TL;DR
- WordPress website maintenance with us typically costs €50 to €200 per month, or about €600 to €2,400 per year, depending on the size of your site.
- On top of that, there are hosting costs (€10 to €50 per month) and your domain name (€10 to €15 per year).
- WordPress website maintenance is not a luxury. In 2025, 11,334 new vulnerabilities were found in the WordPress ecosystem, 91% of which were in plugins and 9% in themes.
- The time you have is short: for heavily exploited vulnerabilities, the median time to first exploitation is approximately five hours, and about half are exploited within 24 hours.
- Premium plugins are not more secure. 76% of the vulnerabilities in paid components were exploitable, and those were three times as likely to have actively exploited vulnerabilities.
- WordPress itself recommends PHP 8.3 or higher. If you’re still running PHP 7.x, you’re using a version without security updates.
- You can do it yourself, but factor in your hours. One hour per month at your own rate is often more expensive than a subscription.
Introduction
Maintenance is the area where almost every business owner cuts corners—until something goes wrong. Then your site gets hacked, or your contact form has quietly failed to send emails for three weeks, or your hosting provider notifies you that your PHP version is no longer supported and your site will go offline in two weeks.
So the question “How much does WordPress website maintenance cost?” is actually two questions: how much does the subscription cost, and how much will it cost you if you don’t do it. In this blog post, we’ll cover both. You’ll learn what maintenance should include, how much it costs, what the risks are (with concrete figures), and when it makes sense to do it yourself.
Table of Contents
How much does WordPress website maintenance cost per month and per year?
With us, WordPress website maintenance costs €50 to €200 per month, which amounts to approximately €600 to €2,400 per year. What you pay depends on the size of your site, the number of plugins, whether you have an ecommerce store, and how many hours of modification you’d like to purchase.
Here’s what sets us apart:
- Type of site. An informative site with ten pages requires less attention than an ecommerce store with a checkout process, integrations, and payment methods.
- Number of plugins. Each plugin is a component that needs to be updated and tested.
- Integrations. A site that’s integrated with your accounting, CRM, or inventory system requires more testing with every update.
- Hours for revisions. Is one hour per month included for text revisions, or is it purely for technical maintenance?
- Response time. How quickly do you want someone to look into it if your site goes down?
Add to that the fixed costs you already have: hosting at €10 to €50 per month and your domain name at €10 to €15 per year. For an average business website, that brings the total to about €800 to €1,500 per year for the complete package of hosting plus maintenance.
You can find details of what’s included on our page about WordPress website maintenance.
What should a maintenance subscription include?
Six things: WordPress updates, theme and plugin updates, restorable backups, monitoring of your site’s availability, security measures, a test environment, and periodic checks of your site. If something on this list is missing, please ask why.
For each component, here’s what it is and why it belongs here:
1. Updates. WordPress, your theme, and your plugins. Timely, and thoroughly tested before major updates are implemented. This is the core of maintenance and the reason it’s done monthly rather than annually.
2. Backups that have been tested. Daily or weekly, stored off-site, and actually restored at least once to verify that they work. A backup you’ve never restored is an assumption, not a backup.
3. Monitoring. So that your host or your agency notices if your site goes down, not your client.
4. Security. A firewall or malware scanner, strong passwords with two-factor authentication, and the removal of plugins you don’t use. Even an inactive plugin with a vulnerability is a vulnerability.
5. A staging environment. This allows updates to be tested on a copy first, rather than on your live site. You can read about how this works in our blog post on staging.
6. Regular monitoring. Are your forms still working? Does your site still load quickly? Are there errors in Search Console? You don’t check these just once—you monitor them on an ongoing basis.
You can find out how to establish a routine for this in our blog post about the perfect WordPress maintenance schedule.
Why is WordPress website maintenance necessary?
Because the gap between a known vulnerability and its exploitation is very small. In 2025, 11,334 new vulnerabilities were found in the WordPress ecosystem, 42% more than the previous year. Of these, 91% were in plugins and 9% in themes. Six were found in WordPress itself, all of which were low priority.
It’s important to understand this: WordPress itself isn’t the problem. Your plugins are. And you don’t have much time: for heavily exploited vulnerabilities, the median time to first exploitation is about five hours, and roughly half of the severe cases are exploited within 24 hours.
Two figures from the same study that surprise most people:
- Premium plugins are not more secure. 76% of the vulnerabilities in paid components were actually exploitable, and paid components were three times as likely to have known, actively exploited vulnerabilities as free components.
- Your hosting provider doesn’t block everything. A test revealed that the standard security measures of hosting providers only blocked a portion of the attacks, with significant differences between providers.
