The price of building a website is discussed at length before a project starts. The cost of running it afterward is discussed much less, and it is the larger number over the life of the site. A business that budgets only for the build tends to be surprised in year two, and surprise is what turns reasonable costs into resentment. This article lays out where the money actually goes once a site is live, so you can budget for it deliberately and know what you are getting for each part.
Hosting: the platform the site runs on
Hosting is the most visible running cost and, for most business sites, not the largest. It covers the servers, storage, network, the edge that terminates TLS and filters traffic, and the platform that keeps all of it patched and running. The right amount depends on traffic and complexity: a content site with modest traffic needs little; a portal with many logged-in users or a shop in peak season needs more.
What you should expect for the money is not just capacity but operation. Managed hosting includes the work of keeping the platform current, monitoring it, backing it up and being on call for it. Bare infrastructure is cheaper on the invoice and more expensive in practice, because the operation has to come from somewhere.
Maintenance: keeping the software current
This is the cost people most often skip and most often regret skipping. Drupal core, contributed modules, PHP, the database and every library in between publish updates on a steady rhythm, and security releases arrive weekly. Applying them is routine work, a few hours a month on a typical site, and it is what keeps the site safe, fast and upgradeable. Deferring it does not save the money; it moves it into a larger, later invoice with risk attached.
Maintenance also covers the periodic larger steps: a minor version of Drupal twice a year and a major version every two years, both predictable from the platform's published calendar. A good maintenance agreement includes them rather than treating each as a new project.
Security and compliance: the ongoing part
Some security is a property of the platform and comes with hosting: the firewall, the hardened runtime, the certificates. Some is ongoing work: reviewing accounts and permissions twice a year, running restore drills, updating the privacy policy when a service changes, answering a customer's security questionnaire, keeping the accessibility statement current. None of these are large. Together they are a few days a year, and they are the difference between compliance you can demonstrate and compliance you hope for.
Content: the cost that depends on you
A website is only as useful as what is on it, and content has a running cost that varies more than any other line. A site that publishes an article a week, maintains product data and keeps two languages current has a real editorial budget, whether that is staff time or outside help. A site whose content changes twice a year has almost none. The cost is yours to set. What the platform can do is keep it as low as possible for a given ambition: an editorial interface designed around your team, structured content that avoids re-entry, and workflows that make review fast.
Improvement: the site as a living asset
The sites that deliver the most value are the ones that keep changing: a new landing page for a campaign, a form that converts better, a section for a new service, a performance pass, a feature editors asked for. This is discretionary spending, and it is the part of the budget that generates returns rather than protecting them. We recommend that clients set an improvement budget rather than approving each change individually, because a steady stream of small improvements consistently outperforms an occasional large one.
Domains, certificates and services
The small recurring items: domain renewals, any paid services the site depends on such as email delivery, search, maps or payment processing, and the occasional paid module or font license. Each is minor. Together they are worth a line in the budget and, more importantly, a list, because a lapsed domain or an expired payment card on a critical service is a disproportionately common way for a well-run site to have a bad day.
How the pieces relate
Two patterns are worth knowing. First, the fixed costs, hosting and maintenance, are what keep the site safe and current; they are not where to economize, and on a well-built site they are stable and predictable. Second, the variable costs, content and improvement, are where the value comes from; they are the ones to fund deliberately and review annually against results.
Third, and most important: build quality determines running cost. A site with structured content, a component library and clean configuration costs less to maintain, less to change and less to upgrade, every year, for as long as it exists. The savings from a cheaper build are usually spent several times over in running costs. This is the argument for building well that we find most persuasive with finance teams, because it is their argument.
Budgeting for it
We help clients set an annual budget with the fixed costs known, a content plan sized to their team, an improvement allowance, and the small items listed. Every hour and every invoice is then visible in the client portal as it happens, so the budget is a living document rather than an annual surprise. If you are planning next year's numbers and would like a realistic picture of what your site should cost to run, we are glad to put one together.