Website Security and Maintenance Budgets for Calgary Companies

Most companies budget carefully for building a website and then budget almost nothing for keeping it alive. Then, two years later, the plugin versions are stale, the contact form silently stopped sending email, the SSL certificate expired on a Friday night, and someone is asking why the site is "suddenly slow." Maintenance is not glamorous, but it is what separates a website that keeps earning from one that becomes a liability.

This guide explains what website security and maintenance actually involve, and how a Calgary company can plan a sensible budget. Scarlett Digital Studio is based in Regina, Saskatchewan and works with Canadian businesses remotely; we do not have a Calgary office. This is part of our wider web development practice.

Why maintenance is a business risk, not a technical hobby

A website is software, and software ages. New vulnerabilities are discovered in common platforms, libraries, and plugins constantly. Attackers use automated tools that scan for known weaknesses across thousands of sites at once, so being a small company does not make you invisible. A compromised website can mean defaced pages, spam injected into search results, stolen customer data, downtime during busy periods, or a blacklisted domain that email providers stop trusting.

The Canadian Centre for Cyber Security publishes guidance for small and medium organizations at cyber.gc.ca, including baseline controls worth reading. The OWASP project's Top 10 at owasp.org is the standard reference for common web application risks, and it is a good document to hand to any developer you are evaluating.

What a maintenance plan actually covers

1. Updates and patching

Content management systems, themes, plugins, frameworks, and server software all need regular updates. Good practice is to test updates on a staging copy first, then apply them to production, because updates occasionally break layouts or integrations. Critical security patches should be applied quickly; routine updates can follow a scheduled cycle.

2. Backups and restore testing

A backup you have never restored is a hope, not a plan. A proper setup includes automated backups of both files and database, stored off the main server, with a defined retention period. Periodically test a restore to confirm it works and measure how long recovery takes. Ask what your recovery time would be if the site disappeared tonight.

3. Uptime and performance monitoring

Monitoring tools check that your site is reachable and alert someone if it is not. Add checks for key functions, such as the contact form, checkout, and login. Track performance with Google's Core Web Vitals guidance at web.dev/vitals as a reference, because speed influences both user experience and search visibility.

4. SSL/TLS and domain management

Certificates and domain registrations expire. Automate renewals where possible and keep a calendar reminder as backup. Make sure the domain is registered under a company-controlled account, not a former employee's or a developer's personal login. This sounds trivial and is the cause of many avoidable emergencies.

5. Security hardening

• Strong, unique admin passwords with multi-factor authentication enabled.
• Least-privilege user roles, with former staff and contractors removed promptly.
• A web application firewall or edge protection service where appropriate.
• Rate limiting on login and form endpoints to reduce brute-force attempts and spam.
• Secure HTTP headers and sensible content-security policies.
• Disabled or removed unused plugins, themes, and test pages.

6. Form and email health

Contact forms are lifelines for lead-driven businesses, yet they fail quietly: a mail setting changes, a spam filter starts rejecting messages, or an API key expires. Schedule test submissions and make sure form data is also stored somewhere durable, not only emailed. Maintain proper email authentication (SPF, DKIM, DMARC) so legitimate site email is delivered.

7. Content and SEO upkeep

Broken links, outdated contact details, stale pricing, and expired promotions hurt trust. A lightweight quarterly review of key pages, redirects, and indexing status catches many problems early. Nobody can guarantee search rankings, but a clean, well-maintained site avoids self-inflicted damage.

Privacy and legal housekeeping

If your site collects personal information through forms, accounts, or analytics, Canada's PIPEDA applies to commercial activities, and Alberta also has its own private-sector privacy legislation. The federal Office of the Privacy Commissioner at priv.gc.ca and the Office of the Information and Privacy Commissioner of Alberta at oipc.ab.ca publish plain-language resources. Your maintenance routine should include reviewing what data you collect, how long you keep it, and whether your privacy policy still matches reality. If a breach involving real risk of significant harm occurs, notification obligations can apply, so having an incident plan matters. Seek qualified legal advice for your specific circumstances.

Building the budget: line by line

Break your annual website budget into recurring categories so nothing is a surprise:

• Hosting and infrastructure: servers or managed hosting, CDN, and email delivery services.
• Domain and certificates: annual registrations and any paid certificates.
• Software licences: premium themes, plugins, or platform subscriptions.
• Security tooling: firewall, malware scanning, and monitoring services.
• Backups: storage and retention.
• Labour: routine updates, monitoring response, small fixes, and reporting.
• Incident reserve: money set aside for the unexpected.
• Improvement hours: content changes, new pages, and conversion tweaks, which are separate from keeping the lights on.

Planning estimates, labelled

Costs vary with site complexity, so treat the following as Scarlett planning estimates in CAD, not quotes:

• Simple brochure site (a handful of pages, no accounts or payments): a modest monthly care plan, often in the low-to-mid hundreds of dollars per month when professionally managed, or less if you handle some tasks yourself.
• Lead-generation or content-heavy site with forms, integrations, and regular publishing: commonly higher, because of testing, monitoring, and more frequent updates.
• E-commerce or custom application: typically the highest ongoing cost, since payments, inventory, and user accounts raise both risk and workload.

Hosting and tool prices change, so consult each vendor's published pricing page when you assemble your budget. A common rule of thumb in the industry is to reserve a meaningful yearly percentage of the original build cost for upkeep, but the right figure depends on your platform and risk tolerance, so treat any rule of thumb sceptically and ask for an itemized proposal.

In-house versus outsourced maintenance

If you have a capable internal technical person, in-house maintenance can work, provided there is documentation and a backup person. The risk is single-point-of-failure knowledge: if that person leaves, nobody knows how the site is held together. Outsourced care plans offer coverage and process, but you should insist on clarity about response times, what is included, how emergencies are billed, and who owns the accounts. Insist that you retain ownership of your domain, hosting account, and code repository.

Questions to ask any provider

1. What exactly is covered each month, and what is billed separately?
2. How often do you back up, and when did you last test a restore?
3. How quickly do you respond to a site-down alert or security incident?
4. Do you test updates on staging first?
5. Who holds the admin credentials, domain, and hosting accounts?
6. What reporting will we receive?
7. What happens if we end the relationship? Is handover documented?

An incident checklist to prepare now

• Know who to call and have contact details stored outside the website itself.
• Keep a current list of accounts, domains, and where backups live.
• Know how to put up a maintenance page.
• Decide who communicates with customers if data may be affected.
• After any incident, record what happened and what changed.

Keep your site healthy

If you are not sure what condition your current site is in, a short health review (updates, backups, forms, SSL, access, and performance) is a good first step. We work with companies across the country; see our Canada-wide services, our Regina studio, and recent work. Check current offers and contact Scarlett Digital Studio to arrange a review or discuss a maintenance plan.