Website maintenance: what it costs and what belongs in the contract

The website works, so it’s easy to assume that nothing needs doing. Meanwhile, plugins, the theme, the PHP version and the SSL certificate need updating or renewing, and a backup only proves its worth when something goes wrong. That’s why many businesses pay for website maintenance. The trouble is that very different services hide under the same name: from automatic updates once a week to an on-call service that responds to an outage within a few hours.

In this guide, I show what website maintenance costs in Poland, what should be in the contract and how to spot an offer that won’t help you much when something breaks. I describe prices and regulations as of 2 November 2026. This is not legal advice: for an online store or a website that collects a lot of customer data, have a lawyer read the contract.

What website maintenance costs in 2026

I went through the public price lists of several Polish companies and agencies (as of the end of October 2026). Most of them sell maintenance in three packages, with a net price per month for one website:

Work beyond the package costs from PLN 139 to PLN 200 net per hour in these price lists. Some companies bill it in 15-minute increments, others charge at least a full hour.

The price depends mainly on the number of hours in the package, the backup frequency and how quickly the provider responds to an outage, so compare the scope, not just the amount. My maintenance comes in three packages: Watch from PLN 149 net a month (monitoring, updates, an off-server backup every week, a response within 2 business days), Standard from PLN 349 (daily backups, 1 hour of content changes, a response within 1 business day) and Pro from PLN 749 (3 hours of work, a response within 4 hours, at weekends too for outages). I quote work outside the scope in advance or by the hour, at PLN 160 net per hour. I calculate the full annual cost, including the domain, hosting and email, in the guide on the cost of running a website.

A closed list of tasks: what exactly the provider does

The weak point of many maintenance contracts is a clause like “comprehensive website maintenance” with no list, which everyone interprets their own way in a dispute. Ask for a closed list of tasks, that is, a list with a frequency next to each item. For example:

• updates of the CMS core, plugins and theme every week, each preceded by a backup and followed by a check of the website,
• urgent security fixes within an agreed time of their release, e.g. within a day,
• a backup of the files and database: daily for a store, at least once a week for a simple business website,
• monitoring of uptime, SSL certificate validity and the domain renewal date,
• a scan for malicious code and a review of administrator accounts,
• minor content changes up to the hour limit,
• a monthly report: what was updated, what outages there were and how many hours were used.

Why are plugins the most important part here? According to a Patchstack report, 11,334 new vulnerabilities were disclosed in the WordPress ecosystem in 2025, 42% more than the year before. 91% concerned plugins, and only 6 were in WordPress core itself. Almost half (46%) had no fix at the time of disclosure. That’s why a good provider doesn’t just click “Update”, but can also disable or replace a plugin when there’s no fix yet.

What the list doesn’t cover is just as important. Ask directly about three things:

1. Is cleanup after a hack included in the price, or is it a separate job?
2. Is a PHP version upgrade included in the price? According to php.net, PHP 8.2 loses security support on 31 December 2026.
3. Who pays for renewing licenses for paid plugins, and in whose name are they bought?

Each of these items is easy to overlook, and each can mean an extra invoice.

Response time is not repair time

“Response within 4 hours” sounds good, but it usually only means that someone will reply or start working within that time, not that the website will already be working. The repair time, meaning the time to restore operation, is a separate number that rarely appears in price lists.

In the contract, agree on:

1. Ticket categories, for example: a critical outage (the website is down, the store isn’t accepting orders, a hack), a bug (a form or a single subpage doesn’t work) and a change (new text, a photo).
2. The response time for each category, and whether it counts only during business hours or around the clock.
3. The reporting channel. In one of the price lists I reviewed, the same package gives 4 hours for a response to a phone call, also in the evening and at weekends, but 8 hours to an email and only on business days.
4. A target time to restore operation for a critical outage, for example from the latest backup. Even if the provider writes it down as a target rather than a guarantee, you have a number you can refer to.
5. The consequence of missed deadlines, for example a reduced fee for that month or the right to terminate the contract without a notice period.

Patchstack reports that for the most heavily exploited vulnerabilities, the median time to mass attacks was 5 hours. So for an urgent fix, what matters is a day, not a week.

