The WordPress Maintenance Treadmill: Why You Can Never Quite Stop

You update your plugins. Three days later, four more need updating. You run a security scan. Next week, a new vulnerability is disclosed in a plugin you updated last week. You add a firewall. The firewall plugin itself releases a security patch. The treadmill never stops. The question is not how to run it better. It is whether you should be on it at all.

Why does the work never end?

Because the threat landscape is continuous. Security researchers find new vulnerabilities. Attackers build tools to exploit them. Plugin authors release patches. You update. A new one surfaces.

In 2025, researchers found 11,334 new WordPress vulnerabilities. That is a 42 percent increase from the year before. Ninety-one percent came from plugins. At that rate, there is a new publicly disclosed WordPress vulnerability roughly every 45 minutes.

You cannot get to the end of a list that is being added to faster than you can clear it.

What does each lap of the treadmill look like?

The cycle is roughly this: you open your dashboard and see the update notifications. You update the plugins. You check whether the site still works. You close the tab.

Next week, there are more. Some are routine feature updates. Some are security patches. Some are both. You cannot tell which are urgent just from the notification. You update again.

Once or twice a year, an update breaks something. Your homepage goes blank. Your contact form stops working. Now instead of 20 minutes, you spend two hours diagnosing the conflict, rolling back, and finding a workaround.

Meanwhile, the plugins you did not get around to updating last cycle are accumulating risk. Roughly 13,000 WordPress sites are hacked every day. Most of them are running outdated software.

Can you step off by hiring someone?

You can hand the treadmill to someone else. A maintenance service or a developer on retainer will run the updates, check the backups, and monitor the security logs for you. That service typically costs $50 to $200 per month.

This is a reasonable choice. It removes the task from your plate. But it does not remove the underlying risk: the plugin stack still has vulnerabilities, they just get patched by someone else. And if something goes wrong, you are still the one with a hacked site, even if it is someone else’s fault.

You are also paying $600 to $2,400 per year for someone to run the treadmill you are renting.

What does stepping off actually look like?

Stepping off means moving to a platform where the treadmill does not exist. No plugins means no plugin vulnerabilities. No exposed login page means no brute-force attacks to monitor. No WordPress database means no risk of database injection. The maintenance burden is not something you reduce. It is something you eliminate by changing the architecture.

For a typical small business site, the content, design, and domain all come with you. The treadmill does not.

You can see the full time cost of the treadmill in how much time does WordPress actually take every week. For a look at what update fatigue feels like up close, read WordPress plugin update fatigue.

Basalt moves small business websites off WordPress to a platform with nothing to hack and nothing to update. The move is free.

Find out what is wrong in 60 seconds

Or skip all this. Enter your web address and we will tell you exactly what is wrong with your site. Free, 60 seconds, no account needed.