Cost of upgrading to PQCrypto We already have recommendations on what PQCrypto to use:
PDF (page 11)


  Symmetric encryption Thoroughly analyzed, 256-bit keys:
  
  
  AES-256
  Salsa20 with a 256-bit key
  
  
  Symmetric authentication Information-theoretic MACs:
  
  
  GCM using a 96-bit nonce and a 128-bit authenticator
  Poly1305
  
  
  Public-key encryption McEliece with binary Goppa codes:
  
  
  length n = 6960, dimension k = 5413, t = 119 errors
  
  
  Public-key signatures Hash-based (minimal assumptions):
  
  
  XMSS with any of the parameters specified in CFRG draft
  SPHINCS-256
  


What would it cost to upgrade to those recommendations?

We assume that the recommendations will survive further scrutiny and that upgrading software is for free. In practice it will happen as part of a software upgrade that will happen anyway.

What is the additional:


Disk usage
RAM usage
CPU usage
Bandwidth usage


for a normal user and for a normal website?

Since users mostly visit the same websites as they did the day before I am thinking that the key exchange may not be so scary after all. If the SSL certificate is only downloaded every few months, then it will be very little extra bandwidth.
Using AES-256 or Salsa20, Poly1305 or GCM authentication should come at no to little additional cost if you are already using HTTPS. If your server is somewhat modern bandwidth cost is about 16 bytes per HTTPS data packet sent and a few hundred bytes (at most) of RAM and rather minimal performance overhead compared to the actual business logic running on the server. You shouldn't worry about this part.

The asymmetric part is the interesting one. As a server you'll have to generate 1 signature for TLS per handshake (so at most one per request) and SPHINCS-256 costs 43M cycles on Intel Kaby Lake CPUs which is about 20ms on a 2GHz CPU. Signatures are 41kB though which means the RAM overhead is probably about ~40kB per handshake and the bandwidth overhead is about the same. Now if you deliver 2MB of JavaScript anyways this will hurt less than if you're only using a very simple static website... I haven't found data on XMSS so won't comment on that.

As for McEliece, performance data suggests it needs about 2M cycles for decryption, which happens once during a TLS handshake, so about 1ms on a 2GHz CPU. However, the public key is 1.3MB which is usually transferred once per handshake. The actual ciphertext is only $n$ bits and so only a bit larger than a comparable RSA encryption. You may want to note though that modern TLS 1.3 doesn't support key transport (ie public-key encryption for key agreement) anymore.

So, in total we get an overhead of about 45M CPU cycles and about 1.4MB per TLS handshake which is about 23ms on a modern server CPU.