1. Executive Summary
Website maintenance is not an optional extra. It is the minimum operating cost required to keep a system of servers, domains, SSL certificates and a CMS working together. Everyone knows what happens when a car never gets an oil change. A website deteriorates in much the same way; the difference is that the damage is harder to see.
For readers looking for a quick answer on website maintenance pricing: monthly maintenance for a typical small or midsize business website in South Korea generally ranges from about KRW 50,000 to KRW 500,000. Content edits sit near the lower end. Security checks, monitoring and incident response push the fee toward the higher end. Actual quotes vary widely by site size and provider, so use this range as a reference point rather than a fixed rule. Section 5 explains the pricing structure in detail.
This article answers three questions: What really happens when a website is neglected? What is the minimum acceptable level of security? And if you outsource maintenance, what should the contract say? Those topics are covered in Sections 2, 3 and 4–6 respectively.
Key takeaway
Development is a one-time expense; maintenance protects that investment. A website that cost millions of won to build can disappear behind a browser warning that says “Your connection is not private” the moment its SSL certificate expires.
Recovery after an incident always costs more than prevention. Compared with removing malware, rebuilding a compromised site and restoring customer trust, a modest monthly inspection fee is inexpensive insurance.
2. What Happens to a Neglected Website
A neglected website ages quietly until one day the damage turns into an incident. The sequence is often predictable: a certificate expires while nobody is watching, a bot finds an outdated plugin, or a domain renewal notice sits unread in a spam folder until the deadline passes. Let us look at each risk.
2.1 The browser turns visitors away: expired SSL
When an SSL certificate expires, visitors see a full-page “Your connection is not private” warning instead of your website. To someone who knows nothing about the company’s internal situation, that warning simply means the site is dangerous. They go back and rarely return.
Let’s Encrypt certificates are valid for 90 days, so automatic renewal is essential. Paid certificates can expire too when the billing contact changes or renewal notices are missed. If nobody is explicitly responsible for renewals, the warning page will eventually appear.
2.2 An outdated CMS is a published route into your site
It is a mistake to imagine an attacker personally choosing your company. In practice, automated bots scan the internet for outdated sites with known vulnerabilities. Once a security flaw in a WordPress plugin is disclosed, every unpatched site becomes an unlocked warehouse.
After gaining access, an attacker may install a web shell, hide gambling or adult-site spam links in the content, or redirect visitors elsewhere. The operator often discovers the breach months later, after someone reports that strange pages appear in a search for the company name.
2.3 An expired domain may be impossible to recover
A domain is leased, not owned forever. Miss the renewal and, after the grace period, someone else may register the address. Common causes include an expired payment card, a former employee who still receives renewal notices, or a dead registration email account. A server can be rebuilt with money; a lost domain sometimes cannot be recovered at any price. Years of search visibility and the address printed on cards and signs can disappear at once.
2.4 Outdated information quietly erodes trust
Even without a major incident, neglect is visible: a “News” section last updated three years ago, former employees still on the organization chart, menu items that lead to 404 pages, or an obsolete phone number. Visitors start by wondering whether the company is still operating. When prospective partners check a website before doing business, an outdated site can become worse than having no site at all.
2.5 Search engines notice neglect as well
Search rankings decline too. Broken links, slow response times, expired SSL and stale content are all negative signals. Spam pages created after a breach are more serious. Google may add an “This site may be hacked” warning to search results, while gambling-related pages outrank the real company page for its own name. Removing the malware, requesting a review and recovering rankings can take months.
Failures tend to arrive together
If nobody noticed that SSL had expired, there is a good chance the site also lacks backups and monitoring. A management gap rarely affects only one area.
That is why many breach-recovery requests end as full rebuilds: there is no usable backup, so the site must be made again from scratch. The company pays the development cost twice, not merely a recovery fee.
3. Security Basics: From SSL to Backups
Five fundamentals prevent most incidents on small-business websites: keep HTTPS working, back up and test recovery, manage administrator accounts, install updates, and use a web application firewall. These are not expensive enterprise products. All five can be implemented on the infrastructure you already use.
3.1 HTTPS is something you maintain, not merely enable
Adding SSL when the site is built is not the end of the work. Check three things.
- Verify automatic renewal: For Let’s Encrypt, confirm that the renewal cron job actually runs and that a recent success log exists
- Send expiry alerts to more than one place: Route the 30-day warning to a shared mailbox or messaging channel, not one employee’s inbox. The alert must survive a staffing change
- Confirm deployment after renewal: Certificates are sometimes renewed on disk but not loaded because the web server was never reloaded. Check the live expiry date in a browser after renewal
3.2 Can your backup actually be restored?
A backup that has never been restored is not a proven backup. Having a file is different from being able to bring the site back with it. Teams often discover on the day of an incident that a database dump is truncated, the files were saved without the database, or the archive cannot be opened.
