A website care plan in India costs ₹1,000 to ₹25,000 a month plus 18% GST, and most small business sites sit at the bottom of that range — roughly ₹1,500 to ₹5,000 a month. Below ₹1,000 you are usually paying somebody to renew hosting and nothing else. Above ₹10,000 the plan should include staging, performance work, monthly content edits and a person who replies on WhatsApp the same day.
Maintenance is not really a product you buy. It is a list of jobs somebody has to do every month whether you pay for them or not. You either pay a monthly fee, do the jobs yourself, or find out what they were worth on the morning your site shows a browser warning.
What breaks when nobody maintains a site
Nothing breaks in month one. That is the whole problem — a neglected site looks perfectly normal right up to the day it does not, and by then the damage is usually weeks old. These are the failures we are called about, roughly in order of how often they happen.
- Plugin and theme vulnerabilities. Patchstack and Wordfence publish new WordPress plugin vulnerabilities every week. Nobody picks your site out of a crowd; a script scans the whole internet for the unpatched version and finds you.
- PHP version bumps. Indian hosts move accounts to newer PHP builds on their own schedule. A theme or plugin that was abandoned by its author throws a fatal error and the site returns a white screen — on a Sunday, usually.
- SSL that half renewed. Let’s Encrypt certificates last 90 days and renew by cron. When DNS, the server or the cron changes, renewal fails silently and every visitor gets a full-page security warning. Certificate lifetimes are getting shorter, not longer, so “we renew it once a year” is on its way out as an answer.
- Contact forms that stopped sending. The most expensive failure and the quietest one. Gmail and Yahoo tightened their bulk sender rules, mail pushed through the old PHP mail() function now lands in spam or bounces outright, and enquiries vanish for months before anybody notices the phone is quieter.
- Expired API keys. Razorpay keys rotated after a staff change, a Shiprocket token that lapsed, a Google Maps key with billing switched off. Checkout, pin code serviceability and the location map fail one at a time, and each one looks like a separate small problem.
- Backups that were never restorable. Most hosting panels take backups. Very few people have ever restored one. An untested backup is a belief, not a safeguard.
- Domain and hosting expiry. Renewal reminders go to a former employee’s inbox or to the developer who built the site three years ago. A .in domain that slips into redemption costs several thousand rupees to recover, assuming it can be recovered at all.
The one check to run today
Open your website on your phone, on mobile data rather than office Wi-Fi, and submit your own enquiry form with a real message. If it does not reach the inbox and the WhatsApp number within a couple of minutes, you have been losing leads and nobody told you. Run this once a month no matter who maintains the site.
What a real care plan includes
A care plan is worth exactly what is written in it. Ask for the task list in writing before the first payment. A plan that deserves the name covers:
- Core, plugin and theme updates — applied to a staging copy first for anything that touches checkout, forms or payments, then pushed live.
- Off-site backups on a schedule (daily for stores, weekly for brochure sites), stored somewhere other than the same server, with a restore actually tested once a quarter.
- Uptime monitoring at one to five minute intervals, with the alert reaching a human on WhatsApp or SMS — not only an email inbox nobody opens at 2am.
- Malware scanning, a firewall, and login hardening: limited login attempts, two-factor on admin accounts, and no user still named “admin”.
- SSL, domain and hosting expiry tracking, with renewal dates in a calendar the vendor keeps and you can see.
- PHP and database compatibility checked before the host forces the upgrade, not after the site is down.
- A monthly quota of small content edits — price changes, a new team photo, revised timings, a festival banner.
- A monthly report: what was updated, what was held back and why, uptime for the month, backup and restore status.
What a care plan is not, and should never be sold as: SEO, new pages, a redesign, or feature development. If a vendor folds “SEO” into a ₹2,000 monthly plan, that SEO is decorative — real search work is priced on its own, and our SEO services page sets out what those monthly bands genuinely buy.
Monthly price bands and what each one buys
All figures exclude 18% GST, which any registered vendor in India charges on top.
| Monthly fee | What it realistically covers | Right for |
|---|---|---|
| Under ₹1,000 | Hosting and domain renewal, an occasional update when you complain. No monitoring, no tested backups. | Nobody, honestly. This is a renewal reminder with an invoice attached. |
| ₹1,000 – ₹2,500 | Monthly updates, weekly off-site backup, uptime monitoring, SSL and domain watch, roughly an hour of small edits, a short report. Codelith Lab’s care plan is ₹1,499 a month and sits in this band. | Brochure and service sites of 5–15 pages with a contact form and no payments. |
| ₹3,000 – ₹6,000 | Everything above, plus a staging copy for risky updates, daily backups, malware scanning with cleanup included, form deliverability checks, two to three hours of edits. | Sites that generate real enquiries, run a blog, or have several plugins doing important work. |
| ₹8,000 – ₹15,000 | Store-grade work: a monthly test order through Razorpay or UPI, courier and pin code serviceability checks, abandoned-cart and invoice flows verified, speed work, four to six hours of changes. | WooCommerce or Shopify stores where a broken checkout costs money every hour. |
| ₹20,000 – ₹25,000+ | High-traffic or custom applications: server and log monitoring, WAF tuning, database maintenance, release management, an on-call response time written into the contract. | Portals, SaaS products and anything with logins and stored customer data. |
A mobile app is a separate line entirely. App maintenance starts around ₹9,999 a month because Play Store and App Store policy changes, SDK deprecations and OS updates force real engineering work every few months — see app development for how that is scoped.
