The call came on the second Monday of January, the busiest week of the year for a private school.
“Mwalimu, I searched for your school on my phone and it took me to a betting site. Is that really your website?”
Mr Kiprop, the director of a private primary school in Eldoret, opened the website on his office computer. It looked perfectly normal: the photos of the new classrooms, the admissions page, the fees. Then he tried it on his phone. Two seconds after it loaded, the page jumped to an online casino.
By lunchtime, a screenshot was going round two parents’ WhatsApp groups. By the afternoon, Google was showing “This site may be hacked” under the school’s name. And the admissions form, the one that had collected parents’ names, phone numbers and their children’s dates of birth, was sitting on a website a stranger now controlled.
Nobody had attacked the school on purpose. The website had been built in 2022 by a company that had since closed. Nobody had logged in for eighteen months. One of its plugins, a photo slider, had a known security hole, and an automated tool scanning thousands of websites had simply found it.
The clean-up took a weekend, nine days of disruption and KSh 85,000, because there was no clean backup to restore. Google’s warning took another two weeks to disappear.
When it was over, Mr Kiprop asked the question that brings many Kenyan business owners to this page: “What does it cost to look after a website properly, and why did nobody tell me I needed to?”
The short answer
- Website maintenance in Kenya costs roughly KSh 3,000–6,000 a month for a small brochure site, KSh 6,000–10,000 for a site that brings in enquiries, and KSh 10,000–20,000 or more for online shops and busy sites.
- A good care plan covers updates, backups, security and uptime monitoring, small content changes and a regular report.
- Hosting, the domain and bigger changes such as new pages are usually billed separately.
- You can do it yourself for free if you have about an hour a week and know what to check.
- Skipping it is the expensive option: hacks, downtime, Google warnings and, if personal data is exposed, legal duties under Kenya’s Data Protection Act.
What website maintenance actually means
A website is not a signboard you put up once. It is software, and software needs looking after. Most Kenyan business websites run on WordPress, which is made of three parts: WordPress itself, a theme that controls the design, and plugins that add features such as forms, sliders and payments. All three get regular updates, many of them security fixes.
Mr Kiprop’s website had not had a single update since it launched. Every week that passed, it fell further behind the fixes everyone else had installed.
What website maintenance costs in Kenya
| Level | Roughly, a month | Suits |
|---|---|---|
| Basic | KSh 3,000–6,000 | Brochure sites with a few pages and few changes |
| Standard | KSh 6,000–10,000 | Sites that bring in enquiries, with regular updates and reports |
| Advanced | KSh 10,000–20,000+ | Online shops, booking systems and busy sites |
These ranges come from what Kenyan web agencies publish in 2026. What moves your price up or down:
- What the site does. An online shop that takes M-Pesa needs more care, and faster help, than a five-page brochure site.
- How many plugins it uses. More plugins means more updates to install and test.
- How often you change things. Weekly news, new products and term dates all take time.
- How fast you need help. Same-day and out-of-hours support costs more.
Why websites get hacked
Most hacks are not personal. Automated tools scan the internet day and night for websites running old versions of popular plugins. When they find one, they break in, usually to send visitors to betting or scam sites, to add spam pages, or to send spam email.
According to Patchstack’s 2026 report, 11,334 new security holes were found in the WordPress world in 2025, 42% more than the year before, and 91% of them were in plugins. For the most serious ones, mass attacks began a median of just five hours after the hole was made public. That is why “I’ll update it when I have time” does not work.
The same report found that the standard protections many hosts use blocked only about a quarter of attacks. Good hosting helps, but it does not replace keeping the website itself up to date.
Can you maintain your website yourself?
Yes, if you are disciplined about it. For a small WordPress site, allow 30 to 60 minutes a week:
- Back up first, then install updates. Keep at least one copy somewhere other than your hosting account.
- Check the site after updating, on a phone as well as a computer. Updates occasionally break things.
- Delete plugins and themes you do not use, and any old admin accounts.
- Use strong, unique passwords and turn on two-step login.
- Test your forms every month by sending yourself a message.
- Put renewal dates in your calendar for the domain and hosting.
The problem is rarely skill. It is that a busy owner, like Mr Kiprop, has a school to run, and the website is the first thing to slip.