- Back up files and the database: A website consists of both. Saving only one side does not produce a recoverable site
- Store copies off the server: A backup on the same machine disappears with the server during a hardware failure or breach. Export it to another server or cloud storage
- Rehearse recovery: Once a quarter, restore the backup to a test environment. The time this takes is a realistic measure of recovery time during an outage
3.3 Administrator accounts: the cheapest route in
A bot’s first attempt is often a login, not a sophisticated exploit. It repeatedly tries common passwords against usernames such as admin. Good account hygiene closes one of the largest doors.
- Do not use admin or administrator as a username; many brute-force attempts begin by guessing the username
- Delete accounts belonging to former employees and past vendors immediately, and review the account list every quarter
- Enable two-factor authentication for the admin area and restrict access by IP address where practical
- Do not share one administrator account among several people; shared accounts make incident auditing impossible
3.4 The cost of delaying updates
Updates are not limited to the CMS core and plugins. They also include the runtime environment, such as PHP on the server. Each PHP release has a security-support deadline. PHP 7.4, for example, stopped receiving security patches after November 2022. When a new vulnerability appears on an unsupported version, there is no patch to install.
It is understandable to worry that an update could break the site, but the risk is manageable when the order is right: back up first, apply the update, then test the main pages and functions. Repeating these three steps once a month is what the “updates” line in a maintenance agreement should cover.
3.5 Web application firewalls are more accessible than they seem
A web application firewall (WAF) filters traffic that matches known attack patterns before it reaches the site. It is not only for large enterprises. Cloudflare’s free plan includes basic attack protection and traffic filtering. In South Korea, KISA distributes the free CASTLE web application firewall and WHISTL web-shell detection tool to small and midsize businesses. Many hosting providers also offer a WAF option, so begin by checking your current hosting plan.
The goal is not perfection; it is to stop being the easiest target
No security measure prevents every intrusion. Automated bots, however, attack the easiest sites first. A site that follows these five fundamentals falls much lower on their list.
And if an intrusion still occurs, tested backups and a recovery procedure turn it into a few days of recovery work. Without them, it becomes another full website project.
4. Maintenance Scope and Frequency
Website maintenance has four broad parts: content changes, technical updates, monitoring and incident response. Most disputes with providers begin because the contract never states which of these are included. Before requesting quotes, decide what your company wants to outsource using these four categories.
4.1 What counts as maintenance?
- Content changes: Replacing text and images, publishing pop-ups and banners, and managing posts. New pages and redesigns usually require a separate quote. This boundary is the one most often left unclear
- Technical updates: Regular updates and security patches for the CMS core, plugins and server packages
- Monitoring: Watching uptime, response speed, SSL and domain expiry dates, and backup status. This prevents customers from being the first people to report an outage
- Incident response: Diagnosing and restoring the site after downtime, a breach or an error. Section 6 explains how an SLA should define response speed
4.2 Recommended schedule by task
| Task | What it covers | Recommended frequency |
|---|---|---|
| Uptime monitoring | Automated uptime and response-time checks with outage alerts | Continuous (automated) |
| Backups | Back up files and the database to off-server storage | At least weekly; daily for frequently changing sites |
| Recovery test | Restore a backup to a real test environment | Quarterly |
| Updates | CMS core and plugin updates, security patches | Monthly; critical patches immediately |
| SSL and domain checks | Check expiry dates and renewal status | Monthly, plus automatic alerts |
| Content changes | Replace text, images and pop-ups | As needed within the contract |
| Maintenance report | Summary of completed work, issues and traffic | Monthly |
4.3 The site’s purpose determines the schedule
The table is a starting point. A brochure site may be fine with weekly backups, while a site that receives orders, reservations or member data every day needs daily backups. Ask one simple question: “How painful would it be to lose one day of data?” Shorten the interval to match the answer.
5. Website Maintenance Pricing
There are two common billing models: pay per request and a monthly retainer. Per-request billing is usually cheaper when changes happen only a few times a year. A retainer makes more sense when the site needs monthly attention or when you want monitoring and backups included. Making this choice first simplifies quote comparisons.
5.1 Pay per request: no work means no fee, but nobody is watching
The provider works only when asked and bills for each request. Basic text or image replacements often cost tens of thousands of won, while functional changes are quoted by the time required. No fixed fee is attractive, but the model has a structural weakness: nobody is continuously watching the site. Backups and monitoring are absent unless contracted separately, so all the neglect risks in Section 2 remain. If you choose this model, automate backups and expiry alerts yourself at minimum.
