What a Dubai Website Actually Costs After Launch

A website is a running cost, not a purchase. From the day it launches, a Dubai business is paying for five separate things: the domain licence, the TLS certificate, the hosting, the platform underneath the site, and somebody’s time to keep all four current. Four of those five renew on a calendar somebody else sets, and two of those calendars got shorter during 2026. Website maintenance cost in Dubai is easier to budget once you stop treating it as one line item and start treating it as five, because each one fails differently when it lapses.

Key takeaways

• A .ae domain does not sit quietly after expiry. The registry removes its DNS records on the expiry date itself, which takes the site and the email down the same day.
• Maximum TLS certificate validity dropped from 398 days to 200 days on 15 March 2026, falls to 100 days in March 2027 and 47 days in March 2029, so manual certificate renewal has a visible end date.
• PHP 8.2 leaves security support on 31 December 2026, and PHP 8.4 leaves active support on the same day. Any Dubai site still on an older branch is running unpatched code.
• WordPress shipped patched releases across four separate branches on 17 July, 6 August, 12 August and 17 September 2026. That release pattern, not a plugin count, is what a maintenance plan is really responding to.
• The largest unbudgeted cost is usually not technical. It is the content nobody updated: the price that changed, the service you stopped selling, the phone number on the contact page.

The renewals that switch your site off the day you miss them

Two renewals have no grace at all in practice, and both are cheap. That combination is exactly why they get missed.

Start with the domain. The .ae Domain Administration sets out what happens in its Domain Name Renewal, Expiry and Deletion Policy, AEDA-POL-012, version 1.1 of 22 September 2010. For .ae, .co.ae, .net.ae and .org.ae names, the moment the expiry date passes the domain enters Expired Hold status, updates stop being accepted, and any domain name server records are removed from the DNS service. Not thirty days later. That day. From then the only available action is renewal, and you have thirty calendar days to take it. On day thirty-one the name becomes eligible for purging from the registry system, at which point it can be registered by anyone.

Compare that with a .com, where a registrar typically parks the name and offers a paid redemption window. The .ae policy has no equivalent. A trading company in Deira whose accounts clerk left in March and whose renewal notice went to that person’s mailbox is a familiar story, and it ends with a live business having no website, no company email and a thirty-day fuse.

The practical fix costs nothing. Register the domain in the company’s name with a company email as the registrant contact, never an employee’s personal address or an agency’s. Renew for the maximum term rather than annually. The same policy allows licence periods of one to five years, so a five-year renewal removes four opportunities to forget.

Certificate renewal stopped being a yearly job in March 2026

The CA/Browser Forum passed Ballot SC-081v3 on 11 April 2025. It sets a schedule that shortens how long a public TLS certificate may be valid: 398 days until 15 March 2026, then 200 days, then 100 days from 15 March 2027, and 47 days from 15 March 2029. Domain validation reuse shortens on the same dates, reaching 10 days in 2029.

For a business this reads as a simple operational change. A certificate you used to renew once a year now needs renewing roughly twice a year, then roughly quarterly, then every six weeks. Any process that depends on a person remembering, or on an invoice arriving, will fail somewhere in that sequence. Browsers show a full-page warning when a certificate expires, so the failure is not subtle: visitors see a security interstitial rather than your home page, and paid traffic keeps arriving at it.

The answer is automation, and it usually already exists. Most managed hosting issues and renews certificates automatically. If yours does not, or if the certificate was bought separately and installed by hand three years ago, that is a specific job to raise now rather than in 2029. Ask your host to confirm two things in writing: that this certificate renews automatically, and which alerts fire if a renewal ever fails.

The platform underneath ages on a published calendar

The language that runs the site has fixed dates, published years in advance. Read on 19 September 2026, the PHP supported versions page shows PHP 8.2 receiving security fixes only until 31 December 2026, PHP 8.3 until 31 December 2027, PHP 8.4 in active support until 31 December 2026, and PHP 8.5 in active support until 31 December 2027.

Two things follow. First, a site built on PHP 8.1 or earlier is already past every support date and is being served by an interpreter that receives no security fixes. Second, PHP 8.2 has about three months of security support left at the time of writing, which makes a version upgrade a Q4 job for anyone still on it, not a 2027 job.

The application layer moves faster. WordPress published its release history for 2026 with 7.0 on 20 May, then 7.0.1 on 9 July, 7.0.2 on 17 July, 7.0.3 on 6 August, 7.0.4 on 12 August, 7.1 on 19 August, and both 7.0.5 and 7.1.1 on 17 September. Look at the dates across branches rather than at one branch and the pattern is clearer: 17 July, 6 August, 12 August and 17 September each produced a release on several supported branches at once, including 6.9 and 6.8. That is how backported security fixes ship. A site that only gets touched when something breaks will sit unpatched through all four of those dates.

