Website Maintenance Services in Mumbai
Website maintenance costs ₹1,500 – ₹6,000 a month depending on how much the site does and how much attention it needs. Maintenance is not “occasional edits”. It is the work that keeps a site online, secure, fast and current — plugin and core updates tested before they go live, off-server backups you could actually restore from, uptime and malware monitoring, and someone answering when something breaks.
The reason it matters is unglamorous: most website disasters we get called into are not sophisticated attacks. They are an unpatched plugin, an expired hosting invoice, or a backup nobody had ever tested. All three are cheap to prevent and expensive to fix.
Key takeaways
- Updates should be tested on staging first. Auto-updating a live site is how a working checkout becomes a white screen at 11pm.
- A backup on the same server is not a backup. If the server is compromised or fails, both copies go together.
- An untested backup is a hope, not a plan. Restores get verified, or they do not count.
- Most hacks exploit known, already-patched vulnerabilities in plugins that were several versions behind.
- Maintenance is not SEO and not new development. Anyone bundling all three into one ₹3,000 fee is not doing all three properly.
On this page
What maintenance actually covers
| Task | Frequency | Why it matters |
|---|---|---|
| Core, theme and plugin updates | Monthly; security patches immediately | Nearly all WordPress compromises exploit vulnerabilities that were already patched. Being current is the single largest security factor. |
| Staging test before every update | Every update batch | Updates occasionally break layouts, forms or checkouts. Finding that on staging costs an hour; finding it on production costs sales. |
| Off-server backups | Daily for stores, weekly for brochure sites | Stored away from the web server, so a server failure or compromise cannot take both copies at once. |
| Restore verification | Quarterly | A backup nobody has restored is an assumption. We restore to a scratch environment and confirm it actually works. |
| Uptime monitoring | Continuous, checks every 1–5 minutes | So you learn the site is down from us, not from a customer. |
| Malware and file-change scanning | Daily | Injected spam links and redirect scripts often run for weeks unnoticed, quietly destroying search visibility. |
| SSL and domain expiry watch | Continuous | An expired certificate throws a browser security warning at every visitor. An expired domain is considerably worse. |
| Database optimisation | Monthly | Post revisions, expired transients and orphaned meta accumulate and slow queries down over time. |
| Broken link and 404 check | Monthly | Catches dead internal links and missing pages before they cost you rankings or enquiries. |
| Form and checkout testing | Monthly, and after every update | Silently broken contact forms are the most expensive fault on any website, because nothing appears wrong. |
| Content edits | Within the plan’s hours | Text changes, new images, price updates, adding a page, seasonal timings. |
| Monthly report | Monthly | What was updated, what was found, uptime percentage, backup status. Written so you can read it in two minutes. |
Plans and pricing
| Plan | Suits | Included | Price / month (ex-GST) |
|---|---|---|---|
| Essential | Brochure and starter sites, 3–10 pages | Monthly updates tested on staging, weekly off-server backups, uptime monitoring, malware scanning, SSL and domain watch, up to 1 hour of content edits, monthly report | ₹1,500 – ₹2,500 |
| Business | Active business sites, 10–30 pages, running ads or SEO | Everything in Essential plus fortnightly update cycles, daily backups, database optimisation, broken-link checks, form and speed checks, up to 3 hours of edits, priority response | ₹3,000 – ₹4,500 |
| eCommerce / Advanced | WooCommerce stores and sites with logins or bookings | Everything in Business plus daily backups with database snapshots, checkout and payment-gateway testing after every update, order-flow monitoring, staging environment kept in sync, up to 5 hours of edits, same-day response on weekdays | ₹5,000 – ₹6,000 |
| Emergency recovery | Hacked, blacklisted or down sites, one-off | Malware removal, clean reinstall of core and plugins, hardening, Search Console security review submission, blacklist removal requests | ₹8,000 – ₹25,000 one-time |
| Speed optimisation | Slow existing sites, one-off | Image and asset audit, caching and compression, plugin rationalisation, Core Web Vitals pass, before-and-after measurements | ₹8,000 – ₹20,000 one-time |
Excludes GST. Hosting is billed by your host directly, in your name — we never resell hosting, so there is nothing you must keep buying from us to keep the site online. Plans are monthly and can be stopped with 30 days’ notice; every build we do includes 30 days of support whether or not you take a plan.
