What does it actually cost to maintain a website in the Philippines?

The call always sounds the same

A client rings on a Tuesday, and the site has been down since Saturday. Or the padlock has vanished from the address bar and Chrome is now warning visitors away from them. Or the homepage is quietly serving pharmaceutical spam in a language nobody at the company speaks.

Somewhere in the first minute, we get the same sentence.

“But we did not change anything.”

Which is usually true, and is also the reason it happened. A website is not an appliance you buy once and switch on. It sits on rented infrastructure, it runs code borrowed from several hundred strangers, and it holds a certificate that expires on a schedule set by a standards body in another hemisphere. All three of those keep moving whether or not anybody at your company logs in.

So when a business tells us it would rather skip maintenance and save the money, we do not argue the point. We show them the bill they are already paying, which is what the rest of this post is.

The short answer: keeping a business website alive in the Philippines costs roughly ₱12,000 to ₱41,000 a year if you pay only for infrastructure, and ₱60,000 to ₱360,000 a year once a team is genuinely responsible for it. The gap between those two figures is the work, and it is the line most proposals leave out.

What hosting actually costs after the first term

We keep client sites on three things, mostly. SiteGround for WordPress, Webflow for the sites we build there, and AWS when a project needs infrastructure of its own. So instead of quoting the cheapest hosting on the market, here is what our own stack costs, which is the number that matters if you are buying the kind of site we build.

Start with SiteGround, because the pattern there catches people out, and it catches them out at a host we choose and recommend. Prices from their WordPress plans on 10 August 2026, prepaid for twelve months and before VAT:

• StartUp: $3.99/mo for the first term, renews at $17.99/mo. 4.5x
• GrowBig: $6.69/mo, renews at $29.99/mo. 4.5x
• GoGeek: $10.69/mo, renews at $44.99/mo. 4.2x

At ₱60.83 to the dollar, GrowBig is about ₱1,824 a month once the introductory year is over. That is roughly ₱21,900 a year for hosting alone, on a plan whose first year suggested ₱4,900. GrowBig is where most of the business sites we manage sit, so this is not the bottom of the market, it is the middle of it.

None of this is hidden. The renewal rate sits on the pricing page in plain text, and SiteGround is worth its money, which is why we still put clients there. It is simply that people budget from the number on the button, and the number on the button is designed to be the one you remember.

Webflow prices more plainly. Its Site plans today are Basic at $15 a month billed yearly and Premium at $25, which works out to about ₱910 and ₱1,520 a month with no renewal cliff behind them. Worth noting if you were quoted a while back: Webflow folded its old CMS and Business tiers into that single Premium plan earlier this year, so the line item on your renewal may have changed names since you signed.

AWS is the one that resists a list price, because you are billed for what you use rather than for a plan. To put a floor under it: a Lightsail instance big enough to carry a real business site runs $12 to $44 a month, a managed database starts at $15, a load balancer at $18, and DNS is $0.50 per hosted zone. A modest production setup therefore lands somewhere around $27 to $45 a month, or ₱1,600 to ₱2,700, and a busy one costs considerably more. The trade is control and headroom, and it is the right answer for some projects and overkill for most.

Then there is the domain, where Philippine businesses get a surprise that businesses elsewhere do not. A .com renews for roughly ₱500 to ₱1,500 a year. A .ph costs several times that. Checking international registrars this month, Dynadot renews a .ph at $46 a year and Gandi at $127.98, which is somewhere between ₱2,800 and ₱7,800. We still think carrying the national extension is worth it for a Philippine company. We would just rather you put it in the budget than meet it in an email eleven months from now.

Add those together and the range is about ₱12,000 a year at the low end, for a Webflow Basic site on a .com, up to roughly ₱41,000 for a site on SiteGround GoGeek or a small AWS setup carrying a .ph domain.

All of which pays for the site to exist. None of it pays for anyone to look after it.

Why “our host handles security” is the expensive assumption

Most owners we meet believe their hosting plan is doing more than it is, and there is now good data on the gap.

Patchstack’s State of WordPress Security in 2026 logged 11,334 new vulnerabilities across the WordPress ecosystem during 2025, up 42 percent on the year before. Where they were found matters more than how many:

• 91 percent were in plugins, 9 percent in themes
• 6 were in WordPress core itself, all of them low risk
• 46 percent had no patch available on the day they were made public

So the risk is rarely the platform. It is the plugins a site collects over the years, and particularly the ones whose developers have gone quiet. For nearly half of these flaws, the fix did not exist on the day attackers learned about them.

Then there is how fast it moves. Patchstack measured a weighted median of five hours between public disclosure and mass exploitation, with roughly half of high-impact flaws under attack inside a day. Against a five-hour clock, checking in on the site once a month is not a security posture, it is a coin toss.

