The short version
A WordPress maintenance plan should cover updates, off-site backups, security, uptime monitoring and a person who checks the site after every change. For one small business site, that costs about $50 to $350 a month.
The cheap end is mostly software running on its own. The expensive end adds content, SEO or development hours. What you're really paying for is someone who notices when something breaks and fixes it before your customers do. Below is the checklist we work from, real prices, and the failures we see most.
What a maintenance plan should cover
This is the list we run on the sites we look after. The column on the right is how often it happens. If a plan you're looking at skips a whole group, ask why.
Always running
- Uptime is checked every few minutes, and someone is alerted when the site goes down.Every 5-10 min
- The whole site (files and database) is backed up and stored somewhere other than the server it runs on.Daily
- Malware and file-change scans run, and logins are protected from brute-force attacks.Daily
Updates
- WordPress core, plugins and the theme are updated, with a backup taken first.Weekly
- After updates, someone actually looks at the key pages: home, contact, checkout, booking.Weekly
- Security releases are applied the same day they ship, not at the next scheduled update.As released
Monthly checks
- Contact and quote forms still deliver to a real inbox that someone reads.Monthly
- The SSL certificate is valid and renews on its own, with an alert weeks before it expires.Monthly
- Broken links, 404s and redirect chains are found and fixed.Monthly
- Analytics is still recording visits, and Search Console shows no new indexing problems.Monthly
- Unused plugins and themes are removed, and admin accounts are reviewed.Monthly
Quarterly and yearly
- A backup is restored to a test copy, to prove the backups work.Quarterly
- Page speed and Core Web Vitals are checked on a phone, not just a desktop.Quarterly
- The PHP version is current and still supported by the host.Yearly
- Domain renewal, DNS records and email sending records (SPF, DKIM, DMARC) are checked.Yearly
Hosting is a separate question. Some plans include hosting and some don't. Ours does, because we can't promise uptime on a server we don't control. If a plan doesn't include hosting, add your host's bill to the monthly price before you compare.
What it costs
We looked at the published prices of WordPress maintenance companies in October 2026. For a single small business site, they fall into four rough bands:
- $10 to $50 a month: software only. Automatic updates, backups and scans, often from a plugin or tool company. Useful, but nobody looks at the site afterward.
- $50 to $150 a month: hands-on maintenance. The same tasks done or checked by a person, plus uptime monitoring, hack cleanup and a few small edits. This is where most small businesses should start.
- $150 to $350 a month: maintenance plus work on the site. More edit time, performance work, reporting, and sometimes SEO or content.
- $800 a month and up: enterprise and ecommerce. Development hours, staging workflows, faster response times and a named contact.
Watch for prices that only apply with a one-year prepay, and setup fees (we saw $199 assessment fees and $300 migration fees). For comparison, our Care plan is $125 a month per site with hosting included, and Growth is $300 with SEO, content and Google Business Profile work on top.
What actually breaks
Hacks get the headlines, but most of what goes wrong on small business sites is quieter than that. The first three happened on sites we look after, with the names left out. The last two are the ones we check for most.
- An SSL certificate expired. The host sold a one-year certificate with the plan, and its dashboard said it was on automatic renewal. It wasn't. On the day it ran out, browsers showed a security warning instead of the site for about an hour and a half. A certificate check with an alert three weeks out would have caught it.
- A contact form stopped sending. The page loaded fine and the form said “thank you.” The emails just never arrived. Two leads were lost over three months before anyone noticed. Uptime monitoring can't see this. Only a test submission or watching for a form that suddenly goes quiet can.
- Old files kept being served. The host's cache kept serving last week's stylesheet after a fix. The fix was done, but customers couldn't see it until the cache was cleared.
- An update changes the layout. A theme or page builder update can shift spacing or hide a button. Nothing is technically down, so no alert fires. A person has to look.
- Analytics quietly stops. Swapping or removing a plugin can take the tracking tag with it. The site looks fine, and you only find out when a report comes back empty. We check for the tag daily.
None of these needed a developer to fix. They needed someone checking. That's the case for a plan with a person in it.
Doing it yourself
You can absolutely maintain a WordPress site yourself. Plan on two to three hours a month for a simple site if nothing goes wrong:
- Turn on daily off-site backups with your host or a backup plugin, and restore one to a test copy once so you know it works.
- Set up free uptime monitoring that emails or texts you when the site is down.
- Update weekly, after a backup, and click through your most important pages afterward.
- Send yourself a test form submission once a month, from a phone, to an inbox you read.
- Put the SSL and domain renewal dates in your calendar, three weeks before each one.
Where it usually falls apart isn't skill. It's the third month, when things are busy and the updates get skipped. If you know that's you, that's the honest reason to pay for a plan.
Questions to ask a maintenance provider
The answers tell you whether there's a person behind the plan or just a plugin.
- Where are backups stored, how long are they kept, and when did you last restore one?
- Who looks at the site after updates, and what do they check?
- What happens when the site goes down at 9pm on a Saturday? Who gets the alert?
- Do you test that my contact form still delivers, or only that the page loads?
- Are content edits included? How many, and how fast?
- If the site gets hacked, is the cleanup included or billed separately?
- What do I get each month to show the work was done?
- If I leave, do I keep my site, my domain and my hosting logins?
Red flags
- Backups stored on the same server as the site. If the server fails or gets hacked, the backups go with it.
- No report. If you never see what was updated or checked, you can't tell whether anything was done.
- They own your domain or hosting account. Everything should be in your name, with access shared to them, so you can leave cleanly.
- Hack cleanup costs extra. If security is part of the plan, fixing a breach should be too.
- Long contracts for basic maintenance. Month-to-month is common. A provider who's doing the work doesn't need to lock you in.
Want us to handle it?
Our Care plan covers hosting, backups, updates, security and uptime monitoring for $125 a month per site, with small edits on request. Growth adds SEO, content and Google Business Profile work for $300. See website care and SEO plans or get in touch.
