The Open-Source Paradox: Hidden Maintenance and DevOps Costs
Exposing the true cost of self-hosting and calculating your three-year TCO...
Contents
The license was free.
That was the whole argument, delivered across a conference table by a developer who meant every word of it. No subscription. No vendor. Download it, own it, build whatever you want.
Three years later the same company was paying two engineers to keep the thing breathing, a hosting bill that had quietly tripled, and a quote for a version upgrade that cost more than the original build.
Nobody lied to anybody.
The license really was free. The software never was.
In Module 01 I laid out the full migration cost stack, and line 05 was backend integration — which became Module 03. This module is the line nobody puts on the stack at all, because it doesn’t arrive as an invoice. It arrives as payroll, retainers, and nights your team spends on infrastructure instead of on your customers. I’ve led four e-commerce implementations, served as architect and project leader on a custom ERP replacement, and watched this exact arithmetic play out on both sides of it. So take this from someone who has actually run the business:
“You never buy software. You buy the obligation to keep it running. The license is just the cover charge.”
Four lessons, one worksheet you can fill in tonight, and the question I’d ask if I sat on your board.
Lesson One: The license was never the cost
Here’s the arithmetic nobody puts in the deck. Shopify Plus runs $2,300 a month on a three-year term, $2,500 on a one-year — call it $27,600 a year. Hosting, CDN, patching, scaling, uptime and PCI certification of the platform are inside that number.
Self-hosted, the license line goes to zero and five other lines wake up.
Three-year total cost of ownership
Three to nearly ten times the cost of the thing that had a price tag on it.
And notice where the money actually goes. It isn’t servers — servers are cheap now. It’s people. A specialized DevOps retainer, or the engineers you hire once you pass roughly $2 million and discover that “our developer handles it” is no longer a sentence anyone can say out loud.
Those are my ranges, from my experience. Yours will differ. That’s the point — put your own numbers in and run it.
A rule I live by
A cost that arrives as payroll is still a cost.
If the only way to see your platform bill is to look at headcount, you don’t have a cheaper platform. You have a hidden one.
Lesson Two: The upgrade treadmill you never budgeted for
Here’s what the free license buys you that nobody mentions: a deadline you don’t control.
Adobe Commerce supports each 2.4.x release for three years. Version 2.4.7 goes out of support on May 31, 2027. After that, security patches stop. You are not choosing whether to upgrade. You are choosing between an upgrade project and an unpatched storefront taking credit cards.
An upgrade is not a patch. It’s a project.
Every extension revalidated, every customization re-tested, every integration re-pointed. Thirty to eighty thousand dollars is a fair range for a store carrying real customization, and the three-year support window puts two or three of them in your window.
POLYWOOD — the outdoor furniture manufacturer, 150,000 product variations — ran a heavily customized Adobe Commerce build and measured exactly this. Their Chief Digital Officer, Benjamin Spiegel, put the number on the record: more than 80% of their development resources went to platform maintenance rather than creating value. One full fifth of every year was spent on codebase version upgrades alone.
Twenty percent of the year. Maintaining the thing that was supposed to be free.
After moving to a managed platform, they redirected 100% of those development resources, met roughly three-quarters of their custom requirements with off-the-shelf apps, and started shipping features in hours and days instead of months. Conversion rose 22%. Average order value rose 12%. Operating cost fell by a six-figure amount. They braced for the three-to-six-month organic traffic drawdown everyone warns about — and it never came.
That last part matters, and it’s the whole argument of Module 02: the traffic loss is not a law of nature It’s a consequence of a bad redirect map.
Lesson Three: Control is real. Ask what you’re paying for it.
I’m not here to tell you open source is a mistake. It isn’t.
Self-hosting buys you three things that are genuinely worth money. You own the code, so no vendor can retire a feature you depend on. You can build a workflow that exists nowhere else — and if you manufacture configured product, that may not be optional. And nobody raises your rent.
Those are real. Pay for them with open eyes.
What I will not let you pretend is that the comparison is free money. Two honest notes, because both columns get fudged:
Card processing fees belong in neither column. You pay those on any platform. Anyone who loads them onto one side of the comparison is selling, not counting.
PCI isn’t a problem that vanishes. A managed platform carries the certification for the platform itself, which is most of the burden and all of the hardest part. It does not carry your apps, your checkout extensions, your call-center order entry, or your staff. Your scope shrinks. It doesn’t disappear.
A rule I live by
Decide control versus cost on your product, not on your pride.
Configured product, custom manufacturing, rules that exist nowhere else — build. A stock catalog on a standard order flow — buy. The second answer is not the lesser one. It’s the one that leaves money for marketing.
Lesson Four: Run the three-year number before the demo
Most platform decisions are made on a year-one comparison, because year one is the only year anybody models. Year one is also the only year self-hosting looks cheap, because the upgrades haven’t come due and the DevOps retainer hasn’t been signed.
So model three years. Every time. It takes an afternoon.
Get your real hosting bill — not the quote, the bill, with bandwidth and scaling events in it.
Price the DevOps capacity honestly. Retainer, or salary plus benefits plus the hiring risk.
Count the upgrade projects inside the support windows of the version you’re actually running.
Add security and compliance — penetration testing, audits, remediation.
Then add the line nobody adds: opportunity cost. Every engineer-week on infrastructure is an engineer-week not spent on merchandising, site speed, or the checkout.
That fifth line is the one that got POLYWOOD. Not the hosting bill. The eighty percent.
A word to the next generation
Learn to read a total cost of ownership model, and learn to build one. It is the single most transferable skill in this business.
Platforms will change three times in your career. The question “what does this actually cost us over three years” never will — and the person in the room who can answer it is the person who gets listened to.
Your next step
The worksheet accompanying this module is prefilled with the ranges above and does the math itself. Overwrite the blue cells with your own quotes, retainers and hosting bills, and look at the bottom line.
Then send it to whoever told you the license was free. Not to win the argument. To have the real one.
If I Sat on Your Board: The question I’d ask
Not which platform. Not what the license costs.
What percentage of your engineering hours last quarter went to keeping the platform alive rather than making you money — and who is tracking that number?
Three possible answers, and they tell you everything. We don’t measure that means you are paying the bill without reading it. About half, we think means you already know and haven’t said it out loud. Eleven percent, here’s the dashboard means you own your platform instead of the other way around.
The license is the smallest number in this decision.
Free software. Expensive obligations. Count them both.
Next in this series — Module 05: Your B2B Buyer Is Not a Consumer With a Bigger Cart Shopify, Adobe Commerce and OroCommerce — and how to tell which one your business actually needs.
About the author
Gary Q. Smith — President, GQS Direct, LLC
Gary pairs four decades of P&L-accountable direct marketing leadership with practitioner-level command of today’s commerce stack. He is currently an AI evangelist and practitioner and has led four e-commerce website implementations and integrations, built marketing databases, was architect and project leader for a custom ERP system, and managed omnichannel marketing strategy and communications for several businesses.
Most consultants have studied these problems. GQS Direct has owned them.
Start with a complimentary consultation →
The E-Commerce Implementation Series
Module 01 — Re-Platforming Is a Systems Project, Not a Web Design Project
Module 03 — Middleware: The Key to Effective Integration and Project ROI
Module 04 — The Open-Source Paradox: Hidden Maintenance and DevOps Costs (you are here)
Module 05 — Your B2B Buyer Is Not a Consumer With a Bigger Cart