This guide is for owners of WordPress sites in the US, UK, Europe and Australia who are deciding whether to keep doing maintenance themselves, rely on their host, or pay a freelancer or agency. I maintain WordPress, WooCommerce and LearnDash sites for a living, so I have a commercial interest in this question. I have tried to keep the numbers sourced and the trade-offs fair, including the cases where DIY is the right call.
Last verified: October 2026.
The short answer
A maintenance-only plan from a freelancer or small provider commonly starts somewhere between $40 and $100 a month (or roughly £30 to £50, €45 to €65, A$50 to A$250), and stores or course sites usually sit in a higher tier. Doing it yourself costs less in cash but more in time: DreamHost’s guide estimates 2 to 8 hours a month plus up to about $105 a month in tools for a self-managed site. Whether DIY is cheaper depends on two numbers you control: what an hour of your time is worth, and how much a broken or hacked site would cost you.
What WordPress maintenance actually covers
“Maintenance” gets used for anything from clicking “Update all” to a full support retainer. When I compare plans, this is the list I measure them against.
- Core, plugin and theme updates with staging and rollback. Updates are tested on a staging copy first, then applied to the live site with a way to revert within minutes if something breaks. WordPress has supported plugin and theme auto-updates since version 5.5, but they are opt-in, run through WP-Cron, and do not test anything for you.
- Backups and restore tests. Daily (or more frequent) off-site backups, kept for a defined period, and a restore that is actually tested. A backup you have never restored is a hope, not a plan.
- Uptime and security monitoring. Checks every minute or few minutes, alerts to a person, and vulnerability alerts for the specific plugins you run.
- Malware cleanup. Whether a hacked-site cleanup is included, capped, or billed hourly. This is the line item that changes the value of a plan the most.
- Performance. Core Web Vitals checks, cache and database clean-up, and spotting a plugin update that made the site slower.
- WooCommerce order-flow checks. After updates: add to cart, checkout, payment gateway, order emails, stock and tax. A store can look fine on the homepage while checkout fails silently.
- LearnDash or LMS checks. Enrolment, lesson and quiz progression, certificates, and membership or payment integrations. These break in ways that only students notice.
- SEO and Search Console health. Watching for indexing errors, accidental
noindex, broken redirects or sitemap problems after updates. - PHP and database version upgrades. WordPress currently recommends PHP 8.3 or greater and MySQL 8.0 or MariaDB 10.11 or greater. Moving an older site up a PHP version is often where old plugins and custom code fail, so it needs testing like any other update.
Things that are usually not maintenance: new features, redesigns, content updates, SEO campaigns and custom development. Good plans say how many development hours are included and what happens beyond them.
Why this work is not optional
Plugins are where most of the risk sits. Patchstack’s State of WordPress Security in 2026 reports 11,334 new vulnerabilities in the WordPress ecosystem in 2025, with 91% in plugins, 9% in themes and only six in core. It also reports that 46% had no developer fix at the time of public disclosure, and a weighted median of five hours to first exploitation for the vulnerabilities it tracked. That is why “I update once a month” is a weaker routine than it sounds, and why monitoring which plugins are affected matters as much as the update itself.
There is also a legal reason to take backups and security seriously if your site holds customer or student data. This is context, not legal advice:
- EU: GDPR Article 33 requires a controller to notify the supervisory authority of a qualifying personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it.
- UK: The ICO explains that reportable breaches must be reported within 72 hours of discovering them, and you can submit an initial report and follow up later.
- Australia: Under the Notifiable Data Breaches scheme, covered entities (including most businesses with annual turnover over A$3 million) must take reasonable steps to assess a suspected breach within 30 days.
- US: All 50 states have breach notification laws, with different definitions and deadlines.
Good maintenance does not make you compliant. It does mean that when something happens, you have logs, clean backups and someone who can tell you what was affected quickly enough to meet those clocks.
WordPress maintenance plans and packages: cost by region
I could not find an independent survey of WordPress maintenance prices for any of these markets. What exists is published pricing from providers and cost guides written by people who sell maintenance (as I do). The table below summarises those sources so you can see the shape of each market. Treat it as “what plans in this market commonly look like”, not as an average.
| Market | Entry plans | Mid tier (stores, LMS, lead-gen) | Higher tiers | Source and caveats |
|---|---|---|---|---|
| US (USD) | about $50 to $100/mo | about $100 to $300/mo | about $300 to $1,000+/mo | DreamHost guide, updated Aug 2026. Codeable lists maintenance-only plans at $39 to $359/mo and hosting-bundled agency plans at $435 to $2,190+/mo (Mar 2026). |
| UK (GBP) | from about £30 to £50/mo | not separately listed | from £150/mo and up | Website Helper price comparison of UK providers. The page was last modified April 2024 and is published by one of the providers listed. |
| EU (EUR, Netherlands sample) | €12.50 to €30/mo (budget) | €44 to €75/mo (maintained by a person) | €96 to €399/mo | Jorijn’s comparison, prices checked Oct 2026, excluding VAT. Author sells maintenance; Dutch market only. |
| Australia (AUD) | A$50 to A$250/mo | A$250 to A$900/mo | A$900 to A$2,500+/mo | WP Creative cost guide, Aug 2026, excluding GST. Publisher’s own ranges, no independent data cited. |
Three patterns hold across all four markets:
- The cheapest plans are mostly automated updates and backups. Cleanup, testing and developer time are where the price climbs.
