How much a WordPress website costs per year: the eight lines of the budget and what drives each

WordPress the software costs nothing. WordPress.org says you may use it, change it and run a business on it "without any licensing fees", under the GPL. Running a website on it is what costs money, and the yearly bill has about eight lines: some paid by the year, some by the month, and some only when something breaks.

Three choices decide most of the total: the hosting, how many paid plugins and themes the site uses, and who does the upkeep.

This page states no company's price and ranks nobody. Prices of domains, hosting and plugins change and differ by seller, so a copied table of them is soon wrong. What follows is the full list of lines, what drives each, the trap in each, and where to read today's price.

The eight lines

Two lines must be paid in money: the domain and the hosting. Each of the others can be free, paid for in your own time, or left as a risk you carry.

The domain name

A domain is rented, not bought. ICANN's guidance for registrants says a name is yours for the period you registered it for, typically one to ten years, and must be renewed before it expires if the website and the email on it are to keep working.

What drives the price. There are two layers. The registry that runs an ending such as .com charges the registrar a wholesale price for each year. The registrar, the company you buy from, then decides what you pay: ICANN's guidance says it is up to your registrar to set its own prices, terms and conditions.

For .com, the wholesale layer has a ceiling written into a contract. The registry agreement between ICANN and Verisign, dated December 1, 2024, sets a maximum price of US $10.26 for each year of a new or renewed registration, and for each transfer between registrars. That is the most the registry may charge a registrar. It is not what you pay: it leaves out a per-name fee of ICANN's own, and the registrar sets its own price on top.

The agreement lets the registry raise that maximum by up to 7 percent in each of the last four years of every six-year period, with six months' notice. In the current period those four years begin on October 26, 2026, which is still to come as of this page's date. A separate clause allows a rise in any year to cover the cost of a new ICANN policy or of an attack on the domain name system. This is a reading of the agreement's text, not legal advice.

Other endings can be on different terms. ICANN also publishes a base registry agreement, and the pricing section of the version approved on January 21, 2024 sets no maximum. It requires uniform pricing for renewals, except where the registrant agreed to a higher renewal price at registration after a clear disclosure. So read a name's renewal price before you register it.

The trap: the first year is not the price. ICANN's guidance says promotions for new customers are common, which is why a first registration can cost less than its renewal. Budget on the renewal price.

The second trap: letting it lapse. ICANN's policy for generic endings such as .com has registrars send a reminder about a month before a name expires and another about a week before. Once a name has been deleted there is a 30-day redemption period, and ICANN says restoring it then may bring an additional fee. After that the name is released to whoever registers it first. Switch on automatic renewal and keep the card behind it current.

Privacy. A privacy service publishes alternate contact details in the public record in place of your own. Whether it is in the price or a line of its own is on the registrar's price page.

Where to read today's price. On the registrar's own site. ICANN's policy requires registrars to display their renewal fees and their redemption fees there. If the name came free with a hosting plan, look up what it renews at.

Hosting

WordPress's documentation defines the host as the company you pay to put your site online. WordPress.org's requirements page lists what the host must supply: a current PHP, a MySQL or MariaDB database, and HTTPS support.

Hosting is sold in three broad kinds.

• Shared hosting. Your site is on a server that hosts other websites besides your own.
• Managed WordPress hosting. A plan built around WordPress, where the host takes on some of the work inside it. "Managed" has no fixed meaning, so each host's own documents say what it covers.
• A server of your own. You rent the machine. WordPress's hardening guide says the web server and the software on it can have vulnerabilities, and that you either keep them secure and current yourself or use a host that does it for you. On your own server that work is yours, or someone's you pay.

What more money buys differs from host to host, so compare plans on the same lines: the limits on visits, bandwidth, disk space and number of sites; how often backups are taken and who restores one; whether there is a staging copy; and what support will and will not do. What hosting covers and what is left to you reads several hosts' own pages on those lines.

