What Does Website Maintenance Actually Include?

Website maintenance means keeping the software on your site up to date, backed up, and monitored for problems. For WordPress sites, that involves several separate tools and often a developer’s time. Most invoices use the word “maintenance” without explaining what is actually included.

What does a maintenance plan actually cover?

Maintenance typically covers four areas.

Software updates. WordPress core, your theme, and every plugin all release updates regularly. These updates fix bugs and close security holes. Someone has to apply them. On a managed plan, that is the agency or host. On an unmanaged plan, that is you.

Backups. A daily or weekly backup means you can restore your site if something goes wrong. Without a backup, a bad update or a hack can destroy your content. Backup tools cost $5 to $15 per month.

Security scanning. Security plugins scan your files for malware and block suspicious traffic. They cost $10 to $25 per month on most plans.

Uptime monitoring. This checks whether your site is online every few minutes. If it goes down, you get an alert. Uptime monitoring tools cost about $7 per month.

Together, the tools alone cost $25 to $60 per month before you add a developer.

What does the developer part cost?

Applying updates by hand takes time. Reviewing security alerts takes judgment. Testing after an update to make sure nothing broke requires someone who knows what they are looking at.

WordPress developers charge $75 to $150 per hour for this kind of work. A maintenance plan from an agency often bundles 1 to 2 hours per month into a flat fee. That is where the $100 to $300 per month number comes from.

The problem is that “my site is on a maintenance plan” does not mean the site is safe. It means someone is applying updates and keeping the lights on. It does not mean the site has no vulnerabilities. It does not mean you will never get hacked.

What is NOT included in most maintenance plans?

Read the contract. Most maintenance plans do not cover:

• Hack cleanup if your site gets compromised
• Redesigning broken layouts caused by plugin conflicts
• Adding new features or pages
• Moving the site to a new host if your current host raises prices

Those are all billed separately, usually at the developer’s hourly rate.

A hack cleanup costs between $500 and $14,500. That is not covered by a $100 per month maintenance plan.

What happens when you stop paying?

The tools stop updating. The plugins stop receiving patches. The security scanner stops scanning. If the developer was applying updates manually, they stop.

Your site keeps running. But every month you go without updates, it becomes more vulnerable. Most attacks on WordPress sites happen through outdated plugins, not through sophisticated techniques.

Stopping maintenance is like stopping your car’s oil changes. The car still runs. Until it does not.

What you can do today

1. Ask your developer or agency exactly what is included in your maintenance plan. Get it in writing.
2. Check whether your backup tool is actually creating backups. Log in and verify.
3. Find out whether hack cleanup is covered. If not, ask what the rate would be.
4. Look at which plugins on your site have not been updated in more than 90 days. Those are risks.
5. Add up what you are paying for maintenance tools separately from developer time.

Why this keeps adding up

Maintenance for WordPress is not a single product you buy. It is a stack of services that each charge separately. Each one solves a real problem. But together they add up to an ongoing cost that a small business with a simple website should not have to manage.

If you want to see the full breakdown of what people pay for WordPress, see /insights/wordpress-maintenance-cost. And if you are wondering whether you really need all those plugins, /insights/do-i-need-all-these-wordpress-plugins walks through that question.

Basalt moves small business websites off WordPress to a platform with nothing to hack and nothing to update. The move is free.

Find out what is wrong in 60 seconds

Or skip all this. Enter your web address and we will tell you exactly what is wrong with your site. Free, 60 seconds, no account needed.