Backups and monitoring: where, how often and who checks

When it comes to backups, the contract should answer four questions:

• Where are the backups stored? At least one must be outside the website’s server and outside the hosting account. A backup on the same server can disappear together with the website after a hack or an account suspension. I describe the details in the guide on website backups and the 3-2-1 rule.
• How often and for how long? For example, daily, with backups kept from the last 30 days. This matters, because a hack is sometimes noticed only after several weeks.
• Who tests restoring? Once a quarter, the provider restores a backup in a test location and records the result in the report.
• Will you get a backup on request? Write in that within an agreed time, e.g. 2 business days, you receive a current copy of the files and database.

For a store and forms, this is not just a matter of convenience. Among its security measures, Art. 32 of the GDPR lists the ability to restore the availability of personal data in a timely manner in the event of a physical or technical incident, and regular testing of security measures.

Monitoring should cover website uptime checked every few minutes, SSL certificate validity, the domain renewal date, as well as new administrator accounts and changes to files. Also ask who receives an alert and what they do with it at night. Without an on-call service, monitoring only means that someone will read the email in the morning.

Hours in the package, extra work and termination

Agree in writing on:

• how many hours the package includes and whether unused hours roll over to the next month (in some price lists they don’t),
• how time is counted: in 15-minute increments or for every hour started,
• the rate for work beyond the package, and that each such job requires your approval before it starts,
• what counts as a “minor change” and what is already a new job, for example a new subpage or a new feature.

In the price lists I reviewed that state contract terms, the standard is an open-ended contract with a one-month or 30-day notice period. Be careful with a 12- or 24-month contract with a penalty for early termination and automatic renewal for another year.

Also add an exit clause. Within an agreed time after the contract ends, the provider hands over a current copy of the files and database, all access credentials and a list of licenses, and then deletes their own accounts. Depending on your decision, they delete backups containing customer data or return them to you.

Customer data: a data processing agreement (Art. 28 GDPR)

A provider with access to the admin panel, database and backups sees personal data: form submissions, orders and customer accounts. Your business is the controller of that data, and the provider is usually a processor. In that case, Art. 28 of the GDPR (RODO in Polish) requires a contract that sets out the subject matter and duration of the processing, its nature and purpose, the type of data and the categories of people. The contract must be in writing, including in electronic form (Art. 28(9)). You’ll find the text of the regulation on the UODO website (Urząd Ochrony Danych Osobowych, Poland’s data protection authority).

For technical maintenance, four clauses are particularly important:

• the provider processes data only on your documented instructions, and the people with access have committed themselves to confidentiality,
• they use other companies (e.g. backup storage, a monitoring tool) only with your prior written authorization, specific or general (Art. 28(2)),
• after the contract ends, they delete or return the data and delete existing copies (Art. 28(3)(g)),
• they notify you of a personal data breach without undue delay (Art. 33(2)).

It’s worth turning the last point into a number. As the controller, you have 72 hours from becoming aware of a breach to notify the President of UODO, unless the breach is unlikely to result in a risk to the people whose data is involved (Art. 33(1)). So write in that the provider informs you, e.g. within 24 hours of detecting a hack that may have affected the data. The EU is working on changes to the breach notification rules (the Digital Omnibus package), but as of the publication date of this guide, the 72-hour deadline applies. I write more about a data processing agreement when a website is being built in the guide on a website development contract.

Red flags in a maintenance offer

Each of these points is a reason to ask more questions before you sign:

• “Comprehensive maintenance” with no list of tasks and no frequency.
• Backups “made by the hosting provider” or no answer to the question of where they are stored.
• A response time without a definition: it’s not clear when it starts counting, during which hours and through which channel to report an outage.
• The domain, hosting or the only admin account in the provider’s name. The domain and a full admin account must be yours. When the provider runs the server (I offer domain and hosting as a separate service myself), the contract says how and when you can move the website to another provider.
• A long contract with a penalty and automatic renewal.
• No data processing agreement for a store, a form or a newsletter.
• No report. You pay every month, but you don’t know what was done.
• “Unlimited changes” in the cheapest package. Ask how many hours that is in practice and what happens when there are many requests.

Summary

Judge website maintenance by the list, not by the amount: what the provider does, how often, how quickly they respond and what work beyond the package costs. Check where the backups are stored, what the exit looks like and whether there’s a data processing agreement for customer data. I give prices and regulations as of 2 November 2026, so check the provider’s current price list before you sign.

If you want to hand updates and backups to one person, my technical maintenance costs from PLN 149 net a month in the Watch package, from PLN 349 in the Standard package and from PLN 749 in the Pro package, and new clients get 20% off their first month. If you don’t know what state your website is in, start with a security audit: you’ll get a report with scores and a list of fixes.