The trap: the introductory price. The advertised price is often for the first term only. Two hosts, in alphabetical order, say so on their own pages as those read in October 2026. DreamHost's pricing page says an introductory discount applies for the period stated on the plan and that the listed renewal rate applies after that. SiteGround's help pages say the first term is discounted, and that the renewal price is typically higher and is displayed during signup. On any host's page, find the renewal rate and the length of the term the advertised rate requires. Budget on the renewal rate.

The second trap: limits. A plan is priced for an amount of use. Kinsta's documentation, for one, says each of its WordPress plans includes a set number of monthly visits or an amount of server bandwidth, and that going over may bring overage charges. Ask any host what happens when your site passes a limit.

The SSL certificate

A site needs one: HTTPS support is on WordPress.org's list of requirements. It does not have to cost anything. Let's Encrypt, a nonprofit certificate authority, says it does not charge a fee for its certificates, and that for many people the hosting provider gets and manages the certificate for them. It adds that some hosting providers charge a nominal fee for the administration.

Its certificates are valid for 90 days by default, and it plans to bring that down to 45 days by February 2028, so renewal has to be automatic. Ask the host whether a certificate is included and whether they renew it.

What paying buys. Let's Encrypt issues Domain Validation certificates, and says it has no plans to issue the other two kinds, Organization Validation and Extended Validation. Other issuers sell those. The CA/Browser Forum, which publishes the guidelines for Extended Validation, says the vetting before such a certificate gives some assurance that the site's owner or operator has been identified against a public record of incorporation or registration. It also says most browsers no longer show this in the address bar: a visitor has to click an icon to see the organization's name.

Pay for a certificate if a contract or a partner asks for one of those kinds by name. Otherwise this line can be zero. How to install a free SSL certificate has the steps.

A theme and plugins

This line can also be zero. WordPress comes with default themes. WordPress.org's Theme Directory describes its themes as free, and each is reviewed by a dedicated team. Plugins in the WordPress.org directory must carry a license compatible with the GPL, and the directory's guidelines forbid a plugin there from locking functionality until you pay. A directory plugin may still connect to a paid service, or offer a paid add-on sold elsewhere.

Paid themes and plugins are sold outside the directory. WordPress.org's page on commercial themes says the GPL does not require everything to be zero-cost. Many are sold as a license that renews. On the WooCommerce.com Marketplace, for one, annual billing is the most common schedule.

What drives the price. The number of paid items, and what each renews at. The renewal can differ from what you first paid. WooCommerce's documentation says its subscriptions renew at the price listed on the day of renewal, not the price originally paid, and that coupon codes do not apply to renewals.

What stops when a license lapses. It depends on the seller, and each one says so in its own documentation. Three examples, in alphabetical order:

In all three, updates stop. A license you let lapse to save its fee turns into a plugin that is no longer patched.

Where to read today's price. Each seller's own page. To build the list, open the Plugins screen and note every plugin and theme that was paid for, when it renews, and whose account the license is in. How to choose WordPress plugins covers what to check before adding one.

Email at your domain

There are two kinds of email, and neither is always part of hosting.

Mailboxes, such as an address at your own domain. Some hosting plans include them and some do not. Kinsta's documentation says it does not provide email as part of its hosting plans. WP Engine's says it does not provide MX records for email hosting. Where the host has no mailboxes, you rent them from a mail service. That works with any host, because mail for a domain is delivered to wherever the domain's MX records point.

The mail the site itself sends: form notifications, password resets, order emails. WP Engine's documentation says it caps the number of messages a site can send in an hour, and recommends a third-party email service, connected with an SMTP plugin, for anything beyond the ordinary. A site that sends many messages may need such a service, which is one more line. How to fix WordPress not sending email covers the setup.

Where to read today's price. The host's plan page says whether mailboxes are included. The mail service's own page has the rest.

Backups and security tools

Check first whether you are already paying for these. A hosting plan or a maintenance plan may include them.

