Website & Ecommerce Lesgo Media · 2026
- RM300-RM800domain and hosting per year
- RM2,500-RM6,000lead-gen site upkeep per year
- RM1,500-RM5,000cleanup after a hack
Most owners budget for a website once. They approve the build, pay the invoice, watch it go live, and file it under done. Then month thirteen arrives with four small charges nobody planned.
None of those charges are unfair. They were always going to happen. They just never appeared on the quotation, because a build quote covers building, not keeping it alive afterwards.
This article lists every line in that bill, gives three budget tiers, and covers what vendors rarely write down: what happens if you pay nothing.
The ten line items a build quote leaves out
An annual website bill is not one payment. It is a scatter of small ones landing in different months, which is why it feels invisible right up until they all arrive together.
For a normal WordPress business site the full list runs: domain renewal, hosting renewal, SSL certificate, paid plugin licences, theme licence, offsite backup storage, security monitoring, uptime monitoring, the labour of updating WordPress and plugins, and content edits across the year. Ten lines. Most build quotes mention two.
The short version
- RM300 to RM800 a year covers domain and hosting, nothing else.
- Almost every paid plugin and theme licence renews automatically.
- The largest cost in maintenance is human time, not subscriptions.
- A backup sitting on the same server as your site is not a backup.
Split the bill into two groups and it gets easier to plan. The first group runs itself as long as your card is valid, and that half is cheap and predictable. The second group needs a person sitting at a keyboard, and that is what decides whether your year costs RM800 or RM8,000.
Domain renewal and the hosting price jump after year one
Domains are the easy part. Exabytes lists .MY at RM89 a year and .COM.MY at RM59.90 for registration, noting that renewal reverts to standard pricing after the first term. Budget RM60 to RM150 a year and you are covered.
Hosting is where owners get caught. The price in the advertisement is usually a first-year promotional rate, often on a three-year contract paid upfront. Year two returns to list price, and a jump of two to three times is normal in this industry.
When you compare hosting plans, ignore the first-year number. Ask support what year two costs. A provider who will not put that figure in writing has told you something already.
One more thing owners forget: whose name is on the account. If domain and hosting sit under your vendor’s account, you pay a markup and you are tied to them the day you want to move. Both should be registered to your business from day one, even if the vendor handles billing and technical work.
SSL is free, backups are not, and where backups actually live
SSL should cost nothing. Let’s Encrypt states in its FAQ that it does not charge a fee for certificates, valid for 90 days. Most Malaysian hosts offer it inside cPanel with automatic renewal. If a vendor bills RM300 a year for a standard certificate, ask what you are paying for.
Paid certificates still have a place, usually for larger stores wanting a warranty or organisation validation. For most sites, free is fine.
Backups are where owners most often fool themselves. Nearly every host offers daily backups, and nearly all store them on the same infrastructure as your site. When that server fails, the backups go with it.
- Backups must be offsite. Google Drive, S3, anywhere that is not your hosting server.
- Backups must be automatic. Anything relying on your memory fails in the month you are busiest.
- Backups must be tested. Restore to staging yearly. An untested backup is a file you hope works.
- Keep 30 days minimum. Hacked sites are usually infected for weeks before anyone notices.
Proper offsite backup runs RM150 to RM900 a year depending on database size and snapshot frequency. For a busy store, plan for the expensive end.
Plugin and theme licences that renew whether you notice or not
This category is easy to miss because the amounts are small and spread across the calendar. Elementor lists its Essential plan for one website at USD49 a year. WP Rocket lists a single-site licence at USD59 a year, and its pricing page states the licence renews automatically.
A typical Malaysian business site runs two to six paid plugins: page builder, caching, forms, SEO, backups, sometimes booking or membership. Added up, that lands around RM400 to RM1,500 a year depending on the count and the ringgit rate when you are charged.
The danger here is not really the cost. It is a licence lapsing unnoticed. The plugin keeps working, it just stops receiving security updates. The site looks fine for months while a hole patched for everyone else stays open on yours.
Keep one spreadsheet with plugin name, renewal date, price and card charged. Ten minutes of work that saves a day of panic later.
Skipping updates is how business sites get defaced
WordPress core, themes and plugins release updates throughout the year. Some add features. Most of them patch security holes that have already been disclosed in public.
