Website Maintenance Cost in Nepal (2026 Checklist & NPR Ranges)
Monthly maintenance ranges
| Site type | NPR/month | Includes |
|---|---|---|
| Static / brochure | 2,000 – 5,000 | Security patches, uptime check |
| WordPress SME | 5,000 – 15,000 | Updates, backups, minor edits |
| E-commerce | 10,000 – 25,000 | Plugin updates, monitoring, support |
| Custom app | 20,000 – 60,000+ | SLA, dev on-call |
These are Gurkha Technology retainer ranges and Kathmandu agency market rates in 2026. One-off “fix my hacked site” projects are priced separately — emergency work often exceeds six months of preventive maintenance.
Maintenance is not hosting. Hosting pays for server space; maintenance pays for someone responsible when something breaks at 10 PM before a campaign launch.
What maintenance actually covers
Tier 1: Static / brochure sites
| Task | Frequency | Why it matters |
|---|---|---|
| Uptime monitoring | Continuous | Nepal ISP routing blips happen |
| SSL cert check | Monthly | Expired cert kills trust and ads |
| Dependency audit (if build pipeline) | Quarterly | Node/Ruby CVE patches |
| Content update requests | 2–4/month included | Phone, hours, photos |
| Form endpoint test | Monthly | Contact forms fail silently |
Static sites on GitHub Pages + Cloudflare need less server patching but still need deploy pipeline maintenance — see GitHub Actions CI/CD.
Tier 2: WordPress SME
| Task | Frequency |
|---|---|
| Core, theme, plugin updates | Weekly review, staging first |
| Offsite backup + restore test | Weekly backup, quarterly restore |
| Security scan (Wordfence/Sucuri) | Weekly |
| Database optimization | Monthly |
| Broken link check | Monthly |
| GA4/GTM spot check | Quarterly |
| Minor content/CSS edits | Per SLA hours |
WordPress without updates becomes a malware host within months — WordPress security Nepal documents local attack patterns.
Tier 3: E-commerce (WooCommerce)
Everything in Tier 2, plus:
| Task | Frequency |
|---|---|
| Payment gateway test transaction | Monthly |
| Checkout flow on mobile 4G | Before each sale period |
| Cart/abandon plugin updates | Staging first — breaks checkout often |
| Product feed sync (if Google Shopping) | Weekly during campaigns |
| Inventory sync monitoring | Daily during peak season |
Gateway integration reference: eSewa/Khalti/Fonepay.
Tier 4: Custom applications
SLA-driven: response time guarantees, on-call rotation, staging environments, database replication monitoring. Priced by scope — NPR 20,000/month is a floor, not a ceiling.
Annual checklist
- Core/plugin/theme updates (staging first)
- Backup restore test quarterly
- SSL renewal (auto if Let’s Encrypt)
- GA4/GTM tag audit
- Broken link scan
- Core Web Vitals review
Expanded annual calendar
| Month | Focus |
|---|---|
| January | Annual security audit, password rotation |
| March | Pre-fiscal year content refresh |
| May | Monsoon performance check (slower mobile networks) |
| August | Pre-Dashain e-commerce stress test |
| October | Festival uptime war room for retail clients |
| December | Year-end analytics report + redirect audit |
Build cost vs maintenance (TCO)
Clients often optimize for lowest build quote, then skip maintenance. Twelve-month TCO comparison:
| Site type | Year 1 build | Year 1 maintenance | Year 1 hosting | Total |
|---|---|---|---|---|
| Brochure WP | NPR 80,000 | NPR 60,000–120,000 | NPR 36,000–60,000 | NPR 176,000–260,000 |
| WooCommerce | NPR 150,000 | NPR 120,000–300,000 | NPR 48,000–96,000 | NPR 318,000–546,000 |
| Static + CI | NPR 100,000 | NPR 24,000–60,000 | NPR 0–12,000 | NPR 124,000–172,000 |
Build pricing detail: website cost guide 2026. Static vs WordPress TCO: WordPress vs static business TCO.
Hosting upgrade triggers
Stay on shared hosting while:
- Page loads under 3s on mobile for homepage
- Concurrent admin + visitor traffic stable
- Host support responds within 24h
Move to VPS or managed WordPress when:
- Repeated 503/508 errors during campaigns
- Checkout timeout during sales
- Need custom cron, Redis, or non-standard PHP extensions
- Compliance requires isolated environment
Hosting options: web hosting Nepal local vs international. Pair with Cloudflare caching before over-paying for server scale.
DIY maintenance minimum viable
Founders maintaining themselves should:
- Enable auto-updates for minor WP core only — major releases manual
- Use managed backup plugin to offsite storage (not server-local only)
- Strong admin username (not
admin), 2FA, limit login attempts - Calendar reminder: first Monday monthly = update day
- Document rollback procedure before first update
Skip DIY if: e-commerce live, ads running NPR 50,000+/month, or no staging copy exists.
What agencies should document in SLAs
| SLA term | Define clearly |
|---|---|
| Response time | e.g. 24h business hours, 4h critical |
| Included edit hours | e.g. 2h/month content, overflow NPR X/hour |
| Update window | e.g. Tuesday 6–8 AM NPT low-traffic |
| Excluded scope | New pages, redesign, plugin custom dev |
| Emergency contact | WhatsApp vs ticket system |
Ambiguous SLAs cause “you didn’t fix my homepage hero” disputes when the retainer covers security patches only.
Common maintenance failures we inherit
| Symptom | Root cause | Cost to fix |
|---|---|---|
| White screen | PHP version mismatch after auto-update | NPR 5,000–25,000 |
| Google Ads disapproved | Malware injection | NPR 15,000–50,000+ |
| Checkout broken | WooCommerce + payment plugin conflict | NPR 10,000–30,000 |
| Lost all posts | Backup on same server, ransomware | Irrecoverable |
| Slow site | 40 active plugins, no cache | NPR 20,000–80,000 audit |
Preventive maintenance retainer always costs less than emergency rebuild.
Nepal-specific considerations
- Load-shedding: Host uptime ≠ site reachable from all ISPs — external uptime monitors matter
- Festival traffic: Dashain e-commerce needs pre-scale review, not post-mortem
- Payment gateways: Bank maintenance windows (midnight–4 AM) — schedule updates outside
- Local vs offshore support: Time zone alignment helps; document handoff if offshore team manages server
- Content in Nepali: Font rendering and plugin conflicts occasionally break after theme updates — visual QA after updates
When to cancel maintenance (rarely)
Consider reducing scope when:
- Site archived, no business function
- Migrating to SaaS platform with vendor-managed updates
- Static site with no CMS and automated CI deploy only
Do not cancel because “site looks fine” — invisible security debt accumulates.
Choosing a maintenance partner in Kathmandu
Questions to ask before signing a retainer:
| Question | Good answer |
|---|---|
| Do you staging-test updates? | Yes, with client approval window |
| Where are backups stored? | Offsite, not same cPanel account |
| Response time for site down? | Defined hours, not “best effort” |
| Included edit hours? | Number specified, overflow rate clear |
| Who holds admin credentials? | Documented handoff, not mystery account |
Avoid providers who only sell annual hosting bundles without update logs. You should receive a monthly report: updates applied, uptime percentage, backup status, security scan summary. If they cannot show logs, they are not maintaining — they are invoicing.
