Most Indian businesses discover website maintenance the same way: something breaks, they call the developer who built the site eighteen months ago, and the developer either does not respond or quotes a number that feels like a penalty for having been out of touch.
It is an avoidable situation, and the fix costs less than people expect.
Why a website needs maintaining at all
A website is not a printed brochure. It sits on a server, running software that other people keep changing, exposed to the entire internet.
The software underneath keeps moving. WordPress ships several releases a year. PHP versions reach end-of-life and hosts force upgrades. Plugins update, and occasionally two plugins update in ways that conflict and take down a page. None of this asks your permission.
Unpatched sites get attacked automatically. Not targeted — automated. Bots scan the entire internet for known vulnerabilities in outdated plugins. A small business site in Ghaziabad is exactly as visible to that scanner as a large one. I have cleaned sites where the owner's first sign of trouble was Google flagging their domain as harmful, by which point the damage to their search presence was already done.
Things break silently. The contact form that stopped delivering mail when the host changed its SMTP settings. The payment gateway that started failing on one card type. The image gallery that broke in a browser update. Nobody gets an alert. You find out when a customer mentions it, or when you notice enquiries dried up two months ago.
Content goes stale. Old prices, a departed team member, last year's offer still in the banner. Small things, but they are what a prospective customer sees.
What a real AMC includes
If you are paying for maintenance, these eight items should be named explicitly in the agreement.
- Core, theme and plugin updates — applied on a staging copy first where the site is business-critical, not straight onto the live site on a Friday evening.
- Security monitoring and hardening — firewall, login protection, malware scanning, and a stated response if something is found.
- Off-site backups — daily or weekly, stored somewhere other than the same server, with a tested restore. A backup nobody has ever restored is a hope, not a backup.
- Uptime monitoring — automated checks with an alert if the site goes down, so you hear it from your developer rather than from a customer.
- Broken link and form testing — a monthly check that the contact form actually delivers to the inbox you think it does.
- Performance checks — page speed measured monthly, because sites get slower over time as content accumulates.
- A defined content-change allowance — for example, two hours a month for text edits, image swaps and price updates. Defined in hours, not in vague goodwill.
- A stated response time — 24 hours for normal issues, 2–4 hours for a site that is down. Without this, "maintenance" means whenever the developer gets to it.
What an AMC should not include
Equally important, and the source of most disputes:
- New pages or new features
- Redesigns or layout changes
- SEO work, content writing, or link building
- Paid advertising management
- Recovery from damage you caused by installing something yourself
- Migrating to a different host or platform
None of these are unreasonable to buy. They are just not maintenance, and a contract that blurs the boundary leads to one side feeling exploited. Better to have the line drawn clearly and pay separately for the extra work.
Real pricing in India
Website maintenance and AMC cost in India, 2026
| Plan level | Monthly | Annual | Suited to |
|---|---|---|---|
| Basic | ₹1,500 – ₹3,000 | ₹15,000 – ₹30,000 | Static or brochure sites, low traffic |
| Standard | ₹3,000 – ₹8,000 | ₹30,000 – ₹80,000 | Business sites with CMS, forms, moderate traffic |
| Ecommerce | ₹8,000 – ₹25,000 | ₹80,000 – ₹2,50,000 | Online stores — payment and order flow testing included |
| Application | ₹15,000 – ₹60,000 | ₹1,50,000 – ₹6,00,000 | Web apps with users, roles and business logic |
Hosting is normally billed separately at ₹1,500–₹12,000 a year for a business site. Some providers bundle it; ask which, because a bundled price that looks high may simply include hosting.
A rough sanity check: annual maintenance at 10–20% of the original build cost is normal. Materially below that and something on the list above is not being done. Materially above, and you should be getting proactive improvement work, not just upkeep.
How to tell whether you are getting value
Ask your current provider for a monthly report. It should show: updates applied and when, backup dates, uptime percentage, security scan results, and the content changes made. Any competent provider produces this in minutes because the tools generate it automatically.
If the answer is vague, or the report takes a week to appear, you are probably paying a retainer for reactive availability rather than actual maintenance. That may still be worth something to you — but price it accordingly.
The DIY option, honestly assessed
You can maintain a small WordPress site yourself. Log in monthly, take a backup, update plugins one at a time, check the site still works, test the contact form. It takes about forty minutes if nothing goes wrong.