Be careful with maintenance plans that bundle in “SEO” for a few hundred rupees extra. Real SEO work — content, technical fixes, links — cannot be delivered meaningfully inside a ₹3,000 monthly fee that also has to cover updates, backups and monitoring. What usually gets delivered instead is an automated rank report and no work. We keep the two separate so you can see what you are paying for, and so neither quietly subsidises the other.
Backups done properly
Three rules, and almost every site we inherit breaks at least one:
- Off the web server. A backup sitting in a folder on the same server dies with the server. Ours go to separate object storage or cloud drive.
- Files and database together, from the same moment. A file backup from Tuesday restored against a database from Thursday produces a site that is broken in ways that take hours to unpick.
- Restored at least once. Quarterly, we restore your most recent backup into a scratch environment and check the front page, a form and — for stores — an order record. Until a backup has been restored, it is an untested assumption.
Retention is 30 days rolling as standard, with one monthly snapshot kept for a year. For stores we keep hourly database snapshots for the most recent 48 hours, because a day of lost orders is not recoverable from anywhere else.
Not sure whether your site is being looked after?
Send us the URL. You get an honest read on update status, backup arrangement, security exposure and mobile speed — and a plain recommendation, including when the answer is that you do not need us.
Security in practice
Stay patched
The overwhelming majority of compromises exploit a known vulnerability in an outdated plugin. Prompt, tested updates prevent more incidents than every other measure combined.
Remove what you do not use
Deactivated plugins still sit on disk and can still be exploited. Unused plugins and themes get deleted, not merely switched off.
Real login discipline
No user called admin, strong unique passwords, two-factor for administrators, and login-attempt limiting. Cheap, and it closes off brute-force entirely.
Correct file permissions
Directories at 755, files at 644, file editing disabled from the dashboard, PHP execution blocked inside the uploads folder.
Least-privilege accounts
Your content person is an Editor, not an Administrator. Former staff and former agencies get removed the day they leave.
Watch for change
Daily file-integrity scanning, because an injected redirect or spam-link block can run for weeks before anyone notices what it has done to your rankings.
Speed and Core Web Vitals
Sites get slower over time on their own — more plugins, larger images uploaded straight off a phone, extra tracking scripts added and never removed. Maintenance includes measuring this monthly rather than discovering it a year later.
| Metric | Target | Usual cause when it fails |
|---|---|---|
| Largest Contentful Paint (LCP) | Under 2.5s | An enormous uncompressed hero image, or a slow shared host |
| Interaction to Next Paint (INP) | Under 200ms | Too much JavaScript, usually from page builders and sliders |
| Cumulative Layout Shift (CLS) | Under 0.1 | Images without width and height, or web fonts loading late |
| Total page weight | Under 1.5 MB | Original-resolution photographs, multiple font families, embedded video |
| Requests | Under 60 | Plugin sprawl, each adding its own CSS and JS to every page |
Plugin count is the health metric we watch most closely. Between eight and fourteen active plugins is a healthy WordPress site; thirty-five is a performance and security problem waiting for a date. The reasoning is on the WordPress website design page.
What is not included
Being explicit about this saves arguments later. Maintenance plans do not cover:
- New development — new page templates, new functionality, a new module. Quoted separately.
- Redesigns. Covered on the website redesign page.
- SEO and content marketing. A separate engagement, deliberately.
- Ad campaign management. Also separate.
- Hosting. Billed by your host, in your name. We will recommend one and configure it, but we do not resell it.
- Third-party licence fees for premium themes or plugins you use. We will tell you which are genuinely needed.
- Recovery from a compromise that predates the plan. Quoted as emergency recovery, then the plan starts on a clean site.
If you would rather do it yourself
Not every business needs a plan, and we would rather say so. If your site is a small brochure site and you are comfortable in the dashboard, here is a monthly routine that covers most of the risk:
- Take a full backup — files and database — and download it somewhere off the server.
- Update plugins in small batches, checking the front page and one form after each batch.
- Update the theme, then core.
- Submit your own contact form and confirm the email arrives. Do this every month without exception.
- Delete any plugin you are not using, rather than leaving it deactivated.
- Check that the padlock is present and note your SSL and domain renewal dates in a calendar.
- Run the homepage and one interior page through PageSpeed Insights on mobile and note the score, so you can see drift.
