthly on staging first. Delete, do not just deactivate, anything unused. Before installing a new plugin, check the last update date and active installs on wordpress.org; a plugin untouched for two years is a liability.

Core. Minor releases (7.1.x) are security and bug fixes and should auto-update. Major releases (7.2, 8.0) need a staging test within one to two weeks, longer if you depend on a page builder.

Themes. Use a child theme for customisations so parent updates do not overwrite them. Remove every theme except the active one and one default fallback.

PHP. Check the version in your hosting panel each quarter against php.net's supported-versions page. In October 2026, 8.3 and 8.4 are the safe choices; 8.2 has three months of security support left; 8.1 and below have none.

Database. Limit post revisions, clear expired transients, delete spam and trashed comments, and optimise tables quarterly. WP-Optimize or a WP-CLI cron job handles this in minutes.

Hardening. Change the default admin username, enforce 2FA for every administrator, limit login attempts, disable XML-RPC unless a mobile app needs it, turn off file editing in wp-config.php, and hide the version string. Put Cloudflare in front for the free WAF and bot filtering.

Managed hosting is not maintenance. Kinsta, WP Engine and Hostinger's managed WordPress plans handle PHP versions, server caching, server-level backups and minor core releases. Plugin and theme updates are still yours: Kinsta sells them as a separate add-on at USD 3 per environment per month. Content edits, form testing and broken-link fixes are also outside hosting. Budget both lines.

Maintaining a custom Next.js, React or Laravel site

Custom stacks have fewer attack-surface problems than WordPress (no plugin ecosystem) and more developer-dependency problems (nobody but a developer can update them). The checklist shifts accordingly:

• Dependency updates monthly: run the package manager's audit, update patch and minor versions, test, deploy. Major framework upgrades are planned work, not maintenance.
• Runtime support: Node.js LTS lines get 30 months of support (12 active plus 18 maintenance); Laravel releases get 18 months of bug fixes and two years of security fixes, so Laravel 11 fell out of security support on 12 March 2026. Track both.
• Error monitoring: Sentry or an equivalent so a broken API call shows up as an alert, not a customer email.
• Build and deploy pipeline: a maintained site needs a working staging environment and a one-command rollback. If deploying is a manual FTP job, fix that first.
• Third-party APIs: payment gateways, WhatsApp Business API providers, maps and analytics all deprecate endpoints. Subscribe to each vendor's changelog.

Our own site runs on Next.js for exactly this trade-off: fewer moving parts to patch, but every change goes through a developer. If you are considering the move, read our guide to migrating WordPress to Next.js first, and plan the switch with the website migration SEO checklist so the rankings survive it.

Maintenance or redesign: which one does your site need?

Clients often ask for "maintenance" when the site is actually past saving, and for a "redesign" when a week of maintenance would fix the problem. A quick test:

Symptom	Maintenance fixes it	Redesign needed
Slow pages, images over 500 KB, no caching	Yes	No
Contact form not delivering	Yes	No
Plugin conflicts after every update	Usually	If the theme or builder is abandoned
Mobile layout breaks on current phones	Sometimes	If the theme predates 2020
Site runs PHP 7.x and the theme cannot handle 8.x	No	Yes
Brand, offer or business model has changed	No	Yes
Conversion rate is poor despite healthy traffic	Partly (copy, speed)	Yes if structure is wrong

If three or more rows land in the right-hand column, maintenance is throwing good money after bad. Our website redesign work starts at Rs 25,000 and includes three months of free support, which is also where a proper maintenance plan should start.

DIY, freelancer or agency: who should do the work?

Do it yourself when the site is a brochure, you are comfortable in a hosting panel, and losing the site for a day would not cost you anything. Budget 2-4 hours a month and keep a tested backup before every update.

Hire a freelancer (Rs 2,000-8,000/month in India) when you want someone else holding the responsibility but the site is still low-stakes. Insist on a written scope, a monthly report and shared access to every account in your own name. The real risk is continuity, not skill: freelancers take jobs, move cities and go quiet.

Hire an agency (Rs 8,000-25,000/month) once the site produces leads or sales you would notice losing. You are paying for redundancy, a documented process, monitoring tooling, a written response time and someone to escalate to. Our freelancer vs agency guide goes deeper on when the premium is worth it.

The cost of your own time is the number most owners forget. Four hours a month at even Rs 1,500/hour is Rs 6,000, which buys a standard plan that also covers the risky technical work.

How to compare maintenance quotes and spot a weak provider

Ask every provider the same six questions and write down the answers:

1. Exactly what is included each month? You want a task list, not "security and updates".
2. What is the response time for a down site, and for a non-critical bug? Reasonable: 2-4 hours and 24-48 hours respectively, in writing.
3. Where are backups stored, how often, and when was the last test restore? Off-site, daily for anything with forms or orders, tested quarterly.
4. Do you update on staging first? If there is no staging environment, every update is a gamble.
5. What does the monthly report contain? Updates applied with dates, uptime, backup status, speed score, hours used.
6. Is malware cleanup included or billed separately, and at what rate? Either answer is acceptable; not knowing is not.

Red flags: no written agreement, the same price for every website regardless of size, no mention of staging, backups stored on the same server as the site, and a provider who registered your domain or hosting in their own name.

A quick audit of your current provider: ask for the last 90 days of update logs, the location and date of the newest off-site backup, your uptime percentage, and a PageSpeed Insights screenshot from this week. If those four things do not arrive within 48 hours, you are paying for work that is not happening.

What we see in maintenance work at Codingclave

We are a team of 5-20 in Lucknow, have delivered 200+ projects since 2017, and hold a 4.9-star Google rating from 76 reviews alongside Top Rated status on Upwork. Maintenance is a smaller part of what we do than new builds, which is partly why I am direct about it: the sites that come to us for a rebuild are very often sites that were never maintained, and the rebuild costs five to ten times what the upkeep would have.

A few things our own checklist does that cheaper plans usually skip. We submit every contact form by hand weekly rather than trusting an uptime ping, because a 200 OK page with a dead form is the most common way a small business loses leads without knowing. We restore a backup to staging every quarter and click through it, because a backup that has never been restored is an assumption. And we keep a written access register for every client (registrar, DNS, hosting, CMS, repository, gateway, analytics), in the client's name, so that switching away from us is a handover and not a hostage situation.

Every website we build through our website development service includes 30 days of post-launch support, and our WordPress development clients can move straight onto a monthly plan. After that, maintenance is scoped and priced after a health check of the specific site, because a 6-page brochure and a 400-product WooCommerce store should not cost the same to look after.

Get a free website health check

If you are not sure whether your site is being maintained, or what it would cost to start, contact us for a free health check. We will report back on security status, backup state, PHP and plugin versions, Core Web Vitals and form delivery, and tell you plainly whether you need maintenance, a redesign or nothing at all.

Get a free website audit | View our services | See our work