A serious WordPress maintenance contract covers six areas: updates, tested backups, security, uptime monitoring, performance and support with a written response time. It costs between €39 and €250 per month depending on the size of the website. Below €30, nothing is left to actually intervene when something breaks.
Why a WordPress website needs maintenance
WordPress powers a large share of the web, which makes it a permanent target. Attacks almost never single out one company: bots sweep the web looking for outdated versions and exploit the known flaw.
The maths is simple. A website not updated for a year accumulates dozens of publicly documented vulnerabilities. Cleaning up after a hack costs €500 to €2,000, without counting the days offline and the lost Google rankings.
What the contract must contain
| Area | What must be written down | Why |
|---|---|---|
| Updates | Core, plugins, theme, at a stated frequency | It is the first line of protection |
| Backups | Frequency, separate storage location, retention period | A backup on the same server dies with it |
| Restore test | At least one real restore per year | An untested backup is worthless |
| Security | Firewall, login limiting, file scanning | Block before the intrusion |
| Monitoring | Uptime checks and alerts | Know before your customers do |
| Support | Written response time, contact channel | Without a written time, no guarantee |
The most important clause
The restore test. Most providers take backups. Few verify that the backup restores. On the day of the incident, you discover the archive is corrupt, or that it holds no database. Insist on one real restore per year, in a test environment.
Market prices
| Package | For which website | Contents | Monthly price |
|---|---|---|---|
| Essential | Showcase, low traffic | Monthly updates, weekly backup, ticket support | €39 to €69 |
| Standard | Active site, several service pages | Fortnightly updates, daily backup, monitoring, 1 h of work | €79 to €149 |
| E-commerce | Online shop | Weekly updates, continuous backup, hardened security, 2 h of work | €149 to €250 |
The included hours cover small changes: editing text, adding a page, fixing a display issue. Without them, every request is billed on top.
Contract traps
- Backup ownership. They must be handed over if you leave. Some contracts keep them.
- "Automatic" updates with no testing. A plugin updated without a check can break the layout. The contract must include a review after each batch.
- Tied hosting. If maintenance forces you to stay with the provider, you lose all negotiating room.
- Long commitments. A monthly contract with no minimum term is the norm. Twelve firm months has no technical justification.
- Hacking excluded. Read what happens after an incident: is the clean-up included, or billed extra?
What you can do yourself
If you choose not to subscribe, three habits limit the risk. Update WordPress and its plugins at least once a month. Install a backup plugin that sends to external storage. Enable two-factor authentication on administrator accounts.
This does not replace monitoring, but it covers most automated attacks.
Our approach
Our maintenance centre runs on a monthly subscription with no commitment, with tested restores and a contact reachable during business hours. Websites we build and those we host can be attached to it. Read also the ten signs a redesign is needed if your website keeps running into trouble.
Website maintenance contract: what changes beyond WordPress
A website maintenance contract is not limited to WordPress. On a Prestashop or Shopify shop, or on a custom-built site, the scope changes: modules and extensions to update, compatibility with the PHP version, database backup, online payment monitoring. Require the contract to name your site’s technology and list what is covered for it.
Website maintenance contract: the clauses to require
- The scope: which sites, which environments (production, test), which extensions.
- The service level: time to take charge of an outage, written in the contract and not promised verbally.
- Backups: frequency, retention period and restoration test.
- Security: corrective updates, monitoring, handling of a hacked site.
- Term and notice: a commitment with no reasonable exit is a warning sign.
- Ownership and access: the site, the code and the credentials remain yours.
- Reporting: a monthly account of what was done.
- Personal data: who processes what, and how, in compliance with GDPR.
Managed WordPress hosting or maintenance: what is the difference?
Maintenance keeps the site up to date and secure. Managed services go further: they also cover hosting, server monitoring and performance. For a showcase site, maintenance is often enough. For a shop or a critical site, managed services avoid having two providers passing responsibility back and forth. Our hosting and managed services page details this scope.
How to ask for a WordPress maintenance quote
To receive an exact quote, prepare this information:
- the number of sites and their technology (WordPress, WooCommerce, other);
- the current host and the access available;
- whether there is a shop or online payment;
- the changes planned over the year;
- the level of urgency you expect in case of an outage.
Our website maintenance page presents the offer; if you are an agency, see white label WordPress maintenance. For an itemised quote within 24 hours, describe your site to us.