- WooCommerce and membership or course sites cost more everywhere, because a failed update costs more and takes longer to check.
- Ad-hoc work outside a plan is billed hourly. Codeable cites $75 to $200+ an hour for emergency work in the US; the Dutch comparison lists €55 to €105 an hour excluding VAT.
WordPress support and maintenance pricing: where mine sits
My WordPress maintenance service has a Care plan from $49 a month for brochure sites and blogs. It covers daily off-site backups, weekly core, plugin and theme updates with rollback, 24/7 uptime monitoring, malware scanning and a monthly report. Higher tiers for WooCommerce, LearnDash and other revenue-critical sites add staging-first updates, monthly restore tests and included development hours. The service page is the source of truth for current tiers and inclusions, and plans are month to month.
The real cost of DIY: a worked calculation
DIY maintenance has three costs: your routine time, your tools, and the expected cost of incidents. The formula I use:
Monthly DIY cost = (routine hours x your hourly value) + tools + (expected incident cost per year / 12)
The expected incident cost is the chance of a serious incident in a year multiplied by what it would cost (your hours to fix it, any paid cleanup, and lost sales or sign-ups while the site is down).
Assumptions used in every example
These are illustrative assumptions, not measurements. Replace them with your own.
- A small WooCommerce store or course site with around 20 to 30 plugins.
- 4 hours a month of routine work done properly: staging updates, checking checkout, reviewing backups and Search Console. This sits inside DreamHost’s 2 to 8 hour estimate.
- A one-in-three chance per year of a serious incident (a broken checkout after an update, a hack, a failed PHP upgrade).
- That incident takes 12 hours of your time plus a cash cost for cleanup and lost revenue.
- Hourly value is what your time is worth to your business, not what you pay yourself.
| Item | US (USD) | UK (GBP) | EU (EUR) | Australia (AUD) |
|---|---|---|---|---|
| Your hourly value (assumed) | $75 | £50 | €60 | A$90 |
| Routine time: 4 h/mo | $300 | £200 | €240 | A$360 |
| Tools: backup, security, uptime (assumed) | $30 | £25 | €25 | A$40 |
| Incident cash cost (assumed) | $1,500 | £1,200 | €1,200 | A$2,000 |
| Incident total: 12 h + cash | $2,400 | £1,800 | €1,920 | A$3,080 |
| Expected incident cost per month (1 in 3 chance, /12) | $67 | £50 | €53 | A$86 |
| Estimated DIY cost per month | $397 | £275 | €318 | A$486 |
On these assumptions, a mid-tier plan in every market costs less than doing the work properly yourself. The comparison changes quickly when the inputs change:
- A personal blog: 1 hour a month, free tools, nothing lost if it is down for a day. DIY costs one hour of your time and is usually the right answer.
- DIY done the usual way: “Update all” on the live site in 15 minutes. The routine cost drops close to zero, but the chance of an incident rises, and so does the cost of the incident, because there is no staging copy or tested backup to go back to.
- A busy store or LMS: If one bad day of downtime costs more than a year of a plan, the incident line dominates and the routine time hardly matters.
Run your own numbers
- Write down how many hours you spent on the site in the last three months, including fixes. Divide by three.
- Pick an hourly value. Use what you could bill a client, or what you would pay someone to cover your work.
- Add your monthly spend on backup, security and monitoring tools.
- Estimate what a full day of downtime costs: average daily revenue or leads, plus any refunds or support time.
- Choose a realistic yearly incident probability. If you have had one in the last two years, one in three is not pessimistic.
- Compare the total with two or three quotes for the tier your site needs.
