Guides

What Magento Maintenance Actually Costs in 2026 (and What Drives the Price)

September 8, 2026 - Alexandru-Manuel Carabus

Ask what Magento maintenance costs and you will get answers from 50 to 5,000 EUR a month, all calling themselves the same thing. Here is what actually drives the price, the honest market ranges, and the questions that expose an offer with nothing inside.

Ask what Magento maintenance costs and you will get quotes from 50 EUR a month to 5,000 and up, every one of them calling itself maintenance. The spread is not because some providers are greedy and others are saints. It is because the word covers wildly different amounts of actual work, and most buyers cannot see inside the offer until something breaks and they find out what they were really paying for.

This is the teardown of what sits inside those numbers. Not a rate card, ours or anyone's, but the four variables that genuinely move the price, the honest market brackets those variables produce, and the questions that reveal within five minutes whether an offer contains work or just a word. We did the same exercise for development pricing and the pattern holds: once you see the drivers, the quotes stop being confusing.

The three offers that are not maintenance

Before the real drivers, clear out the three most common fakes.

Hosting sold as maintenance. The invoice says maintenance; the deliverable is a server that stays on. Uptime is not maintenance. Nobody at the hosting company is reading your exception logs, testing your backup restores or applying Magento security patches to your codebase. When SessionReaper landed, "maintained" stores on this model were exactly as exposed as unmaintained ones, because in every sense that mattered, they were unmaintained.

Hourly-only, no commitment. Pay-per-incident sounds fair: no retainer, you only pay when something happens. Read the incentive. A provider paid only when things break has no economic reason to prevent breakage, and no obligation to be available when it happens. You have not bought maintenance. You have bought a queue position, with the queue length undisclosed.

The fear-priced enterprise retainer. At the other end, retainers priced on what an outage would cost you rather than on the work being done. The pitch leans on downtime horror stories and stays vague about deliverables. Any real offer can enumerate its contents; we published the full task list a real program covers, monthly, quarterly and annual, and it makes a useful ruler to hold against any quote.

The four variables that actually move the price

1. Module count and customization depth. The single biggest driver. Every installed extension is something to update, something that can conflict with the next update, and something an attacker can probe. A store running 40 well-chosen modules and one running 200 accumulated ones are different maintenance jobs by an order of magnitude, whatever their revenue. When we took over the Vitacom store we removed roughly 180 modules, and every one of them had been silently inflating the maintenance bill: more patching surface, more conflict testing, more things that could wake someone up. If your maintenance quote seems high, the honest first question is not "is this provider expensive" but "how much store is there to maintain."

2. Version currency and upgrade debt. A store on the current patch release costs little to keep there: apply, test, promote. A store three versions behind is not buying maintenance, it is buying a rescue project on an installment plan. Debt compounds: the further behind, the more each module update fights the core, the more custom code has to be untangled per step. Two stores with identical catalogs can differ several times over in maintenance cost purely on how far behind they start.

3. Response guarantees. Best-effort is cheap because it promises nothing. A written SLA costs more because someone is now staffing for your worst day: keeping capacity free, maintaining escalation paths, answering inside a committed window. Whether that premium is worth it is a revenue question. A store doing 2,000 EUR a day can think about it; a store doing 20,000 a day already knows. What matters at any size is that the number is in writing. Ours is two working hours on critical incidents, on the contract, not in the pitch.

4. What "included" includes. Performance work, Core Web Vitals monitoring, staging upkeep, restore testing, module licence tracking: in some offers these are inside the retainer, in others each is a billable extra. Two quotes 800 EUR apart can converge completely once you price what the cheaper one bills separately. Always compare the list, never the number.

The honest market brackets

With the four drivers visible, the market's spread turns out to be fairly rational. Across published EU agency pricing, the brackets look like this:

• Patch-and-pray, a few hundred EUR a month. Security patches applied, updates done on a schedule, little else. Legitimate for small, simple, low-stakes stores; the risk is everything the list above showed is missing.
• The real retainer, roughly 1,000 to 3,000 EUR a month. The full monthly and quarterly checklist, a written SLA, staging, restore tests, a monthly report. This is where most serious mid-market stores land, and where the module-count driver decides the position inside the band.
• Complex and multi-store, 5,000 EUR a month and up. Multiple storefronts, ERP integrations, custom middleware, compliance requirements. The price tracks the surface area, not the logo.

These are market observations, not our price list. Where a specific store lands depends almost entirely on driver number one, which is why any provider quoting you a precise number before seeing your module list is quoting their target margin, not your store.

The cost of the alternative, with real numbers

The comparison every maintenance number should be held against is not zero. It is the cost of not maintaining, and 2025 provided the cleanest data point the industry has had in years. When SessionReaper (CVSS 9.1) was disclosed in October 2025 with a patch available on day one, an estimated 81 percent of Magento stores saw attack traffic within six weeks, and 16 to 18 percent ended up backdoored. For those stores, the bill was incident response, forensics, customer notification under GDPR, and the slow rebuild of trust, a total that dwarfs years of the retainers described above. The full SessionReaper write-up walks through the timeline. Unmaintained is not the free option. It is the expensive option with the invoice date left blank.

Five questions that expose a hollow offer

Take any maintenance quote and ask:

• What are the response times, in writing? Not "usually fast." Numbers, on the contract.
• What is the patch policy? How many days from an Adobe security release to it being live on my store? SessionReaper made this the question that separates real programs from words.
• When was the last time you restored one of my backups? Correct answers involve a date and an environment. "Backups run nightly" is not an answer to this question.
• Is there a staging environment, and who keeps it current? Providers updating production directly are gambling with your name on the table.
• What arrives in the monthly report? If nothing arrives monthly, ask what happens monthly. The silence is the answer.

A provider who answers all five crisply is worth talking to at whatever bracket they quote. A provider who stumbles on two or more is selling the word, not the work.

Where to go from here

Price your own store against the four drivers before you talk to anyone: module count, version distance, the response guarantee your revenue actually needs, and the list of what must be included. That one page of notes turns every sales conversation from "is this expensive?" into "what exactly am I buying?", which is the stronger position in every negotiation. What a program with a written SLA includes is on our support and development page. And if you want a second opinion on a quote you already have, ours or anyone's, book a free strategy call and bring the module list. We will tell you honestly which bracket your store belongs in, and why.