5.2 Monthly retainers by service level
Monthly plans generally fall into three levels based on scope. The ranges below are reference points commonly seen in the South Korean market; actual pricing varies by site and provider.
| Plan | Typical monthly cost | Included scope | Best suited for |
|---|---|---|---|
| Per request | No retainer; tens of thousands of won per request and up | Changes only when requested | One or two edits a year, with in-house backups |
| Light | About KRW 50,000–150,000 | Small content changes, backups and basic checks | Company brochure websites |
| Standard | About KRW 200,000–500,000 | Guaranteed monthly changes, updates, monitoring and incident response | Sites where inquiries or bookings generate revenue |
| Dedicated | KRW 1,000,000 and up | Ongoing planning and development capacity, including feature improvements | Online stores and service platforms |
5.3 Three things to check separately in a quote
First, separate hosting and domain fees from maintenance fees. Some quotes inflate “maintenance” by mixing in server rental; in other cases, clients assume hosting is included and pay twice. Second, if the contract says changes are “unlimited,” read the conditions. Unlimited service is usually paired with strict scope limits. Third, look for the rate for work outside the included scope. Agreeing on an hourly or per-request rate in advance prevents arguments later.
If you also need to understand pricing during the initial build, see our guide to website development costs. Development quotes and maintenance quotes need to be read differently.
The catch in “one year of free maintenance”
“One year of free maintenance” in a development contract usually means warranty fixes for defects present at delivery. Content changes and security updates are often excluded.
Get the free period’s exact scope in writing before signing. If you hear only the word “free” and leave the site alone for a year, it may already have a year’s worth of overdue updates when the period ends.
6. Setting an SLA with Your Agency
An SLA, or Service Level Agreement, does not need to be a grand document. It simply records “when something happens, how soon will the provider do what?” in measurable terms. A promise to “respond diligently” guarantees nothing in a dispute. Put five items into numbers.
6.1 Five measurable terms to put in the contract
- Initial response time: How many hours after a request will the first reply arrive? State whether this means business hours or clock hours, and how night or weekend incidents are reported
- Recovery target: How quickly must the provider restore a fully unavailable site? It is even better to set targets by severity: full outage, partial functional error and routine inquiry
- Backup frequency and retention: How often are backups made, where are they stored and how many generations are retained? Write “weekly, external storage, latest four copies,” not merely “backups included”
- Access to source code and accounts: State who owns copies of the source and access to the server, domain and admin accounts. This is covered separately below
- Out-of-scope rates: Agree in advance on hourly or per-request pricing for work outside the contract
6.2 Source code and accounts are company assets
One of the most painful failures looks like this: the maintenance provider closes or stops responding, while the domain is registered in the provider’s name and only the provider knows the server credentials. The website may still be online, yet the company cannot change it. The domain registrant must be the company, and the company must retain the server and CMS administrator credentials. A clause requiring regular delivery of source-code copies also preserves leverage when changing providers.
If you are still choosing a provider, our web agency selection guide explains the questions to ask. Maintenance capability is difficult to judge from a development portfolio alone.
One handover clause can protect the company
Add this sentence to the contract: “Within 30 days of contract termination, the provider will hand over all source code, databases and account information.” Without it, handover can become leverage during a provider change.
A reliable provider will not object to this clause. Reluctance is itself a useful warning sign.
7. Conclusion and Checklist
7.1 Six things you can check in 30 minutes today
The entire article can be reduced to six actions. You can check every one of them today.
- Check the SSL expiry date: Open the certificate details from the browser’s address bar. If fewer than 30 days remain, assign the person responsible for renewal now
- Check the domain expiry date and registrant: Use WHOIS to confirm both the date and that the company is the registered owner
- Find the latest backup: Check when it was created and whether a copy exists off the server. If nobody knows, that is the answer
- Clean up administrator accounts: Remove former employees and shared accounts, then enable two-factor authentication
- Review pending updates: Count the update notices in the CMS dashboard. If the number has reached double digits, back up and schedule the work
- Read the contract: If a maintenance agreement exists, check whether response time, recovery targets and source access are written in measurable terms. If not, use the five items in Section 6 for the renewal discussion
7.2 The cost of care versus the cost of neglect
If you answered “I do not know” to at least three of the six checks, the website is already in the neglected zone. The only difference is that the incident has not happened yet.
Maintenance costs tens to hundreds of thousands of won a month. Neglect costs a rebuild, lost revenue and months of restoring trust. A website is not finished on launch day; that is the day its operation begins. You can choose which price to pay only before an incident.