What a WordPress maintenance plan should include (and what it costs in the UK)

A proper WordPress maintenance plan covers six things: tested updates (core, plugins, theme and PHP), off-site backups you have actually restored, security hardening and monitoring, uptime and speed checks, a human testing your forms and checkout, and a fixed amount of developer time for small changes, with a short report each month. In the UK that typically costs £30 to £60 a month for a small brochure site, £60 to £120 for a busy business site and £120 to £300 or more for a WooCommerce shop. If you would rather not pay a retainer, you can buy developer hours instead; our WordPress rate is £50 an hour + VAT and the hours never expire.

Below is what each part involves, how much time it really takes, what it should cost, and how to tell a good plan from a monthly invoice for clicking “Update all”.

Why a WordPress site needs looking after at all

WordPress core is well maintained. Minor security releases even install themselves by default. The trouble is everything bolted on around it. Patchstack, which tracks WordPress vulnerabilities, has reported year after year that the overwhelming majority of new vulnerabilities (well over 90 %) sit in plugins and themes rather than in core. A typical small business site we inherit has somewhere between 20 and 40 plugins, a few of them abandoned by their authors years ago.

Sites rarely fall over in one go. What usually happens is slower and more annoying: the contact form stops sending because an email setting changed at the host, a slider plugin conflicts with a WooCommerce update, the hosting company retires an old PHP version and half the site throws errors, or a known hole in a forgotten plugin gets found by an automated bot. Each of those is a one-hour fix if someone spots it in week one, and a two-day emergency if nobody notices for three months.

What a good maintenance plan includes

1. Updates that are tested, not just applied

Anyone can press the update button. The value is in what happens around it. A plan worth paying for will:

• Apply security releases quickly, ideally within 24 to 48 hours for anything rated high or critical.
• Batch routine plugin and theme updates weekly or fortnightly rather than letting them pile up for months.
• Run major updates on a staging copy first: a new major WooCommerce version, a page-builder update, a PHP upgrade.
• Check the pages that make you money after every update: home page, a service page, the contact form, basket and checkout.
• Keep a rollback route, either a fresh backup taken minutes before or version-controlled code, so a bad update can be reversed in minutes.

We are blunt about this one. If the provider cannot tell you how they test updates, they don’t.

2. Backups you can restore

• Daily backups of files and database as a minimum. A shop taking orders all day needs the database backed up more often, hourly or in real time.
• Stored off-site, with a different provider from your hosting. If the hosting account is compromised or suspended, backups held inside it go with it.
• At least 30 days of history. Malware is often found weeks after it arrived, and you need a clean copy from before that date.
• A test restore every quarter to a staging site. A backup nobody has restored is a theory.

3. Security hardening and monitoring

• A web application firewall in front of the site. We use Cloudflare for most clients; security plugins can do part of the job at server level.
• Malware scanning and file-change alerts, so an injected file is noticed the same day.
• Two-factor authentication on every admin account, and a review of who has access. Former staff and old agencies with admin logins are a common weak spot.
• Login rate limiting, XML-RPC disabled if nothing needs it, and file editing switched off in the dashboard.
• SSL certificate and domain renewal monitoring. An expired certificate or lapsed domain can take a site offline as effectively as a hack.

If a breach exposes personal data, UK GDPR may require you to report it to the ICO within 72 hours of becoming aware of it. A provider who already has logs, backups and a clean-up procedure makes those 72 hours far less painful.

4. Uptime and performance monitoring

You should not hear that your site is down from a customer. Uptime checks every one to five minutes, with alerts going to a person, are cheap and should be standard. Once a month someone should also look at load times and Core Web Vitals, because sites slow down gradually as plugins, tracking scripts and large images accumulate. Our guide to Core Web Vitals explains which numbers matter.

5. PHP and hosting housekeeping

WordPress runs on PHP, and each PHP version gets roughly two years of active support and then a period of security-only fixes. PHP 8.1 stopped receiving security fixes at the end of 2025 and 8.2 is scheduled to follow at the end of 2026, so plenty of UK small business sites are already running on, or about to run on, versions that no longer get patches. Upgrading is normally painless on a well-built site and miserable on one held together by old plugins. Either way, it should be tested on staging, not discovered when the host forces it.

The same housekeeping pass should look at disk space, database size (WooCommerce sessions and old revisions can bloat it), error logs and scheduled tasks that have quietly stopped running.

6. Human functional checks

Automated monitoring will tell you the home page returns a 200 status. It will not tell you that the enquiry form now sends to an inbox nobody reads, or that the booking calendar shows no availability on a phone. Once a month, a person should submit every form, place a test order or booking, check that the confirmation emails arrive and are not landing in spam, and look at the key pages on a mobile.

7. Developer time for small changes

Most plans include 30 minutes to a few hours a month for small jobs: a new team member, updated prices, a fresh landing page, a bug fix. Check three things: how much time is included, whether unused time rolls over (it usually doesn’t), and what you pay per hour beyond the allowance.