A hacked site: recovery versus prevention
This is the comparison that decides most care plan arguments. The numbers below are typical Indian market ranges, not a quotation.
| Item | Typical cost in India | Notes |
|---|---|---|
| Care plan, 12 months at ₹2,000 a month | ₹24,000 a year | Predictable, budgeted, boring. That is the point. |
| Emergency malware cleanup, one site | ₹10,000 – ₹40,000, one time | Upper end when the entry point is unknown or the site was reinfected after a first cleanup. |
| Blacklist removal and Search Console clean-up | Included by some, ₹5,000 – ₹10,000 by others | Google’s review takes days. You cannot pay to speed it up. |
| Rebuild when nothing is recoverable | A fresh build — see web development in India for current bands | You also lose the old content and photos unless a backup exists somewhere. |
| Enquiries lost while the site is flagged | Not on any invoice | Usually the largest number in this table, and the only one nobody measures. |
Two Indian specifics worth knowing. First, hosts here suspend accounts quickly when a hacked site starts sending outbound spam — your site goes fully offline, not just infected. Second, once the domain is on a spam blocklist, your ordinary business email stops delivering too, so quotations and invoices bounce while you are still fixing the website. And the classic symptom to watch for is spam pages in Google: search site:yourdomain.com and look for Japanese, pharmacy or betting pages you never wrote.
Nine checks on your current vendor
Run these in an hour. They cost nothing and they settle the question of whether you are paying for work or for a subscription.
- Ask for last month’s report. No report means no plan, whatever the invoice says.
- Log in to the admin panel and open the updates screen. Plugins several versions behind, or last updated by their author two years ago, tell you the truth.
- Ask them to restore last week’s backup to a staging URL within 24 hours. This is the single best test in the list.
- Click the padlock in your browser and read the certificate expiry date. Then run a public whois on your domain and confirm the registrant email is yours.
- Submit your own contact form from mobile data and confirm the enquiry reaches both email and WhatsApp.
- Check the PHP version in the hosting panel. In 2026 it should be 8.2 or newer.
- Ask for the uptime monitor’s public status link. A monitor you cannot see does not exist.
- Confirm ownership: domain, hosting, Google Analytics and Search Console must be in your name and email. We create every account in the client’s name for exactly this reason, and it matters most on small business websites where one developer often holds everything.
- Search site:yourdomain.com on Google and count the pages. If the number is far higher than the pages you built, you have already been hacked.
When you should not buy a care plan
Several situations where the honest answer is to keep your money.
- A static HTML site with no plugins and no forms. There is nothing to patch. Pay for hosting and domain renewal, and buy an hour of somebody’s time once a year.
- Shopify or Wix. The platform handles core updates, server security and SSL itself. You may still want hours for content, checkout testing and speed, but do not pay WordPress-sized security fees for a platform that patches itself.
- A site that earns you nothing and you know it. Keep the domain renewed, keep one final backup, and stop the monthly outflow until you have a reason to restart it.
- A responsive freelancer at ₹1,000 who actually replies beats an agency at ₹5,000 that sends a PDF. Judge on response time and on the restore test, not on the size of the company.
The limits of our own plan, stated plainly: ₹1,499 a month buys about an hour of attention. That is right for a brochure site and wrong for a 100-product store taking payments — for that we will quote a higher band or tell you to keep your existing vendor. Emergency cleanup of a site we did not maintain is quoted separately, because inheriting somebody else’s compromised server is a project, not a monthly task. We are a registered company in Pune working with clients across India, and every invoice carries GST at 18%, which also means the tax is visible rather than absorbed into a round number. If your requirement is closer to a platform than a website, that sits under custom software and is maintained differently again.
The short version
- Expect ₹1,500 to ₹5,000 a month plus GST for a normal business site; ₹8,000 and up if it takes payments.
- A plan without tested restores, uptime alerts and a monthly report is not a care plan — it is a hosting renewal.
- Cleaning up one hack costs more than a year of prevention, and the lost enquiries cost more than both.
- Test your own contact form monthly, and make sure the domain, hosting and analytics accounts are in your name.
Frequently asked questions
How much does website maintenance cost per month in India?
Most small business sites cost ₹1,500 to ₹5,000 a month plus 18% GST. Simple brochure sites can sit near ₹1,000. WooCommerce and Shopify stores usually need ₹8,000 or more, because payment, courier and checkout flows have to be tested every month. High-traffic portals and custom applications run to ₹25,000. Below ₹1,000 a month you are generally paying for hosting renewal rather than maintenance.
Do I need a care plan if my site is on Shopify or Wix?
Not the same one. Those platforms handle server security, core updates and SSL themselves, so nobody needs to patch software on your behalf. You may still want a few hours a month for content edits, checkout testing, app conflicts and speed work. Pay for those hours honestly as content and support time, rather than a WordPress-style security plan you do not actually need.
What is included in website maintenance charges?
At minimum: core, plugin and theme updates, off-site backups with a restore tested every quarter, uptime monitoring that alerts a human, malware scanning and login hardening, SSL and domain expiry tracking, PHP compatibility checks, a small quota of content edits, and a monthly report. It should not include SEO, new pages or a redesign. Those are separate projects with separate prices, and bundling them usually means neither is done properly.
How much does it cost to fix a hacked WordPress site in India?
Cleanup for a single site is typically ₹10,000 to ₹40,000, and the higher end applies when the entry point is unknown or the site was reinfected after a first attempt. Add time for Google Safe Browsing and Search Console clean-up, plus a possible hosting suspension while the host stops outbound spam. The real cost is the enquiries lost while visitors see a browser warning, which no invoice ever records.
Is GST charged on website maintenance in India?
Yes. Maintenance is a service, and a registered vendor charges 18% GST on top of the monthly fee, so a ₹2,000 plan invoices at ₹2,360. If your business is GST registered and the website is used for business, that tax is normally available as input credit — confirm the treatment with your accountant. Insist on a proper GST invoice; a vendor who cannot raise one is usually a risk in other ways too.