A serious WordPress maintenance contract covers six areas: updates, tested backups, security, uptime monitoring, performance and support with a written response time. It costs between €39 and €250 per month depending on the size of the website. Below €30, nothing is left to actually intervene when something breaks.
Why a WordPress website needs maintenance
WordPress powers a large share of the web, which makes it a permanent target. Attacks almost never single out one company: bots sweep the web looking for outdated versions and exploit the known flaw.
The maths is simple. A website not updated for a year accumulates dozens of publicly documented vulnerabilities. Cleaning up after a hack costs €500 to €2,000, without counting the days offline and the lost Google rankings.
What the contract must contain
| Area | What must be written down | Why |
|---|---|---|
| Updates | Core, plugins, theme, at a stated frequency | It is the first line of protection |
| Backups | Frequency, separate storage location, retention period | A backup on the same server dies with it |
| Restore test | At least one real restore per year | An untested backup is worthless |
| Security | Firewall, login limiting, file scanning | Block before the intrusion |
| Monitoring | Uptime checks and alerts | Know before your customers do |
| Support | Written response time, contact channel | Without a written time, no guarantee |
The most important clause
The restore test. Most providers take backups. Few verify that the backup restores. On the day of the incident, you discover the archive is corrupt, or that it holds no database. Insist on one real restore per year, in a test environment.
Market prices
| Package | For which website | Contents | Monthly price |
|---|---|---|---|
| Essential | Showcase, low traffic | Monthly updates, weekly backup, ticket support | €39 to €69 |
| Standard | Active site, several service pages | Fortnightly updates, daily backup, monitoring, 1 h of work | €79 to €149 |
| E-commerce | Online shop | Weekly updates, continuous backup, hardened security, 2 h of work | €149 to €250 |
The included hours cover small changes: editing text, adding a page, fixing a display issue. Without them, every request is billed on top.
Contract traps
- Backup ownership. They must be handed over if you leave. Some contracts keep them.
- "Automatic" updates with no testing. A plugin updated without a check can break the layout. The contract must include a review after each batch.
- Tied hosting. If maintenance forces you to stay with the provider, you lose all negotiating room.
- Long commitments. A monthly contract with no minimum term is the norm. Twelve firm months has no technical justification.
- Hacking excluded. Read what happens after an incident: is the clean-up included, or billed extra?
What you can do yourself
If you choose not to subscribe, three habits limit the risk. Update WordPress and its plugins at least once a month. Install a backup plugin that sends to external storage. Enable two-factor authentication on administrator accounts.
This does not replace monitoring, but it covers most automated attacks.
Our approach
Our maintenance centre runs on a monthly subscription with no commitment, with tested restores and a contact reachable during business hours. Websites we build and those we host can be attached to it. Read also the ten signs a redesign is needed if your website keeps running into trouble.