What a hack really costs
The KSh 85,000 clean-up was only the start of Mr Kiprop’s bill:
- Admissions: families who searched for the school during its busiest week found a casino and a warning.
- Trust: the screenshots in the parents’ WhatsApp groups did more damage than the hack itself.
- Time: nine days of calls, explanations and meetings.
- Legal duties: the admissions form held personal data about parents and children.
That last one matters. Under Kenya’s Data Protection Act, if a breach of personal data creates a real risk of harm to the people affected, you must notify the Office of the Data Protection Commissioner within 72 hours of finding out, and tell the people affected. Schools must also register with the Commissioner whatever their size, as must health care, hospitality and property businesses, among others. Our guide to creating a business website explains the registration rules.
A year of basic care would have cost less than the clean-up alone.
What to look for in a care plan
- Backups: how often, how long they are kept, and whether they are stored away from your hosting. Ask when they last tested a restore.
- Updates: how often, and whether someone checks the site afterwards.
- Monitoring: who gets the alert when the site goes down, and how fast they act.
- Security: malware scanning, a firewall and two-step login for admins.
- Changes: how much content editing is included each month.
- Reports: what you will see every month.
- Ownership: the domain, hosting and website logins should stay in your business’s name.
Mr Kiprop’s January, a year later
After the clean-up, the school moved to a care plan. Updates now go in every week and someone checks the site afterwards. Backups run every night and are stored away from the hosting. The admissions form asks for less, and sends straight to the school’s own email instead of piling up in the website. And the school registered with the Data Protection Commissioner, which it should have done years earlier.
This January, the website stayed up all month. Forty-two families booked a school visit through it. The only call Mr Kiprop got about the website was from a parent who wanted to say the new photos of the library looked lovely.
Mr Kiprop is a composite of the business owners we work with. The costs are typical ranges, not quotes; the security figures come from Patchstack and the legal duties from Kenya’s Data Protection Act.
Want someone to look after your website?
Our care plans start at KSh 3,500 a month for Basic care: security updates, regular backups, uptime monitoring, basic content updates and email support. Professional care, at KSh 7,500 a month, adds performance optimisation, SEO monitoring, advanced security, unlimited content updates, phone support and monthly reports. Premium care, at KSh 12,500 a month, adds 24/7 priority support, emergency response and quarterly security audits. Our prices include VAT.
See the care plans on our web design page, compare everything on our pricing page, or tell us about your website. If it has already been hacked, contact us and we will tell you what it will take to fix it. And if renewals are your worry, read what hosting costs in Kenya and why the accounts should be in your name.
Website maintenance in Kenya: FAQs
How much does website maintenance cost in Kenya?
Roughly KSh 3,000–6,000 a month for a small brochure site, KSh 6,000–10,000 for a site that brings in enquiries, and KSh 10,000–20,000 or more for online shops and busy sites. Hosting, the domain and bigger changes are usually extra.
What does website maintenance include?
Updates to WordPress, the theme and plugins; backups; security and uptime monitoring; small content changes; testing forms and buttons; renewals; and a regular report on what was done.
Does a small website really need maintenance?
Yes. Attackers use automated tools that do not care how small your business is. A five-page site with an old plugin is just as easy to break into as a big one.
Is hosting included in website maintenance?
Usually not. Hosting and the domain are normally billed separately, by your hosting company or as part of your website package. Check what your care plan covers.
How often should a WordPress website be updated?
Check for updates at least once a week, and install security fixes as soon as they are released. Always back up first, and check the site afterwards.
Can I maintain my website myself?
Yes, if you can set aside about an hour a week and follow a checklist: back up, update, check the site, test forms, remove unused plugins and renew on time.
How do I know if my website has been hacked?
Common signs: the site redirects on phones but not on computers, Google shows “This site may be hacked”, strange pages appear when you search for your website on Google, unknown admin users appear, or your hosting company warns you about spam or malware.
What should I do if my website is hacked?
Change all passwords, tell your hosting company, restore a clean backup or have the site cleaned, update everything, remove unknown users and plugins, then use Google Search Console to ask Google to review the site. If personal data may have been exposed, take advice on notifying the Data Protection Commissioner.
Do I have to report a website hack in Kenya?
If personal data was breached and there is a real risk of harm to the people affected, Kenya’s Data Protection Act requires you to notify the Data Commissioner within 72 hours of finding out, and to inform the people affected.
