A £50 a month website plan should cover hosting, an SSL certificate, daily backups, software updates, security monitoring and a small allowance for changes, and you should be able to see each of those in writing.
Plenty of plans cost £50 and deliver very little. The price tells you nothing until you know what sits behind it. Some include a developer's time every month. Others are a shared server, an automatic backup you cannot restore and an invoice.
This article sets out typical UK costs, the six things the money should buy, the risk it protects you from and the questions to ask before you sign. It forms part of our wider guide to UK web design agencies.
What does website maintenance cost in the UK?
Typical running costs are £10 to £60 a month for hosting and £20 to £100 a month for maintenance, plus a domain at £3 to £10 a year.
Those ranges come from one UK small business cost guide, which cites no underlying survey and is inconsistent in places, so treat them as indicative. The same guide puts search work at £100 or more a month, which is a separate service from keeping a site running.
A combined plan at £50 a month therefore sits towards the lower end of hosting plus maintenance. It can be good value for a small, simple site. It is thin for an ecommerce store or a site with bookings, payments and many plugins.
The right amount depends on how much can go wrong and what it costs you when it does. A brochure site that gets a handful of enquiries a month can carry a lean plan. A site that takes orders, appointments or payments needs more.
What should £50 a month actually include?
Six things belong in any serious plan.
1. Hosting that suits the site
The server should be fast, in the UK or close to your customers, with enough resources for your traffic. Shared hosting suits a small brochure site, and a shop or a busy site needs better. Ask what happens when traffic spikes and whether your site shares a server with hundreds of others.
2. An SSL certificate and its renewal
The padlock in the browser comes from an SSL certificate, and expired certificates scare visitors off with a full-page warning. It should be installed and renewed automatically, and someone should check that the renewal worked.
3. Backups you can restore
Daily or weekly automatic backups, stored away from the server itself, with a tested restore. A backup that has never been restored is a hope, not a backup. Ask how long a restore takes and who does it.
4. Updates to the software
If the site runs on WordPress or a similar system, the core software, theme and plugins need regular updates. For a custom build, dependencies need the same attention. Ask how often updates are applied, who tests them and what happens if one breaks the site.
5. Monitoring and security
Uptime monitoring that alerts someone when the site goes down, a malware and vulnerability scan, and a firewall or similar protection. Ask who receives the alerts and how fast they respond.
6. A small amount of time for changes
An hour or two of developer time a month for text changes, new images and small fixes. Without it, every edit becomes a new quote. Ask what counts as a small change and what does not.
Why does the security part matter?
Because most successful attacks on small sites use weaknesses that already have a fix, and a plan that applies updates promptly closes them.
The government's Cyber Security Breaches Survey 2025 found that 43% of UK businesses had experienced a breach or attack in the previous 12 months, with phishing the most common type by a significant margin. Phishing targets people, not websites, but a hacked site can be used to send it.
On the website side, Patchstack, a WordPress security company, reported more than 4,100 vulnerabilities disclosed in the WordPress ecosystem in 2024. It said that over 60% of the attacks it tracked exploited vulnerabilities for which a patch already existed, and that the average window for updating, testing and patching was 120 days.
Putting those together, the risk comes from slow updating, not from clever attacks, and a monthly plan that updates promptly addresses the biggest part of it.
Custom-built sites have a smaller surface to attack, because they have no public plugin marketplace, but they still need patched dependencies and secured accounts. We compare the two approaches in why we build on Next.js, and when WordPress is right.
How might £50 be split?
One plausible split is about £15 to £20 for the server and £30 to £35 for the human time and tools that keep it healthy, though providers rarely publish theirs.
Take the guide's ranges as the boundaries. If hosting costs £10 to £60 and maintenance £20 to £100, then £50 in total might buy decent shared hosting and about half an hour of professional attention each month.
That is enough to apply updates, check backups and respond to an alert. It is not enough to fix a broken checkout on a busy shop.
This is a model, not a quote, and the exact split matters less than whether the supplier will tell you. Ask them to break the price into hosting, tools and time. If they cannot, they may not have thought about it, which tells you something about the service.
Also compare the annual cost with the cost of an hour offline. A shop that takes £300 a day loses about £12 an hour of sales while the site is down, so a plan that prevents two hours of downtime a year covers some of its own price.
A brochure site that gets two enquiries a week has a lower cost of downtime, and a leaner plan is fine.
What does a £50 plan usually not include?
It usually excludes new features, redesigns, content writing, search optimisation, emergency recovery after a major hack and anything that takes more than an hour or two.
Make sure the plan states how emergency work is charged. A hacked site can cost several hours to clean, and an hourly rate you have never seen is a bad thing to learn at that moment. Also ask about the cost of restoring from backup, and about the response time for faults: same day, next working day or "when we can".
Content changes are another grey area. If you want a blog post each month, a monthly price change or a new landing page, ask whether it is covered or billed separately. Our piece on the cost of a cheap website shows how a low price at the start can turn into a long list of extras.
What are the red flags in a hosting and maintenance offer?
Be wary of plans that do not list what they include, that will not give you access to your own accounts or that lock you in with a long contract.
The commonest red flags:
- "Unlimited everything" with no description of limits.
- No stated backup frequency, or backups stored on the same server.
- No named person or team responsible for updates.
- A contract that auto-renews for 24 or 36 months.
- Hosting in the agency's account with no way to move it.
- A support line that is an email address with no response time.
The ownership point is the one to push on. The hosting, domain and code should be in your name or transferable on request, which is part of our checklist of what your web agency should hand over.
Should you pay an agency, a host or do it yourself?
For a small site, a managed plan from the agency that built it is simplest, and doing it yourself works only if you are willing to carry the responsibility.
The choice is between three routes. A managed host handles servers and some updates and leaves you to do the rest. An agency maintenance plan covers the whole stack and gives you one number to ring. Doing it yourself costs the least money and the most attention, and fails the day you are on holiday.
If you choose to do it yourself, put a monthly reminder in your diary and keep a written list of what to check.
For a clinic or healthcare practice, where the site may carry patient enquiries, or a law firm handling client data through forms, the case for a managed plan is stronger because the cost of a breach is higher.
How do you know the plan is working?
Ask for a short monthly report: updates applied, backups taken and tested, uptime, security scans and the time used for changes.
A good provider sends one without being asked. Once a quarter, test it yourself. Ask for a backup restore on a test copy. Check that the SSL certificate has a future expiry date. Look at your page speed, using the method in page speed as a sales metric, because updates and new plugins can slow a site without anyone noticing.
Getting a plan priced
List your site's moving parts: platform, plugins, integrations, forms and payments. Then ask each supplier to price against that list.
Our website design service covers the support after launch, and you can contact us with your list for a plain view of what a fair plan costs.