Launch is a project. Maintenance is a subscription to keeping the business online. The app stores change their rules, payment gateways deprecate APIs, PHP releases security patches, maps change pricing and riders find new ways to break an order flow. None of that stops because the licence was one-time.
The right maintenance budget depends on who does the work. An in-house developer costs a salary; a freelancer costs an hourly rate; an agency costs a retainer. The work itself is similar.
| Workstream | Frequency | Typical monthly effort |
|---|---|---|
| Server and PHP security updates | Monthly / as released | 1–3 hours |
| Backups and restore test | Weekly / quarterly | 1–2 hours |
| Monitoring and incident response | Continuous | 2–5 hours |
| App-store releases | Quarterly / OS updates | 2–8 hours per release |
| Payment/SMS/map API changes | As needed | 2–6 hours |
| Bug fixes and small changes | Ongoing | 4–12 hours |
| Content and menu support | Ongoing | 2–8 hours |
Indicative monthly ranges
In-house: a part-time developer or technical operator costs a salary, but you get priority and context. Budget the full cost, not just the hours.
Freelancer: $150–$800 per month for a small platform with routine updates, or $25–$80 per hour for ad-hoc work. Response times are usually best-effort.
Agency retainer: $500–$2,500 per month for monitoring, updates, a support window and a block of change hours. More if the agency handles app-store releases and after-hours support.
These ranges are planning estimates for a small self-hosted deployment. They vary by country, stack, order volume and the state of the codebase.
The four costs people forget
App-store releases. A mobile app is not a website. Every OS update can break a build, and both stores require periodic target-SDK updates. A release that takes two hours in a good month can take two days in a bad one.
Gateway changes. Payment providers retire APIs and change onboarding requirements. If your checkout depends on an old integration, an unannounced change can stop orders. Maintenance includes monitoring provider announcements, not just fixing bugs after they bite.
Security. A public admin panel and payment flow attract automated probing. You need patching, access control, rate limiting and a backup you have actually restored. A breach costs far more than a year of maintenance.
Support. Someone has to answer “my order is late” at 8pm. That is an operations cost, not a software cost, but it belongs in the same budget.
What a good maintenance contract includes
- Defined response times for critical (orders down) and non-critical issues.
- Monthly security updates and a patch log.
- Backup monitoring and a quarterly restore test.
- App-store target-SDK updates and release support.
- A block of change hours with a rollover or overage rate.
- Uptime and error monitoring with alerts.
- Documentation updates when the code changes.
How to reduce the bill without creating risk
Keep the stack boring. Every extra plugin, custom module and third-party service is another thing to patch. Use managed hosting with managed backups if you do not have a sysadmin. Automate monitoring and alerts. Batch small changes into a weekly release instead of deploying every request.
Do not skip backups or security updates to save a few hours. The cheapest maintenance is the work that prevents an outage, not the work that responds to one.
Read the three-year TCO model, the installation checklist, or see the software page.