The fallback most owners assume will cover them turns out to be thin as well. When Patchstack tested hosting-level defences, the firewalls bundled into your plan, they blocked 26 percent of attacks overall, and only 12 percent of attacks using vulnerabilities already known to be exploited.

The older pattern has not changed either. Sucuri’s 2023 threat report, drawn from 39,594 sites its team cleaned, found 39.1 percent of CMS installations were out of date at the point of infection. Almost none of it involves a sophisticated attack. It is mostly a matter of updates that nobody got around to installing.

SSL is no longer a set-and-forget purchase

If you have not thought about your certificate since launch, this is the year that changes. The CA/Browser Forum, which sets the rules every browser follows, passed Ballot SC-081v3 to shorten certificate lifetimes on a fixed schedule: 200 days from 15 March 2026, 100 days from 15 March 2027, and 47 days from 15 March 2029.

A certificate you used to renew once a year now needs renewing roughly twice, and by 2029 about eight times. Handled automatically, this costs you nothing and you will never think about it again. Left to a person to remember, it is a full-width browser security warning sitting on your homepage, waiting for the week that person is on leave.

If your site collects personal data, you are on a 72-hour clock

One more cost lands here, and it is not a technical one.

If your site takes personal data through a contact form, a booking page, or a newsletter signup, you are a personal information controller under the Data Privacy Act. Where a breach involves sensitive personal information and creates a real risk of serious harm, the National Privacy Commission has to be notified within 72 hours of you knowing about it, with the full report due five days after that.

Seventy-two hours is not long to establish what happened. It is a good deal shorter when the honest answer is that nobody has logged into the site since 2023 and there are no backups to compare anything against. Part of what you buy with maintenance is simply a record of what normal looked like, so that when something changes you can prove it.

What a maintenance plan costs

Professional maintenance in the Philippines runs ₱5,000 to ₱30,000 a month depending on scope, the same range we published in our guide to website costs. Broadly:

• ₱5,000 to ₱10,000 for a brochure site. Managed hosting, uptime monitoring, backups, core and plugin updates, SSL handled, small content edits.
• ₱10,000 to ₱20,000 for a content-driven business site. Everything above, plus performance work, a staging environment so updates are tested before they go live, security scanning, and monthly reporting written to be read.
• ₱20,000 to ₱30,000 and up for e-commerce, membership, or anything taking payments, where an hour of downtime has a peso value somebody can calculate.

Those figures look heavy sitting next to a one-time build, and we would rather say so plainly than talk around it. A year of middle-tier maintenance on a ₱250,000 site is a real fraction of what the site cost to make in the first place.

The build is the wrong thing to measure it against, though. A middle-tier plan is about ₱500 a day. Cleaning a compromised site, sitting out a Google security warning while enquiries dry up, and reporting a breach to the NPC will cost considerably more than that, and it arrives inside one week instead of spread across twelve months.

If you are not ready for a retainer

We would genuinely rather you do this yourself than not do it at all, so here is the honest minimum.

Turn on automatic updates for WordPress core and for plugins whose developers still ship regular releases. Delete every plugin you are not using, because deactivated is not the same as removed and the code is still sitting on the server. Keep backups somewhere that is not the same server as the site, and restore one into a test environment at least once, so you know the backup actually works before you need it to. Put the domain and certificate renewal dates in a calendar that somebody other than you can see. And give one named person responsibility for the site, because “the agency who built it” stops being an answer the moment nobody is paying them.

That list is not a managed plan and will not perform like one. It will keep you off the Tuesday phone call.

Questions we get asked

Is maintenance included in the build cost?

Usually not, and you should assume it is not unless the proposal says so in writing. Ask what happens on day 31 after launch, and who specifically is responsible for updates, backups, and uptime. If a team cannot answer that cleanly, they have not thought past the launch date. Our post on how a Dthree project actually starts covers what we put in writing.

We are on Webflow. Do we still need maintenance?

Less of it, and that is a genuine advantage of the platform. Webflow handles hosting, SSL, and platform security itself, and there is no plugin ecosystem underneath you to patch. What is left is content, performance, forms, integrations, and SEO upkeep, so plans sit toward the lower end of the range. We go through the trade-offs in our Webflow, WordPress, and Shopify comparison.

Our site has never had a problem. Why start now?

Because “nothing has gone wrong yet” and “nothing is exposed” are two different situations, and only one of them can be seen from the outside. If nobody has reviewed the site in over a year, a paid audit is the cheap way to find out which one you are in. Our post on the signs a site needs a redesign covers what we look at.

What to budget

A website is an asset with a running cost, in the same way a company vehicle is. The businesses that get the most out of theirs are the ones that budget for the year rather than for the launch.

If you are not certain what your site currently costs to keep alive, or who is responsible for it when something breaks, we are happy to take a look. Our maintenance and support and hosting work exists for exactly this, and the first conversation costs nothing. Talk to us and we will tell you what you actually need before we tell you what it costs.