8. A report you can read

A one-page monthly summary: updates applied, anything that failed, backups taken, uptime percentage, security events and work done. It keeps the provider honest and gives you a paper trail if something goes wrong later.

How much time maintenance really takes

Prices make more sense once you see the hours behind them. These are our working estimates for a well-built site; a site with a heavy page builder and 40 plugins will take longer.

That is before any content changes or new features. It is also why a £15-a-month plan cannot include real testing: at any normal UK developer rate, it pays for about 20 minutes of someone’s time.

What WordPress maintenance costs in the UK

These are typical market ranges we see across the UK in 2026, excluding VAT. Agencies in central London tend to sit at the top; freelancers and offshore providers at the bottom.

Watch whether hosting is included. A £50 plan without hosting plus £25 a month of decent managed hosting is £75, which can be more than a £70 plan that includes both. Premium plugin licences (forms, SEO, backup tools, WooCommerce extensions) are usually billed on top and can easily add £150 to £400 a year on a shop.

Retainer or a bank of hours? Worked numbers

There are two sensible ways to pay for maintenance, and the right one depends on how often your site changes.

A monthly retainer

Best for online shops, booking-led businesses and any site where a broken checkout costs real money by the hour. You are paying for someone to be responsible every month whether you remember or not, and for a faster response when things go wrong.

A bank of developer hours

Best for brochure sites that change a few times a year. You buy hours once and spend them on updates, checks and small improvements as needed. With WE-DEV, WordPress Development is £50/h + VAT, the hours never expire, and volume discounts apply automatically:

Put that against the time table above. A brochure site needing about 1.25 hours a month uses roughly 15 hours a year: £675 + VAT, which works out at £56.25 a month before VAT, with any leftover hours carried into next year. A WooCommerce shop at around 4 hours a month uses about 48 hours a year; a 50-hour bank costs £2,000 + VAT, or £166.67 a month before VAT, with two hours spare. Both land inside the market ranges, but you only pay for time that is actually used. You can book hours online and pay in full or with a 50 % deposit.

Which option suits you

• A five-page site that rarely changes (a plumber in Cardiff, a consultant in Edinburgh): a 10 or 15-hour bank, with quarterly maintenance passes and urgent security updates as they land.
• A 15 to 30-page lead generation site with regular blog posts and landing pages: a 20-hour bank or a standard retainer. If you publish weekly, the retainer’s included change time starts to pay for itself.
• A WooCommerce shop turning over more than a few thousand pounds a month: a retainer with staging tests on every update and priority response. An hour of broken checkout on a Saturday will cost more than a month of maintenance.
• A membership, booking or custom-coded site: talk to the people who built it. Generic plans often refuse to touch custom code, which leaves you with nobody responsible for the part most likely to break.

What maintenance does not cover

Agree the boundaries in writing so nobody is surprised by an invoice. Even generous plans normally exclude:

• Redesigns and new sections, which are projects in their own right.
• New functionality, such as adding bookings, a shop, a members’ area or an integration with your CRM.
• Copywriting and SEO campaigns beyond small edits to existing pages.
• Repairing changes made by someone else outside the plan, such as an untested plugin installed by a staff member.
• Premium plugin licences and third-party subscriptions.

Red flags when comparing plans

• No staging environment and no explanation of how updates are tested.
• Backups stored only on the same server or hosting account as the site.
• No named person, no stated response time and no out-of-hours route for a shop.
• “Unlimited support” with no definition of what counts as support.
• The provider holds the hosting, domain or admin logins and you do not. You should always have owner-level access to your own site, hosting and domain registrar.
• A 12 or 24-month contract with exit fees, for what is essentially a monthly service.

A maintenance checklist you can use

Whether you keep it in-house or hand it to someone, this is the routine we recommend:

• Weekly: apply and check updates; confirm backups ran; review security alerts.
• Monthly: submit every form, place a test order or booking, check emails arrive; review uptime and load times; send a short report.
• Quarterly: restore a backup to staging; remove unused plugins and admin accounts; check the PHP version against its end-of-support date.
• Yearly: check domain and SSL renewals; review your privacy notice and cookie banner; plan bigger improvements and budget for them.

How we keep WordPress sites healthy

Most maintenance pain is designed in at build time. We hand-build classic WordPress themes without page builders, so a typical brochure site of ours runs on a handful of well-supported plugins rather than thirty. Fewer moving parts means fewer updates, fewer conflicts and quicker checks. Sites go behind Cloudflare, updates go through staging, and backups live away from the host.

We also take on sites we did not build. The first job is usually a short audit (two to four hours) to list the plugins, PHP version, backup situation and anything already broken, so you know what you are dealing with before committing to a plan. Our team is based in St Albans and works with businesses across the UK; for server-side and security work we draw on our cybersecurity and DevOps services.

If you are planning a new site, budget for maintenance from day one. Our guide to how much a website costs in the UK covers running costs alongside build prices, and if your current site is sluggish, start with our WordPress speed fixes.

Photo: Ali Kaan Uçar via Unsplash