- Once a quarter, actually restore a backup somewhere and confirm it works.
If that list makes you uneasy, or if your site takes orders and bookings, a plan is cheaper than the first incident.
Frequently asked questions
How much does website maintenance cost in Mumbai?
₹1,500 – ₹2,500 a month for a brochure site, ₹3,000 – ₹4,500 for an active business site, and ₹5,000 – ₹6,000 for a WooCommerce store or a site with logins and bookings. One-off emergency recovery for a hacked site is ₹8,000 – ₹25,000 and speed optimisation is ₹8,000 – ₹20,000. Excludes GST and hosting.
Do I really need a maintenance plan?
If your site takes orders, bookings or logins, yes — the cost of a plan is a fraction of one bad day. If it is a small brochure site and you are comfortable updating plugins and taking backups yourself, a disciplined monthly routine covers most of the risk. We would rather tell you that than sell you a plan you do not need.
What happens if my site gets hacked?
We remove the malware, reinstall core and plugins cleanly from official sources rather than trying to clean infected files, change every credential, harden the installation, then submit a security review through Search Console and request removal from any blacklists. That is ₹8,000 – ₹25,000 depending on severity. If you are on a plan when it happens, recovery is included.
Why can’t I just enable automatic updates?
Because updates occasionally break things, and automatic updates break them on your live site with nobody watching. A plugin update that changes a CSS class can collapse a layout; one that changes a hook can silently stop your contact form emailing. Testing on staging first turns a lost weekend into a fifteen-minute non-event.
Isn’t my hosting company already backing up my site?
Often yes, but check three things: whether the backup is stored off the web server, whether it includes the database, and whether you can actually restore it yourself. Many host backups are on the same machine, retained for only a few days, and require a support ticket to restore. Treat host backups as a second layer, not your only one.
Does maintenance include SEO?
No, deliberately. Real SEO work cannot be delivered inside a fee that also has to cover updates, backups, monitoring and edits — what usually gets delivered instead is an automated rank report. We keep them separate so you can see exactly what each is buying. Maintenance does include the technical hygiene SEO depends on: speed, uptime, broken links and clean indexing.
Can you maintain a site someone else built?
Yes, and most of our maintenance clients are in exactly that position. We start with an audit — update status, plugin health, backup arrangement, security exposure, speed — fix what needs fixing as a one-off, then start the plan on a stable site. We will also tell you honestly if the site is in a state where maintaining it costs more than replacing it.
How many content edits are included?
One hour a month on Essential, three on Business, five on eCommerce/Advanced. That comfortably covers text changes, new images, price updates and seasonal timings. Anything structural — a new template, new functionality — is quoted separately so you are never surprised by an invoice.
How fast do you respond when something breaks?
Same working day on Business and Advanced plans, next working day on Essential. For a site that is completely down we treat it as urgent regardless of plan, because a down site is not a ticket. WhatsApp is the fastest way to reach us.
Are you locking me in?
No. Plans are monthly with 30 days’ notice, your domain and hosting are in your own name and paid directly by you, and you hold the admin credentials throughout. If you leave, the site keeps working and nothing switches off. That is deliberate — lock-in through hosting resale and withheld credentials is one of the practices we built our process against.
My site is very slow. Is that a maintenance issue?
Partly. Sites drift slower as images and plugins accumulate, and maintenance measures that monthly so it does not surprise you. But fixing an already-slow site is separate work: ₹8,000 – ₹20,000 for an image and asset audit, caching and compression, plugin rationalisation and a Core Web Vitals pass, with before-and-after numbers so you can see what changed.
Do you maintain sites that are not WordPress?
WordPress and WooCommerce are our main work. We also maintain Shopify stores at the content and app level, and static or custom sites case by case. If a site is built on a framework we cannot support properly, we will say so rather than take the fee and hope.
Care plans from ₹1,500 a month
Updates tested before they go live, backups you could actually restore, and someone who answers when something breaks.
Related reading
- Website design services in Mumbai — packages, process and coverage.
- WordPress website design in Mumbai — plugin discipline and stack choices.
- Website redesign services in Mumbai — when maintenance is no longer enough.
- Website design cost in Mumbai — including real first-year running costs.
- eCommerce website development in Mumbai — store-specific maintenance needs.
- All our Mumbai resources — every guide and service page in one place.