WordPress's documentation says to keep at least three to five recent backups in different places. It notes that most hosts back up the whole server, but that getting a copy of your site from those backups takes time. By that advice the host's copy is one of several, and the others need somewhere to live.

So the line is storage away from the server, plus a license if the backup or security plugin you use is a paid one, plus an uptime monitor if yours is paid for. Each exists in free and paid forms, and each seller's own page has today's price. How to schedule automatic backups shows a setup and how to prove that a backup restores.

Upkeep

Someone has to apply updates, look at the site afterward, check that backups ran and notice when the site is down. There are three ways to pay for that: your own hours, an hourly rate when something breaks, or a fixed monthly fee.

This is the line you have the most choice over, and what WordPress maintenance costs works out each of the three in your own figures. Is WordPress maintenance worth it? covers when a plan is not needed.

For the budget: your own hours in a month, times twelve, times what an hour of yours is worth. Or a plan's monthly fee times twelve. Paying by the hour puts nothing on this line in a quiet year, and moves the cost to the next one.

The unplanned

These have no date, so they are the lines most budgets leave out.

• A fix. An update breaks a page, a form stops sending, the site shows an error. Someone is paid by the hour or at a fixed price.
• A cleanup after a break-in. What malware removal costs covers what moves that price.
• A change forced from outside. PHP is one example. The PHP project supports each release for two years, then for two more with critical security fixes only. WordPress.org says your hosting company determines which PHP versions are available, and that it cannot guarantee your themes and plugins will work on a newer one. So a move to a newer PHP can bring repair work on an old theme or plugin. The end-of-life checker shows where your version stands.
• Work the site comes to need: speed optimization, a move to another host, or a redesign. Each is a project with a quote, not a yearly bill. If you expect one, spread what you expect to pay over the years between.

Nobody can tell you this line in advance. Put a figure on it anyway: what one fix would cost at the hourly rate you would pay, plus what one bad day would cost in sales.

Three budgets to fill in

The last column is empty on purpose: every figure in it is yours. Use renewal prices, and multiply a monthly charge by twelve.

A brochure site

A few pages, a contact form, no payments.

A site that takes bookings or leads

The form or the booking calendar is the point of the site, so the lines around it grow. One line is new.

A store

A store has every line above, with payment fees on every sale, and paid extensions as a line of their own.

WooCommerce itself is free: its listing on WordPress.org calls the core platform free and open source. The two lines in bold are where a store's budget differs.

Payment fees are taken from each sale, so they grow with sales. WooCommerce's documentation for WooPayments, its own payment service, shows how such fees are built. Fees are deducted from each payment. The base fee usually has a percentage part and a flat part, a percentage is added for a card from another country or a currency conversion, and transaction fees are not refunded when you refund a customer. Every provider publishes its own schedule. Read yours, and work the line out from last year's sales.

What WooCommerce maintenance costs covers the upkeep line for a store.

What changes the total most

Cheap in the wrong place

A low price is not the fault. The fault is saving on the three lines that show their value only on a bad day.

Hosting. Check a cheap plan on what matters when something goes wrong: how often it backs up, who restores, and what its support will do when the site is down. Then price an outage in your own terms. The downtime cost calculator works out what an outage costs in sales not made, from your own revenue and the hours the site was down. Set a year's saving on hosting against one such day. Search adds to it: Google's documentation says server errors make its crawlers slow down, and that pages which keep returning them are eventually dropped from its index.

Backups. A single copy kept on the same server is gone on the day that server fails. WordPress's documentation asks for several recent copies in different places. The saving here is small, and the loss can be everything added to the site since the last copy that still exists.

Updates. WordPress's hardening guide says that once a fix for a vulnerability is released, the information needed to exploit it is almost certainly public. A site that skips updates, or runs paid plugins on lapsed licenses, stays open to holes that are already known. The bill arrives later on the unplanned line, as a cleanup.

How to work out your own figure