That disclosure is the part owners miss. When a plugin vulnerability is patched, its details become public. Within days, bots scan the internet for sites still running the old version. Those bots do not know who you are and do not care how small your business is.
Malaysian SME sites are rarely hacked because someone targeted them. They are hacked because they were found. The result is usually not dramatic data theft but spam pages for pharmaceuticals and gambling injected into your site, or a quiet redirect sending mobile visitors elsewhere.
Doing updates properly is not clicking a button. It is backing up first, updating on staging, checking that forms and checkout still work, then pushing live. An hour a month is enough for a brochure site. For a store with payment and shipping integrations, plan two to four hours a month.
That is why this line costs the most. At normal Malaysian developer rates, managed updates run RM600 to RM4,800 a year depending on site complexity.
Security monitoring, uptime alerts, and the bill after a hack
Uptime monitoring is the cheapest thing here and the most often skipped. Free services ping your site every five minutes and alert you when it goes down. Without one you depend on customers telling you, and they usually do not. They go to a competitor.
Security monitoring scans files for suspicious changes and blocks bad traffic before it ever reaches WordPress. Paid single-site plans sit around RM150 to RM1,200 a year.
Now the uncomfortable part. If a site is hacked and you hold a clean, tested backup, recovery takes hours and costs RM1,500 to RM5,000 for cleanup, malware removal, and a review request to Google if the site got flagged.
If no backup exists or none restore, you are not cleaning. You are rebuilding, and the price returns to the original build range of RM3,500 to RM8,000 for a full business website. A year of monitoring costs a fraction of that.
Content edits, and choosing between a retainer and paying ad hoc
Every business changes small things during the year. A new phone number, a service added, prices raised in a package, a team photo swapped, an expired promotion pulled. Each is minor. Over twelve months it becomes real work.
Two ways to pay for it, and the answer depends on how often your site changes, not how large your business is.
| Model | Typical cost | Suits | Risk |
|---|---|---|---|
| Ad hoc, pay per job | RM120 to RM250 per hour | Under 6 changes a year, simple site | Nobody owns updates. Slow response in an emergency. |
| Monthly retainer | RM250 to RM1,200 a month | Monthly changes, live traffic or ads running | You pay in quiet months too. |
| Annual care plan | RM1,200 to RM6,000 a year | Managed updates and backups, you edit content | Capped hours. Read the scope carefully. |
Our call: if your site takes leads or has ad spend pointed at it, take the retainer. Downtime on a site burning ad budget costs more than the fee. For a brochure that rarely changes, ad hoc works if automatic backups and scheduled updates are in place. The warning signs of a site needing a redesign usually show up first as deferred maintenance.
What happens if you pay nothing at all
Owners think this quietly and rarely ask a vendor. The site does not die at once. It decays in a predictable order.
- Months 1 to 6. Nothing happens. The site runs normally. This is the misleading part.
- Months 6 to 12. Plugin licences lapse and updates stop. Some plugins start conflicting with the newer PHP version your host rolled out.
- Months 12 to 18. The enquiry form quietly stops sending email. You find out when a customer calls asking why nobody replied.
- Months 18 to 24. A bot finds an old vulnerability. Spam pages get injected or the site redirects. Google flags it and traffic drops.
- When the domain expires. The site disappears, business email on that domain dies too, and recovery depends on the registrar grace period.
The costliest item is usually not the hack. It is the form that died silently for six months. Nobody can count those leads, because no record exists.
Recovery is not symmetrical with prevention. A maintained year on a lead-gen site runs RM2,500 to RM6,000. One cleanup after a hack runs RM1,500 to RM5,000, a rebuild with no backup RM3,500 to RM8,000. Save one year, repay it in one incident.
Three tiers and a one-page annual budget you can copy
These three profiles cover most Malaysian businesses, and what separates them is how much can break.
Brochure site. Five to ten pages, rarely edited. Annual bill RM800 to RM2,000. Many web design packages cover year one.
Lead-gen site. Blog, campaign landing pages, tracking, CRM or WhatsApp integration. Annual bill RM2,500 to RM6,000. These usually have ads pointed at them, so downtime costs real money.
