"Website maintenance" is one of the vaguest line items a small business pays for. Two Cincinnati companies can be paying wildly different amounts for plans with the same name, and neither owner can tell you what is actually being done each month. That vagueness is not an accident — it is easier to sell a round number than an itemized list.
So here is the itemized list, what drives the price up or down, and the test for whether the plan you have is doing anything.
What you are actually buying
A real WordPress care plan is five jobs:
- Updates, tested first. WordPress core, the theme, and every plugin, applied on a schedule — but run against a staging copy before the live site, so a bad plugin release breaks a sandbox instead of your homepage.
- Backups that have been restored. Off-server, on a schedule matching how often your site changes, and periodically restored to prove they work. An untested backup is a hope.
- Security. Login hardening, malware scanning, and a periodic review of who has admin access. Former contractors with live accounts are a far more common problem than sophisticated attacks.
- Monitoring. An alert when the site goes down or slows materially, so the first person to know is not a customer.
- Small changes. Hours, photos, a new staff member, a service description. The edits too small to be a project.
If a plan does not include staging, tested restores, and access review, it is probably a plugin auto-updater with a monthly invoice attached.
What moves the price
Three things, mostly:
- Plugin count and complexity. A brochure site with eight plugins is straightforward. A site with thirty, several of them premium with their own licence keys, is a different job — more to update, more to break, more to test.
- Whether there is a store. WooCommerce changes the risk profile completely. A broken contact form costs you a lead; a broken checkout costs you revenue for every hour it is down, so it needs faster response and more careful update testing.
- The state it is in when someone takes it over. Inheriting a well-maintained site is cheaper than inheriting one that has not been updated in three years, because the second one needs work done before a routine can even start.
That last point is why we audit before quoting a monthly figure. Quoting a care plan without looking inside means either overcharging the tidy sites or absorbing a mess on the untidy ones, and neither is a good way to start.
The cheap-plan trap
There is a tier of maintenance plan priced low enough that it cannot include human attention, and it usually does not. What you get is automated plugin updates and a monthly PDF listing them. When an update breaks something, nobody notices, because nobody looked — you find out when a customer mentions the contact form has not worked for a fortnight.
That is worse than no plan, because it buys the feeling of coverage. If you are on one of these, the test is simple: when did someone last tell you about a problem before you noticed it? If the answer is never, you are paying for a cron job.
The real comparison: maintenance versus the emergency
The way to judge the cost is against what one bad incident actually costs — not against zero.
A hacked WordPress site typically means an emergency cleanup at emergency rates, some days of downtime, and a spell where Google shows a warning next to your name in the results. For a business whose phone rings because of that website, the lost calls usually dwarf the cleanup invoice. Add the cases where the only backup turned out to be six months old, or nonexistent, and the site has to be partly rebuilt from whatever is in Google's cache.
Set against that, a year of maintenance is generally the cheaper side of the arithmetic — and the point of the arithmetic is that it is arithmetic. Anyone selling you a care plan on fear rather than numbers is doing it wrong.
When you should not buy a plan
Two cases, and we would rather say them out loud.
If you genuinely do it yourself. Some owners keep a tidy site, update monthly, and know where the backups are. If that is you, keep going. The honest test is whether you can say, right now, when your plugins were last updated. If yes, you do not need us.
If the site is at the end of its life. Paying a monthly fee to maintain a site that is slow, hard to edit, and already scheduled to be replaced is spending money on both ends. Sometimes the right move is a holding pattern — backups and security only — until the replacement is ready. We would rather set that up than sell a full plan on a site with a year left in it. Our redesign decision guide covers how to tell which situation you are in.
Questions worth asking any provider
- Do you test updates on staging before applying them to the live site?
- Where are backups stored, how long are they kept, and when did you last restore one?
- Who has admin access to my site right now, and when was that last reviewed?
- What is your response time if the site goes down on a weekend?
- If I leave, do I keep the domain, hosting, and logins?
That last one matters more than it sounds. Agencies that hold their clients' domains and admin credentials are relying on the hassle of leaving rather than the quality of the work. Everything should be in accounts that are yours from day one.
If you want a straight answer on what your specific site needs, that is what our WordPress maintenance audit is for — including the version where we tell you the site is in good shape and you do not need much. And if the site is slow as well as neglected, the five usual causes are worth ruling out first.