In addition to security, there’s another factor: technology becomes outdated. WordPress recommends PHP 8.3 or higher and MariaDB 10.11+ or MySQL 8.0+. If you stick with an old PHP version, you’ll no longer receive security updates, and at some point, your site will simply stop working. Switching to a new PHP version is exactly the kind of change you should test in a staging environment first.
What does it cost if you don’t perform maintenance?
It’s more than just a subscription—and that’s not meant rhetorically. Having a hacked site cleaned up costs a one-time fee that’s a multiple of an annual subscription, and then there’s the loss of visitors and trust. A form that quietly stops submitting data costs you inquiries you’ve never even counted.
The costs you incur without maintenance:
- Recovery after a hack. Clean up the site, restore the backup, patch the vulnerability, and verify that nothing has been left behind. This is by far the most expensive scenario, especially without a recent backup.
- Missed requests or orders. You won’t see a broken form or a broken checkout process in your statistics. You’ll just see that things are quiet.
- Loss of search visibility. A hacked site may be flagged as harmful by Google, and removing that warning takes time.
- Catching up on overdue maintenance. Two years without updates means that making updates becomes risky: too many versions have been skipped to proceed safely. At that point, it becomes a project rather than a quick fix.
- Your own time. Every hour you spend figuring out why something isn’t working is an hour you’re not spending on your business.
That last point is the most underestimated. Factor in your own hourly rate, and the math often changes immediately.
Can you handle WordPress website maintenance on your own?
Yes, and for a simple site, that’s a realistic option. You’ll need three things: a set time in your calendar, a test environment to try out updates, and working backups. Without those three, self-maintenance isn’t maintenance—it’s just hoping for the best.
Here’s what you’ll be doing each month:
- Back up the file and check that it is usable.
- First deploy updates to your test environment and go through your checklist.
- Publish updates and double-check them.
- Test forms by actually filling them out.
- Remove unused plugins.
- Check Search Console for new errors.
- Check your page load speed.
Expect to spend half an hour to an hour per month on a simple site, and more for an ecommerce store or a site with many plugins. At an hourly rate of €75, that’s around €900 per year of your own time—plus the risk that you’ll miss something. Compare that to a subscription before you decide that doing it yourself is cheaper.
Where doing it yourself goes wrong:
- The fixed schedule disappears when things get busy—and that’s exactly when you forget about it.
- There is no test environment, so every update is a gamble.
- The backup has never been tested. Then, at the worst possible moment, you realize it doesn’t work.
- Major updates are postponed because they’re scary, and this increases the risk rather than reducing it.
If you do want to handle this yourself, start by getting the basics in order: hosting with a staging function, automatic backups, and a set time in your calendar. See also our blog on securing your website.
How many plugins are too many?
There’s no maximum, but there is a good rule of thumb: every plugin should solve a problem you actually have, and you should know who maintains it. Twenty well-maintained plugins that you actually use are better than eight neglected ones. The number isn’t the problem; unmanaged and unnecessary plugins are.
What to look out for when cleaning up:
- When was it last updated? No activity for over a year indicates a risk.
- Are you still using it? If not: delete it, don’t just deactivate it.
- Does he do just one thing? All-in-one plugins are difficult to replace if something goes wrong.
- Can you do without it? For many things, there’s a simpler solution in your theme or in a few lines of code.
Every plugin you remove means less website maintenance, less risk, and usually a faster site as well. An overview of plugins that deserve a spot on your site can be found in our blog post about the best WordPress plugins.
Maintenance and Speed: Why They’re Connected
Because a site without maintenance slows down. Plugins pile up, images are uploaded without optimization, caching becomes ineffective, and your PHP version becomes outdated. Google uses three metrics for this: LCP under 2.5 seconds, INP under 200 milliseconds, and CLS under 0.1, to be achieved in 75% of your page visits.
The important caveat: Google itself states that there is no single “page experience” signal and that good scores are no guarantee of a high ranking. So you optimize speed for your visitors, with SEO as an added benefit.
Here’s what maintenance involves: a newer PHP version is faster, streamlined plugins are lighter, and effective caching makes the biggest difference with the least effort. You’ll find a concrete starting point in our blog post on improving your website’s speed.
What should you look for when choosing a maintenance provider?
Ask about five things: exactly what’s included, how often updates are provided, whether testing is done in a test environment, who owns your site and your backups, and what happens if something goes wrong. You can’t compare a price without those answers.
Specific questions you should ask:
- What is and isn’t included? Are text changes included, or are they billed by the hour?
- How often are updates made? Monthly is the minimum; security updates are made as soon as possible.
- Is testing conducted on a staging environment? If not, experimentation will take place on your live site.
- Where are my backups, and can I access them? You must be able to access them yourself, even if the collaboration ends.
