Once a site’s live, most developers offer some version of an ongoing maintenance plan — a monthly fee to keep things running. Sometimes that’s genuinely worth paying for. Sometimes it’s a recurring charge for work your site barely needs. The difference comes down to what’s actually in the plan, not the price tag on its own.
Do you actually need one?
It depends almost entirely on how the site was built, not on how important the site is to your business.
You probably need a plan (or at least someone on call) if: your site runs on WordPress or a similar CMS with plugins and a database — these need regular security patching, and a missed update is one of the most common ways small business sites get hacked. If nobody’s watching it, it’s a real risk, not a hypothetical one.
You probably don’t need one if: your site is static (no database, no plugins to patch) — the kind of build that just serves fixed pages with nothing to exploit. These sites can genuinely sit untouched for a year without the security exposure a CMS carries. Worth asking directly when you’re quoted: “does this site need a maintenance plan to stay secure, or is that not really a risk here?” A straight answer either way tells you something about who you’re talking to.
What a legitimate plan should include
If you are paying monthly for maintenance, here’s the checklist of what that fee should actually cover — not just “we’ll fix stuff if it breaks”:
- Software, plugin, and theme updates, applied on a defined schedule (not “whenever we get to it”)
- Automatic backups, stored somewhere other than the same server as the live site, with a stated retention period (30 days, 90 days) and — critically — a plan they’ve actually tested restoring from
- Uptime monitoring, so someone finds out the site’s down before your customers do
- A response time commitment for something urgent — a broken contact form, a site that’s down — not just “we’ll get to it eventually”
- A small allowance of content changes — swapping a photo, updating hours, fixing a typo — without it triggering a separate invoice every time
- Basic security scanning, catching a compromised plugin or injected malware before it costs you traffic or gets the site blacklisted
If a plan is mostly “we’ll be available if something goes wrong,” that’s a support arrangement, not maintenance — worth knowing the difference before you commit to a monthly fee.
Roughly what it costs
For a small NZ business site, a genuine maintenance plan covering the list above typically lands somewhere in the $50–$200/month range, scaling with how complex the build is and how fast the response-time commitment is. Below that, you’re likely paying for backups and updates alone with no real support attached. Well above it, you should be getting a genuinely fast response time and a real human checking in, not just automation running in the background.
Red flags worth watching for
- Vague scope — “ongoing maintenance and support” with no actual list of what’s included is a fee without a deliverable
- No mention of backups being tested, only that they’re taken — an untested backup is a false sense of security; plenty only find out it doesn’t restore properly when they actually need it
- Lock-in with no way to leave cleanly — you should always be able to take your domain, hosting, and content elsewhere if you stop paying; if that’s unclear, ask directly (we’ve written more on this in do you own your website?)
- A flat fee regardless of what the site actually needs — a five-page static brochure site and a site with online bookings and a database don’t carry the same risk, and shouldn’t cost the same to maintain
The honest answer
A maintenance plan is worth paying for when your site has real ongoing security exposure — a CMS, plugins, a database — and no worse than skipping insurance if it doesn’t. Before signing up for one, ask exactly what’s included, how backups are verified (not just taken), and what happens if you want to leave. If the answers are vague, that’s usually the plan telling you something about itself.