Website and Web Application Maintenance Costs in the UK: What to Budget in 2026

Most website budgets stop at launch. The site goes live, the invoice is paid, and maintenance becomes something to think about later. Later usually arrives as a security warning, a broken form or a hosting bill nobody expected. This guide puts numbers on the work of keeping a website or web application healthy, so you can budget for it deliberately rather than pay for it in a hurry.

If you want to know what should be in a plan before you think about what it costs, start with our web application maintenance checklist. This article is about the budget.

Two kinds of maintenance cost

Every maintenance budget has two parts that behave very differently.

• Fixed costs are subscriptions and fees with published prices: hosting, the data protection fee, certification, and the services your site uses such as email delivery. They are predictable and usually modest.
• Time costs are the skilled hours spent applying updates, checking backups, investigating errors and making small changes. They are the larger part of the bill, and the part most often underestimated.

The fixed costs, with published prices

Here are the common fixed costs for a UK business website or web application, as published on 5 November 2026.

Common fixed costs for a UK website or web application (5 November 2026)

Cost	Who needs it	Published figure
Hosting	Every site. Shown here for a Next.js application on Vercel.	Vercel Pro: $20 a month per developer seat, including a $20 monthly usage credit. Usage beyond the credit is billed separately.
Data protection fee	Most UK organisations that process personal information, such as enquiry form details	£52, £78 or £3,763 a year depending on the organisation's size, under the 2025 amendment regulations in force from 17 February 2025.
Cyber Essentials	Optional, but often required by larger customers and for public sector work	Priced by organisation size, starting at £320 plus VAT a year, according to the NCSC.
Third-party services	Sites that send email, store files or use paid plugins and APIs	Varies by provider and volume. List each one and its renewal date.

Hosting choice affects this line more than any other. Our comparison of where to host a Next.js app explains the trade-offs between managed platforms, containers and your own servers.

The time costs: what the work really takes

The time a site needs depends far more on what it does than on how many pages it has. A large brochure site with no forms needs less care than a small application that takes payments. The following budgets are our own planning assumptions from experience, priced at the IT Jobs Watch UK median full-stack contract rate of £500 a day for the six months to 5 November 2026.

Illustrative monthly time budgets for maintenance

Type of site	Typical monthly work	Time assumption	Monthly cost at £500 a day
Marketing website	Framework and plugin updates, uptime checks, form testing, small text and image changes	2 to 4 hours	About £135 to £270
Web application with bookings or payments	Dependency and security updates with testing, backup restore checks, error monitoring, small improvements, payment provider changes	1 to 2 days	£500 to £1,000
Business-critical platform	All of the above plus faster response times, out-of-hours cover, performance work and regular access reviews	3 days or more	£1,500 or more, plus any on-call arrangement

The jump between rows is driven by three things: whether the site handles money or personal data, how many other systems it connects to, and how quickly someone must respond when it breaks.

Why updates cannot wait

It is tempting to treat updates as optional while everything appears to work. A recent example shows why that is risky.

On 3 December 2025, the Next.js team published a security advisory for CVE-2025-66478, a vulnerability in React Server Components rated CVSS 10.0, the highest severity score. The advisory says it could allow remote code execution on unpatched servers, and that it affected Next.js 15 and 16 applications using the App Router. Patched releases were published alongside the advisory, including 15.5.7 and 16.0.7, and the advisory states plainly that there was no workaround: upgrading was required.

The NCSC's guidance on how quickly to apply updates is summarised in our maintenance checklist, and our Next.js 16 upgrade checklist shows what a planned major upgrade involves.

The costs nobody budgets for

Beyond the monthly plan, a few costs regularly catch businesses out.

• Major version upgrades. Every year or two, a framework or language release needs more than a routine update. Budget a few days for each, rather than treating them as emergencies.
• Third-party changes. Payment providers, mapping services and other APIs retire old versions on their own timetable. Each change is small, but it is never optional.
• Usage growth. Hosting bills that scale with traffic are good news for the business, but they still need a line in the budget.
• Handover. If the person who built the site leaves, the first job for anyone new is to understand it. Good documentation and tests make that days rather than weeks.
• Neglect recovery. Taking over an application that has not been updated for a long time often starts with a short stabilisation project before routine maintenance is possible.

How to choose the right level of cover

A simple way to set the level is to ask what an hour of downtime would cost you.

1. If the site is mainly information, a light monthly plan with updates, monitoring and a small amount of change time is usually enough.
2. If the site takes bookings, payments or customer data, choose a plan with tested backups, security updates applied within days, and an agreed response time.
3. If customers or staff rely on it all day, add out-of-hours cover, performance monitoring and a regular review of who has access.

Whichever level you choose, ask for a monthly report that shows what was updated, what was checked and what is coming next. If a plan cannot tell you what it includes, it is hard to know what you are paying for.

Getting your maintenance budget right

If you are budgeting for a new application, include maintenance from the start. Our web application cost calculator shows a monthly upkeep figure alongside the build cost. Our guide to custom web application costs shows how build and running costs fit together. If you already have a site and are not sure what state it is in, a short review of its versions, backups and monitoring will tell you quickly.

Our managed web application services cover updates, monitoring, backups and small improvements for businesses that would rather not manage this themselves. If you would like a clear, fixed monthly figure for your site, get in touch and tell us what it does and how it is hosted.