Online store. Payment gateway, shipping, inventory, customer accounts. Annual bill RM6,000 to RM15,000. Every update is tested through checkout, and the platform shapes the bill, as in our WooCommerce and Shopify piece.
| Line item | Brochure | Lead-gen | Store |
|---|---|---|---|
| Domain renewal | RM60-RM150 | RM60-RM150 | RM60-RM150 |
| Hosting renewal | RM240-RM650 | RM600-RM1,500 | RM1,200-RM3,600 |
| SSL | RM0 | RM0 | RM0-RM400 |
| Plugin and theme licences | RM0-RM500 | RM400-RM1,200 | RM800-RM1,500 |
| Offsite backups | RM150-RM300 | RM200-RM600 | RM400-RM900 |
| Uptime and security monitoring | RM0-RM350 | RM150-RM800 | RM400-RM1,400 |
| Update and test labour | RM600-RM1,200 | RM1,200-RM3,000 | RM2,400-RM4,800 |
| Content edits | RM0-RM400 | RM400-RM1,200 | RM600-RM2,000 |
| Annual total | RM800-RM2,000 | RM2,500-RM6,000 | RM6,000-RM15,000 |
How to use this table
- Low end if you update the site yourself, high end if a vendor does it.
- Keep a contingency worth one month.
- Under RM800 total means the full bill has not arrived.
Before signing a care plan, ask for scope in writing: hours per month, emergency response, where backups live, who holds the accounts. A cheap price without those answers means nothing, as in what an RM500 website buys.
Nak tahu angka sebenar untuk business anda?
Hantar detail ringkas. Kami semak akaun atau website anda, pastu tunjuk di mana duit bocor dan apa langkah paling berbaloi seterusnya.
Frequently asked questions about website maintenance cost
How much does website maintenance actually cost per year in Malaysia?
Budget RM800 to RM2,000 a year for a brochure site, RM2,500 to RM6,000 for a lead-gen site, and RM6,000 to RM15,000 for an online store. If you pay only for domain and hosting and do the rest yourself, you can run at RM300 to RM800.
Why did my hosting bill go up in the second year?
Because the first-year price is usually promotional. Year two returns to list price, and a jump of two to three times is normal. Before signing, ask support what year two costs. A provider who will not put that in writing should worry you.
Do I need to pay for an SSL certificate?
For most business websites, no. Let’s Encrypt states in its FAQ that it does not charge a fee for certificates, and those are valid for 90 days. Most hosts renew them automatically. Paid certificates are worth it only for organisation validation or a warranty.
Are my host’s backups good enough?
Usually not. Most host backups sit on the same infrastructure as your site, so when that server fails, the backups go with it. Keep a copy on Google Drive or S3, make it automatic, and restore to staging yearly to confirm it works.
What happens if I never update WordPress?
The site does not die immediately, which is the misleading part. Within six to twelve months licences lapse and updates stop. After that, bots scanning the internet find an old vulnerability already disclosed publicly, and spam pages get injected into your site.
Monthly retainer or pay when something breaks?
If your site takes leads or has ad spend pointed at it, take the retainer. Downtime on a site burning ad budget costs more than the fee. For a brochure that rarely changes, ad hoc at RM120 to RM250 an hour makes more sense.
What does it cost to recover a hacked website?
With a clean, tested backup, cleanup runs RM1,500 to RM5,000 including malware removal and a review request to Google. Without a backup that restores, you are rebuilding, which returns to the RM3,500 to RM8,000 range for a business website.
Does maintenance include SEO and new content?
No. Maintenance keeps the site alive, secure and working. SEO and new content are marketing work on a separate budget. A care plan covers small edits such as a phone number or price. If a vendor claims SEO is included, ask what they do.
Conclusion: treat maintenance as a fixed cost, not an emergency
Website maintenance cost is not a mystery figure. It is ten lines you can write down today and slot into the annual budget alongside rent or insurance. RM800 to RM2,000 for a brochure site and RM2,500 to RM6,000 for lead-gen are honest.
What loses owners money is not the maintenance bill. It is paying nothing for two years, then RM3,500 to RM8,000 to rebuild what could have been kept alive far cheaper.
Versi Bahasa Melayu artikel ini ada di Kos Maintenance Website Malaysia.
If you want us to review your hosting, backups and licences before setting next year’s budget, talk to Lesgo Media.
Baca lagi
- What Makes a Good Business Website in Malaysia? A Practical Checklist
- Berapa Kos Website Design di Malaysia? (2026)
- 5 Signs Your Business Website Needs a Redesign