This will always be a work in progress, because the web just keeps on keepin' on.
This is not a guide for big corporate sites, for movers and shakers, for the absurdly ambitious who want to fight with the big sites for attention. This is for the small people; the ones for whom a website is to be an expression of personality, a hobby, a little shop of things, a bit of personal joy. YMMV, but that's who I'm writing for - the people who miss or missed out on the way the web used to be.
Costs
Probably most people's first question. Things you will and won't and might have to pay for:
A domain name, the URL at which your site is accessible. Registration costs are annual (normally), and tend to be around $15-25 USD, but it depends on the extension you choose (e.g. com, net, info, and so on), and the services you opt into, such as identity protection (unprotected domains include your name and address as part of the WHOIS info, a public registry, so if you don't pay this fee you will get spam, yes this is extremely annoying). This is a somewhat avoidable cost - you can have a subdomain on someone else's domain name; for example, WordPress's free hosting option allows you an address at yourwebpage.wordpress.com.
Hosting, the computer space and bandwidth used to actually run your site, make it accessible on the web, and store your images, code, and other content. Costs and associated services vary wildly, potentially ranging anywhere from $10-15 a month (often with cheaper annual plans), to hundreds or thousands of dollars for sites which need significant resources. (Most do not.)
"Managed" hosting will offer a certain amount of automatic maintenance and other tools. Again, there are a few options for free hosting, but as with most things free, there are non-currency costs - primarily reduced control. In most cases free hosting will be limited to whichever architecture is provided by the service, and you will likely have serious limitations on the features available.
Email support. If you don't need your website to send email (such as a contact form from which users can directly email you, registration and password reset forms, and so on), this is an optional cost. If you do, it is generally necessary to subscribe to a service providing SMTP (secure mail transport protocol), which ensures your emails are delivered. Emails not using SMTP are often blocked by Gmail and other email handlers. SMTP services range around $90 annually.
Architecture. Some architectures (see below) have associated costs.
Development. You may create your site yourself, and some architectures will make this more or less accessible to non-technical users or new learners. You may also choose to hire a developer. Choosing a developer is outside scope of this tutorial.
Maintenance. Depending on your architecture (see below), you may have few maintenance requirements, especially if using managed hosting. However, most architectures will require regular updates to fix discovered bugs, add new features, and generally keep the structure compliant with the current state of the web. This is frequently a task relegated to a developer as a monthly maintenance contract, and depending on your hosting and technical comfort level, may be something you can do for yourself.
Design. You may choose to opt for a largely out-of-the-box visual design for your site, so this is optional up to the limits of your architecture's built-in design options, but for a custom, personalized design you will generally need to hire someone, or learn how to adapt a theme yourself. Developers and designers are often but not always different people (and there can be some overlap in the creation of a site theme). A designer may either create the actual visual design, or may implement one provided. Also, many architectures have a library of available themes, some free, some paid, which can provide additional options.
Architecture
Once upon a time, all sites were plain HTML. Then CSS came along. Then PHP and Perl and JS and Flash and all manner of other interactive, programmed options which, being interactive, carry certain risks.
It is still entirely possible to have a pure HTML (likely HTML + CSS) site. Unless you're having someone else do the building for it, this will require learning enough HTML to format your content, even if that's no more than paragraphs and italics. Such a site, while it potentially sacrifices a great deal of convenience, almost completely nullifies the risk of your site being hacked from the webpage itself. (Server hacking is outside the bounds of this tutorial.)
However, most people are going to want some form of "content management system" (CMS). WordPress is common example - it provides the ability to log in, view lists of your posts, add and edit new posts, and attach other desired features.
However, some architectures have associated costs, such as the extensive plugin library available to WordPress, many of which charge one-time or annual licensing fees. Depending on the functionality required by your site, this can become very expensive; often for complex sites this is a reason to hire a shop to handle your webpage, as shops will generally have a suite of plugins for which they have already purchased multi-site licensing.
Some architectures are notably open-source, with their libraries of plugins predominantly free for use. Drupal and Backdrop (a Drupal 7 fork), are particularly noteworthy for this, with a vast repertoire of features which can freely and easily be added to sites.
Backups
No matter how carefully maintained and updated, sites can be hacked, servers can crash, hosting can have failures. It is an extremely good idea to have a regular routine for taking and storing a backup - the code, media files, and database (if any) which make up your site. For a simple HTML site this may just mean copying the web directory to your computer at whatever interval makes you comfortable. For an architecture, this requires determining how content is stored, which files are required, and the best method of copying the database. This is architecture-specific, and the architecture may provide the tools innately, or may have one or more plugin options for the purpose.
Your hosting itself may offer an automated backup feature (sometimes for a fee), which can reduce the amount you need to personally do, but it is extremely advisable to make sure you can save copies yourself, and that you know how to restore them.
Moderation
Not all sites need moderation. If you're not supporting comments on posts, forums, or other multi-user interactive features, you can skip this section.
If you do want users interacting directly on your site, you will deal with bots, trolls, spammers, and similar nuisances. How you choose to manage your community will entirely depend on your tastes and the type of interaction you're cultivating.
You'll need some form of user registration, which will need to include anti-bot measures such as honeypots, captchas, or other similar interfacing. All modern architectures offer built-in or add-on features for this, and the ones you choose to implement are up to you. They won't catch everything.
Search Engine Optimization (SEO)
Currently search discoverability on the web is in severe flux as a result of the AI tsunami, Google's bad faith management of its search service, and the reductive consolidation of internet features onto a few massive services. Once upon a time, SEO mattered, but it has been obnoxious and opaque for a long time now, and is increasingly becoming pointless as Google drives traffic away from actual sites.
I don't have the expertise to comment further on it. Word of mouth is the only semi-reliable option I'm aware of.
AI Scrapers
The parasites of the web, draining bandwidth, potentially to the point of DDOSing (denial of service - attacks which use up all of a site's capacity so they become inaccessible), and stealing content to repurpose without attribution. Until and unless some governmental source decides to take legal action on this plague, there's not much to be done about it. You can either make your site available to the world at large and be scraped, or you can lock it down to users who log in and make it a walled garden.
Cloudflare, a content delivery service involved in a huge proportion of websites, is taking steps to reduce this issue, but Google's bad-faith approach is making it difficult for them both to prevent AI theft and still make sites available for Google indexing. You may be forced to choose between having your site listed on Google and keeping control of your content.
On the plus site, there are non-Google search engines, and if you're not paying Google's bribes for good rankings you might not show up with them regardless. And they will AI-summarize your site, reducing the chance people visit it anyway.