From a development perspective this is the part clients find hardest to price, because nothing visible happens. Nobody sees a PHP upgrade. They see the invoice.

What a maintenance retainer is actually paying for

Most Dubai proposals describe maintenance as “updates and support”, which tells a buyer nothing. Broken into its parts, the work is specific and each part has a consequence attached.

Ask for the retainer to be quoted against rows like these. If a provider cannot say which rows are included, the honest reading is that only the first two are.

Hosting has a performance number attached to it

Hosting stopped being a commodity when page experience became measurable. Google’s Core Web Vitals thresholds, on a page last updated 31 October 2024, are 2.5 seconds for Largest Contentful Paint, 200 milliseconds for Interaction to Next Paint and 0.1 for Cumulative Layout Shift. Those are measured against real visitors, which for most Dubai businesses means mid-range Android phones on mobile data, not the agency’s laptop.

The hosting decision that matters is not the monthly price. It is where the server sits relative to your customers and whether anything caches in front of it. A Dubai audience served from a single origin in Europe pays a round trip on every uncached request. Putting a CDN in front, or moving the origin closer, is a one-time change with a permanent effect, and it usually costs less than the difference between two hosting tiers. We have written a separate walkthrough on fixing Core Web Vitals and INP for anyone whose field data is failing.

The jobs nobody quotes for

Three costs turn up on every site we take over, and none of them appear in the original proposal.

Content that aged without anyone noticing

A price list from 2024, a service you no longer offer, a team page with two people who left, a PDF brochure with the old office address. Each is small. Together they are the reason a well-designed site stops converting, because a buyer who catches one wrong detail starts doubting the rest. Budget a quarterly hour for a walk through the site as a customer would read it.

Forms, and what they collect

Contact forms decay in two directions. They break silently when a plugin or a mail provider changes, and they fill with automated spam that trains your team to ignore the inbox. Both need checking, and the check is the same: submit the form yourself once a month and confirm the message arrives where it should.

There is a second reason to look at forms. Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data governs personal data collected in the UAE, and a lead form collects it. The practical questions are whether the data is going anywhere you did not intend, how long it is kept in the site database, and who on your side can read it. Cleaning out years of stored submissions from a CMS is unglamorous work that reduces what you can lose.

Anything a third party controls

Payment gateways, booking widgets, mapping keys, chat tools and analytics tags are all governed by somebody else’s release notes. They change without asking you. When a booking widget’s embed code is deprecated, the booking page stops working and the only warning was an email to whoever set up the account four years ago.

Sizing the budget against the site you actually have

There is no single right figure, and any agency quoting one without seeing the site is guessing. The honest way to size it is by how much of the site changes and how much money depends on it.

A five-page brochure site on a mainstream platform, with no transactions and a handful of content changes a year, needs little more than the renewals, hosting, patching and a quarterly read-through. For a small business we would usually recommend keeping this light and spending the difference on the content itself.

A lead-generation site, where forms and tracking drive real pipeline, needs the same base plus monthly verification that the forms and conversion tracking still work. The cost of a form that silently stopped sending for six weeks is measured in lost enquiries, and it dwarfs the retainer.

A store is a different order of work. Transactions, stock, payment gateway updates, tax rules and customer accounts all change, and each change can cost real money on the day it breaks. Maintenance here is closer to operations than to housekeeping, and it should be staffed accordingly.

One opinion worth stating plainly: if a site genuinely needs nothing beyond renewals and patching, say so and charge for that. Selling a large retainer for a static brochure site is how agencies lose clients who later discover what they were paying for.

Questions to ask before you sign a retainer

1. Name the registered owner of the domain and the email address that receives the renewal notice.
2. Confirm the TLS certificate renews automatically, and state what happens if a renewal fails.
3. State the PHP or runtime version the site is on and the date it leaves security support.
4. State the schedule platform updates are applied on, and whether they are tested on a copy before the live site.
5. Say where backups go, how far back they reach and when a restore was last performed.
6. Give the response time if the site goes down on a Friday evening.
7. List exactly what you hand over if the agreement ends: hosting access, the code, the database, the domain.

The last item separates a maintenance agreement from a hostage arrangement. It deserves an answer in writing before money changes hands, in the same way the ownership clauses in a website development contract deserve reading before signature.

If you are not sure which of these five costs your business is currently carrying, the fastest way to find out is to check who receives the domain renewal notice and when the site last had a platform update. We look after website maintenance for Dubai businesses and run the hosting behind it, and we are happy to review an existing setup before anyone proposes changing it.

Dates and version figures here were checked against primary sources on 19 September 2026 and change over time. This is general information rather than legal or tax advice. Cover photo: Marina Promenade – Dubai Marina by Sergio Boscaino from Busseto, Italy, via Wikimedia Commons (CC BY 2.0).