The difficulty is the other case. When an update breaks something, you need to know how to roll back, and you need to do it before customers notice. That is the whole value of paying someone: not the routine forty minutes, but the capability on the day it goes wrong.
A reasonable middle path for a business with a simple site and a technically confident person on staff: do routine updates yourself, keep a small retainer with a developer for the day something breaks. Agree the hourly rate in advance so the emergency does not come with a negotiation attached.
Warning signs in a maintenance contract
- No mention of backups, or backups stored only on the same server
- No defined response time
- Unlimited changes — either meaningless or about to be rationed informally
- The provider holds your hosting login and will not give it to you
- Automatic annual renewal with no cancellation window
- No monthly reporting
What to do if your site has been unmaintained for years
This is a common starting point, and it is recoverable. In order:
- Take a full backup before touching anything — files and database, downloaded to your own machine.
- Confirm you control the domain and hosting. If you do not, sort that out first; everything else is built on it.
- Get a security scan done. An unmaintained site may already be compromised without any visible symptom.
- Update in stages on a staging copy, not live, and not all at once — one plugin at a time so you know what broke what.
- Check PHP version. Sites running very old PHP are both slow and a security liability, and hosts eventually force the upgrade at a time of their choosing rather than yours.
- Then set up proper maintenance, so you are not here again in three years.
Expect a one-time catch-up cost of ₹5,000–₹25,000 for a neglected business site, more if malware has to be removed.
A quarterly check you can run yourself
Even with a provider, spend fifteen minutes a quarter verifying the work is real. You are not auditing their competence — you are confirming the basics have not quietly stopped.
- Submit your own contact form from a phone on mobile data, and confirm it reaches the inbox. This catches the most expensive silent failure there is.
- Tap your phone number and your WhatsApp button on the live site. Confirm both reach an account someone watches.
- Load the homepage on mobile data and count the seconds. Sites get slower as content accumulates; a gradual slide is easy to miss.
- Check the copyright year in the footer. If it says 2023, nobody has looked at this site in a while, which tells you something about everything else.
- Log into the CMS. Confirm your admin account still works and that you can still see the update notifications.
- Ask for the last backup file, or at least its date and where it is stored. Once a year, ask them to demonstrate a restore to a staging URL.
If any of these fail, you have found a problem worth a conversation — and you have found it before a customer did.
Frequently asked questions
How much does website maintenance cost in India?
₹1,500–₹3,000 a month for a basic site, ₹3,000–₹8,000 for a standard business site with a CMS, ₹8,000–₹25,000 for ecommerce, and ₹15,000–₹60,000 for web applications. Annual contracts typically run at 10–20% of the original build cost.
What does a website AMC include?
Core, theme and plugin updates; security monitoring and hardening; off-site backups; uptime monitoring; broken link and form testing; performance checks; a defined allowance of content changes; and a stated response time. New features, redesigns and SEO are not maintenance.
Do I really need website maintenance?
Any site running a CMS such as WordPress does. Unpatched plugins are scanned and exploited automatically by bots, regardless of how small your business is. A purely static HTML site with no forms needs far less, but still needs backups and uptime monitoring.
Can I maintain my own website?
For a small WordPress site, yes — monthly backups and staged plugin updates take around forty minutes. The value of paying someone is capability on the day an update breaks something, not the routine work itself.
What happens if I have not maintained my site for years?
Back everything up, confirm you control the domain and hosting, run a security scan, then update in stages on a staging copy rather than live. Budget ₹5,000–₹25,000 for the catch-up, more if malware needs removing.
Is hosting included in maintenance?
Usually not. Hosting typically runs ₹1,500–₹12,000 a year for a business site and is billed separately. Always ask, because a bundled quote that looks expensive may simply include it.
What happens to my website if I stop paying for maintenance?
Nothing immediately — the site keeps running. The risk accumulates quietly: plugins fall behind, a known vulnerability eventually gets exploited by an automated scanner, or an update you never applied becomes incompatible with a forced PHP upgrade from your host. Most neglected sites survive a year without visible incident and then fail suddenly, which is why the problem is so easy to underrate.
Should my developer hold my hosting login?
They need access to do the work, but the account should be in your name with you holding the master credentials. Give them a separate user account where the platform allows it. If your provider refuses to let you hold your own hosting login, that is reason enough to change provider.