What Website Maintenance Actually Costs in Australia (2026)

A website maintenance retainer at $250 AUD a month costs $15,000 AUD over five years — more than most Australian small businesses paid for the website in the first place. That number isn't automatically a rort. Plenty of sites genuinely need that much attention, and plenty of providers genuinely deliver it. But almost nobody buying a maintenance plan can tell you what the money is actually for, because "maintenance" is three completely different bills wearing one name, and quotes rarely separate them.

Separate them and the whole category becomes legible. You can work out which bills apply to your site, which ones you're paying twice for, and which ones you're paying for and not receiving.

The three bills hiding inside one word

The first bill is rent — what you pay a platform or a host each month simply to keep the site reachable on the internet. The second is upkeep — the ongoing work of keeping the software the site runs on patched, backed up and monitored so it doesn't quietly break or get compromised. The third is change — actual work on the site itself: new content, a new page, a form that needs rebuilding, a price list that's out of date.

Those three have almost nothing to do with each other. Rent is a fixed subscription with a published price. Upkeep is a technical obligation that scales with how much third-party software your site depends on. Change is labour, and it's the only one of the three that varies with what your business actually does. A retainer that bundles all three into one round monthly figure makes it impossible to tell whether you're getting value, because there's no line item to compare against anything.

If you're on a hosted platform, the subscription is the maintenance

This is the part most owners get wrong in their own favour, then wrong against themselves.

On Squarespace, Wix or Shopify, the platform handles the entire upkeep bill. Security patches, server updates, backups, uptime — all of it happens without you knowing it happened, and that's genuinely what the subscription buys. Shopify's Australian pricing page currently lists Basic at A$42 a month on annual billing (A$56 month-to-month), the mid-tier Grow plan at A$114 (A$149 month-to-month), and Advanced at A$431 (A$575 month-to-month). Those are real AUD figures, not conversions, and for that money you are never patching anything.

So if you're on a hosted platform and someone is also charging you a monthly "maintenance" fee, the honest question is what that fee covers that the subscription doesn't. There's a legitimate answer — it's the third bill, change — but it should be described as that. A retainer sold as "keeping your site secure and updated" on a platform that already does both is selling you something you've already bought.

The catch on the other side is that platform rent isn't fixed forever. It's the one line item you have zero control over, and the direction of travel is well documented: we went through the pattern of website builder price rises since 2024 in detail, including the trick of restructuring plan names so a rise never has to be announced as one. Budget for a subscription that costs more in year five than year one, because that's what the last five years looked like.

If you're on WordPress, upkeep is a real job with a real cost

WordPress is where the three bills genuinely all exist at once, which is why WordPress maintenance retainers are the most common kind sold in Australia — and the hardest to evaluate.

Rent is straightforward enough. WP Engine prices its Australian plans in AUD: the entry-level Startup plan is A$42 a month billed annually — A$504 a year — for one site, 25,000 monthly visits and 10GB of storage, and it explicitly includes automated WordPress and PHP updates, daily backups, and security patching with plugin risk scans. Their Professional tier is A$76 a month and Growth is A$155. Cheap shared hosting will run WordPress for a fraction of that, but without any of the managed upkeep, which just moves the second bill somewhere else rather than removing it.

The second bill is the one worth understanding properly, because it's where "we'll keep your site updated" earns its money or doesn't. Patchstack's State of WordPress Security in 2026 report recorded 11,334 new vulnerabilities disclosed across the WordPress ecosystem during 2025, a 42% increase on the year before. Ninety-one per cent of them were in plugins. WordPress core itself accounted for six. Most usefully for anyone assessing a retainer, Patchstack found that 46% of those vulnerabilities had no patch available at the point they were publicly disclosed.

That last figure is the argument for paying someone competent, and also the test of whether you are. If nearly half of disclosed vulnerabilities have no fix waiting when the world finds out about them, then "we run the updates monthly" is not a security service. Someone has to be watching which plugins are affected, which ones are abandoned, and which ones need to be replaced rather than updated. That's judgement, not a button. A retainer that only ever presses the button is charging judgement rates for automation you could get from the host.

We've broken down the full annual arithmetic — hosting, plugin licences, and the hours the updates actually take — in the real cost of "free" WordPress. The short version is that a properly run WordPress site has a genuine four-figure annual cost before anyone touches the design, and pretending otherwise is how sites end up three versions behind.

If the site is custom-built, most of the second bill disappears

A hand-coded site with no plugin layer and no admin panel doesn't have the same exposure. There's no third-party plugin ecosystem to monitor, no theme to conflict with an update, no login page under constant brute-force attack. Hosting for a static or near-static build is cheap enough to be a rounding error next to a Shopify Advanced plan.

That doesn't make maintenance zero, and anyone claiming it does is overselling. Dependencies still get security releases, certificates renew, and integrations change their interfaces so something that worked last year stops. What changes is the shape of the bill: upkeep drops close to nothing, and what's left is almost entirely change, which is at least tied to something your business decided to do.

Our own position on this is deliberately unfashionable. Every custom build we do includes 30 days of free iteration after launch — bug fixes, copy tweaks, content updates — and after that, changes are billed by the hour when you actually want them. No monthly retainer, no minimum term, and the code and CMS are handed over at launch so leaving costs nothing but the decision. A recurring fee makes a lot of sense for a studio's cash flow. It makes sense for the client only when there's genuinely recurring work, and for a lot of small business sites there isn't.

The retainers worth walking away from

A few patterns are worth recognising before you sign anything, and they're structural rather than a matter of price.

Hosting bundled into the retainer with no way to separate it. If the only way to keep your site online is to keep paying the monthly fee, the retainer isn't a service agreement, it's a hostage arrangement. Ask what happens to the site if you cancel. If the answer is that it goes offline, the fee isn't really buying maintenance.

Scope described as "ongoing support" with no hours attached. Support is not a unit. Ask how many hours a month are included, what happens to unused hours, and what a change outside the included hours is billed at. A provider who can answer those three questions in a sentence each is probably fine. One who can't is selling ambiguity, and ambiguity always resolves in the provider's favour.

"Updates included" that means software updates only. This is the most common mismatch in the category. The client hears "you'll keep our website current." The provider means "we will apply plugin patches." Both are true readings of the same three words, and the gap between them surfaces the first time you ask for a new page and get a quote.

A minimum term with auto-renewal on a brochure site. Twelve-month lock-ins make sense where there's a genuine ongoing programme of work. On a site that changes twice a year, a minimum term is doing one job: making it awkward to leave.

No report, ever. If nobody can show you what was done last month — updates applied, backups verified, uptime, any changes made — assume nothing was. A maintenance retainer with no reporting is the easiest recurring revenue in the industry, because the deliverable is that nothing visibly went wrong, and nothing visibly goes wrong on most sites for months at a time regardless.

What to ask before you renew

Pull the last twelve months of invoices for anything website-related — hosting, platform subscription, plugin renewals, the retainer itself — and put them in one place. Then ask your provider three questions: which of those line items are you paying for twice, how many hours of actual work happened in the last year, and what would it cost to leave.

The answers tell you more than any pricing page. A fair arrangement survives all three questions comfortably. An unfair one usually falls apart on the second.

If you'd like a straight read on what your site should reasonably cost to run — and whether the retainer you're on is buying anything you're not already getting from your host — book a 20-minute call. We'll go through your actual invoices rather than a template comparison and tell you honestly where the money's going. You can also call us on 0421 933 907 if that's easier than a calendar link.