- Do I own my website, my hosting, and my domain name? Sort this out upfront. If your domain name is registered in your agency’s name, you’re more dependent than you think.
- What is the response time in the event of a system failure? And is someone available outside of business hours if you have an ecommerce store?
- Will I receive a report? So you know what’s been done and what you’re paying for.
Want to outsource it? Check out our WordPress website maintenance and managed WordPress hosting services, or contact us. You’ll know upfront what we do and what it costs.
Frequently Asked Questions About the Costs of WordPress Website Maintenance
Is WordPress website maintenance really necessary, or is it just a revenue model?
It’s necessary, and the numbers speak for themselves. In 2025, 11,334 new vulnerabilities were found in the WordPress ecosystem, 91% of which were in plugins. For heavily exploited vulnerabilities, the median time to first exploitation is approximately five hours. That means “just updating next month” is a real risk. What you should critically examine, however, is the scope of a subscription: does it only involve clicking an update button, or does it also include backups, monitoring, a test environment, and periodic checks? Ask for that specification. A subscription without a test environment is only half the job.
What happens if I don’t perform maintenance for years?
At that point, updating becomes riskier than not updating—and that’s exactly where the trap lies. After two years without updates, so many versions have been skipped that a single round of updates can easily break your site. What’s needed then isn’t maintenance but a recovery project: first a backup, then updating step by step in a test environment, and checking what breaks at each step. That costs many times what regular maintenance would have cost. And in the meantime, you’ve been online for months or years with known vulnerabilities.
Isn’t maintenance already included with my hosting?
Partially, and that distinction is important. Your host maintains the server: the operating system, the web server, the PHP version, and sometimes the backups. What your host doesn’t do is update your WordPress website, your theme, and your plugins, or check whether your forms still work after an update. Some managed WordPress packages perform automatic updates, which is a benefit, but without testing, it’s also a risk. So be sure to ask exactly what your host does and where your responsibility begins. That gap is usually bigger than people think.
Can I just turn on automatic updates and be done?
This is a good approach for security updates, as speed takes precedence over certainty in those cases. However, it’s unwise for major updates to your theme, page builder, or a major WordPress version: these can break your layout or forms, and those issues will appear on your live site without you realizing it. The practical approach is therefore: keep automatic updates enabled for security, and test major updates in a staging environment first. And in both cases, be sure to check afterward, because an automatic update won’t notify you if your contact form has stopped working.
How much does it cost to clean up a hacked WordPress site?
That depends on how long the site has been compromised and whether there is a recent, clean backup. With a good backup, restoring the site and patching the vulnerability is manageable. Without a backup, manual cleanup is required: reviewing files, checking the database, removing any remaining access points, and verifying that the issue is resolved. This is a labor-intensive process and costs many times more than a year’s worth of maintenance. On top of that, you may receive a warning from Google, and removing it takes extra time. This is the scenario you’re paying for with your maintenance fees.
How much time does maintenance take if I do it myself?
For a simple site, it takes half an hour to an hour per month, provided everything is already set up correctly. For an ecommerce store or a site with many plugins and integrations, that time increases because you’ll need to do more testing. Convert that to your own hourly rate and compare it to a subscription plan, because the cost often works out differently that way. And factor in the one-time setup: setting up a staging environment, configuring backups, and creating a checklist. That takes a few hours, but without that foundation, self-maintenance isn’t reliable.
What is the difference between maintenance and support?
Maintenance is preventive and scheduled: updates, backups, monitoring, and checks, on a fixed schedule. Support is reactive: something is wrong, and you need help. Many subscriptions include both, but not always to the same extent. Therefore, be sure to ask explicitly whether text changes and minor adjustments are included or billed by the hour, and what the response time is in the event of an outage. For an ecommerce store, that response time is the most important factor in your entire subscription, because an hour of downtime costs you more than a month of maintenance.
Do I have to purchase maintenance from the agency that built my site?
This isn’t required, but it’s usually more practical. Whoever built the site knows its structure and the links, and can find the cause of a problem more quickly. What you must do: make sure you own your site, your hosting, and your domain name, and that you have access to your backups. Then you can switch whenever you want. Check this upfront, not when you’re leaving. If your domain name is registered under your agency’s name, or if you don’t have an administrator account, your freedom of choice is more limited than it seems.
Does maintenance pay for itself?
Not in terms of extra revenue, but in avoided costs and time. The math is simple: compare the annual fee to what a single recovery process after a hack costs, or to what a month of broken forms costs you in lost applications. For an ecommerce store, this becomes even more critical, because a single day without a functioning checkout process translates directly into a loss. On top of that, a well-maintained site is faster and therefore converts better. That’s not a promise of a return on investment, but it is the reason why it’s wiser to take action than to hope for the best.
