WordPress maintenance cost: what you pay for, and why prices differ

WordPress maintenance has no single price, because the word covers a list of recurring work and sellers draw the list differently. The work itself is the same on every site: updates, a look at the site after each one, backups that can be restored, a watch for outages and break-ins, and small fixes. You pay for it in one of three ways: with your own hours, by the hour when something breaks, or with a fixed monthly fee.

This page quotes no company's price list and ranks nobody. It shows what moves the cost, and how to work out each of the three ways in your own figures.

What you are paying for

Five kinds of work, whoever does them.

• Updates. WordPress's hardening guide says older versions are not maintained with security updates, and that once a fix is released the information needed to exploit the hole is almost certainly public.
• A look at the site afterward, and a way back. WordPress's guide to managing plugins says problems can sometimes happen during an update, and to have a current backup first.
• Backups that can be restored. A full restore needs both the database and the files. WordPress's documentation says to keep at least three to five recent backups, in different places.
• A watch on the site. The hardening guide says prevention is sometimes not enough, and that monitoring lets you react faster.
• Small fixes and changes to pages, menus and forms.

WordPress does part of this for nothing. It installs its own maintenance and security releases in the background by default, and an administrator can switch on automatic updates one plugin and one theme at a time. Nobody looks at the site after an automatic update.

That look is the part that costs money, along with someone who can put the site back and someone who notices when it is down. All three are attention, and attention is paid for in time. The jobs themselves, and where each one is in WordPress, are in the WordPress maintenance checklist.

The three ways to pay for it

None of the three is the cheap one for every site. Which is cheapest for yours depends on what follows.

What moves the cost up or down

These apply to all three ways. They change your own hours as much as they change a seller's price.

Licenses decide what you keep when you leave. WooCommerce's documentation for its own marketplace says that when a subscription expires, the extension stays installed and stops receiving new versions, security patches included. Its guidance for agencies sets out three arrangements: the client buys the subscription, the agency buys it and transfers it, or the agency keeps the ownership and the billing. Ask which one a quote assumes.

What doing it yourself costs

The cost is your hours each month, times what an hour of your time is worth, plus what you pay for tools. No published figure can tell you the hours: a brochure site with five plugins and a store with forty are different jobs. Measure your own.

The weak point of doing it yourself is that a missed round is silent. Nothing on the front of the site shows that updates are three months behind or that the backups stopped.

What paying by the hour costs

In a month when nothing breaks, it costs nothing. When something does, the bill is a rate times the hours, and the hours start before the repair does.

• Getting in. On a single site, only an Administrator can update WordPress, plugins and themes. The person needs an account at that level, and the hosting login when the dashboard itself will not load.
• Finding the cause. Someone who has never seen the site has to learn what is installed before they can say what failed.
• The repair, and a check that nothing else broke.

One public figure is a useful reference, as long as it is read for what it is. The U.S. Bureau of Labor Statistics puts the median hourly wage of web developers employed in the United States at $44.54 in May 2025, with the middle half earning between $30.88 and $60.69. That is an employee's gross pay. It leaves out what an employer pays for benefits, and the survey does not cover self-employed people. So it is not what a freelancer or an agency charges, and it is not a quote. Ask for the hourly rate in writing, and ask whether time spent finding the cause is billed at the same rate.

What a break costs when nobody is watching

A fault costs three stretches of time: the hours before anyone notices, the hours until someone is free to start, and the hours of the repair. Only the last one appears on an invoice.

• An outage nobody has seen. A site that is down takes no orders and no inquiries for as long as it is down. Search follows later. Google's documentation says server errors make its crawlers slow down, that addresses already in its index are kept at first, and that addresses which persistently return a server error are removed.
• A break-in found late. WordPress's hardening guide gives the example of a site compromised on May 1st and not detected until May 12th. Whether a clean backup still exists by then depends on how far back the backups reach. If Google has flagged the site, visitors may see a label in search results or a warning page in the browser, and after the clean-up the owner has to request a review. Google's guidance says a malware review takes a few days, and a review for a site hacked with spam can take up to several weeks.
• A backup that is not to hand. WordPress's documentation notes that most hosts back up the whole server, that requesting a copy of your site from them takes time, and that a speedy recovery is critical.

So the question to price is how long the site would be broken before the repair began, and what those hours are worth.

What a monthly plan trades for the fee

A plan swaps a bill you cannot predict for one you can. You pay in months when nothing happens. In return the routine runs on a schedule, the person who answers already knows the site, and a monitor is meant to notice a fault before a customer does.

It does not buy certainty. WordPress's hardening guide says security is risk reduction, not risk elimination. A plan lowers the odds of a bad day and shortens it. It also leaves some hours with you: what the site should say, and the writing of it, stay yours.

What a plan should include, and what it leaves out

Prices are comparable only when the lists behind them are. Hold every plan to the same lines, and get a number or a yes for each in writing.

How to choose a WordPress maintenance service has the full list of questions, and how to check each answer against the site.

WP Ministry's own plans show how those lines become tiers. In its WordPress maintenance service, every plan covers weekly updates, daily offsite backups, uptime monitoring, security scanning and a monthly report. Essential has no time for edits. Care adds 90 minutes a month of fixes and small edits, malware cleanup, and backups kept for 90 days. Business raises the allowance to 3 hours a month, tests updates on a staging copy first, and adds a quarterly speed tune-up. Store is for WooCommerce. It raises the allowance to 5 hours a month and adds a checkout and payment test after every update and more frequent backups for order data.

Each step up is a factor from the table above: edit time, a staging copy, a store.

What sits outside a plan

Three things are separate work. A plan may include one of them or none, so ask about each.

• Hosting. The server, and anything on the hosting account that is not WordPress.
• Redesigns, new features and content writing. These are projects. Ask how one is quoted.
• Time beyond the allowance. Ask whether the work stops, is quoted first or is billed by the hour, and whether you are told before the clock starts.

Cleaning up after a break-in and the licenses for paid plugins are two more lines that a plan may or may not cover. Ask for the exclusions as a written list. A plan with no list still has exclusions, and you will meet them on an invoice.

How to work out your own figure