Decision framework: DIY, host-managed, freelancer or agency
| Option | Works best for | What you still own | Typical trade-off |
|---|---|---|---|
| DIY | Blogs, portfolios, brochure sites with low revenue at risk; owners with technical confidence | Everything: testing, backups, incident response | Lowest cash cost; highest time and incident risk |
| Host-managed updates | Sites on managed WordPress hosting that offers automated plugin updates | Functional testing, WooCommerce and LMS flows, cleanup, custom code | Good automation, but checks are usually visual or generic |
| Freelancer | Small to mid-size stores, course sites and business sites that want one accountable person | Strategy and content | Personal attention and fair rates; check cover for holidays and out-of-hours issues |
| Agency | High-traffic or high-revenue sites needing SLAs, teams and 24/7 cover | Budget and vendor management | Highest price; strongest cover when the contract is specific |
Some hosts do more than you might expect. WP Engine’s Smart Plugin Manager, for example, takes a backup, updates on a schedule, compares before-and-after screenshots and rolls back automatically if pages look different. That is useful, but a screenshot comparison will not notice a payment gateway that throws an error at the final checkout step, or a quiz that no longer records a pass. For those sites, host automation is a layer, not a replacement.
My rule of thumb: if the site makes money or holds personal data, someone needs to be responsible for testing the parts that make money after every update. That someone can be you, but it should be a decision, not an accident.
Red flags in WordPress maintenance plans
- “Unlimited updates” with no mention of testing. Any plugin can be updated automatically. The work is checking that the site still works.
- Backups on the same server as the site. If the server is compromised or deleted, so are the backups.
- No restore test, ever. Ask when they last restored a client site from backup and how long it took.
- Malware cleanup “available” rather than included. Find out the price before you need it.
- No written response time. “Fast support” is not a number.
- Long minimum contracts or setup fees with no clear onboarding work behind them.
- No access handover. You should keep admin access, hosting access and your own backups if you leave.
- Vague reports. A list of updated plugins is not a report. You want what changed, what was tested, what failed and what was done about it.
What to ask before you sign
- How are updates tested, on which environment, and what exactly is checked on my site after each one?
- Where are backups stored, how long are they kept, and how often do you test a restore?
- What happens if my site is hacked: is cleanup included, and how fast do you start?
- What is your response time for “site down” and for normal requests, and does it cover my time zone?
- How many development hours are included, and what is your hourly rate beyond them?
- Will you check WooCommerce checkout, payment and emails, or LearnDash enrolment and progress, after updates?
- How do you handle PHP version upgrades and plugins that are abandoned or no longer patched?
- What do I get if I cancel: notice period, final backup, and confirmation that your access is removed?
Frequently asked questions
How much does WordPress maintenance cost per month?
For a maintenance-only plan, published prices commonly start around $40 to $100 a month in the US, about £30 to £50 in the UK, about €45 to €65 for person-run plans in the Netherlands, and from A$50 in Australia. Stores and course sites typically fall into higher tiers. These figures come from provider pricing and vendor-written guides, so get quotes for your own site before budgeting.
Is DIY WordPress maintenance cheaper?
In cash, yes. Once you count your time at a realistic hourly value and add the expected cost of a serious incident, a properly run DIY routine on a store or course site often costs more than a mid-tier plan. For a low-traffic blog with nothing at stake, DIY is usually cheaper and perfectly reasonable.
Do I still need maintenance if I use managed WordPress hosting?
Usually yes, but you may need less of it. Managed hosts handle servers, caching and often backups, and some automate plugin updates. They rarely test your checkout, course progress or custom code, and cleanup terms vary, so check what your host covers before paying twice.
How many hours a month does WordPress maintenance take?
DreamHost estimates 2 to 8 hours a month for a self-managed site. A small brochure site with few plugins sits at the low end. A WooCommerce or LearnDash site with staging tests and post-update checks sits at the upper end, before any incidents.
Should I turn on WordPress auto-updates instead?
Auto-updates are fine for low-risk plugins and minor core releases, especially on simple sites. They run on WP-Cron, do not test anything, and can apply a breaking update at a bad time. On a store or LMS, I prefer scheduled updates through staging with a tested rollback.
What does WooCommerce maintenance cost compared with a normal site?
More, because the checks take longer and failures are expensive. Codeable cites WooCommerce retainers in the $500 to $3,000 a month range, and the Australian guide above lists A$500 to A$2,500+ for WooCommerce sites. Smaller stores can often be covered by a mid-tier plan if it includes order-flow testing.
Is malware removal included in maintenance plans?
It depends on the provider. Some include cleanup, some cap it, and some bill it as a separate job. Ask for this in writing before signing, because it is often the most expensive thing that happens to a site in a year.
How often should WordPress be updated?
Weekly is a reasonable baseline for most sites, with security patches for actively exploited vulnerabilities applied as soon as they are tested. Patchstack’s data shows exploitation can start within hours of disclosure, so a monthly cycle leaves long gaps.
If you want someone else to own the updates, backups, monitoring and WooCommerce or LearnDash checks, look at my WordPress maintenance service. Plans start at $49 a month, and run month to month. If you are not sure which tier fits, send me the site and I will tell you whether DIY or your host already covers what you need.
