WordPress maintenance: what you need and what it costs

Short answer: Good WordPress maintenance covers regular updates, tested backups, monitoring, security checks and response times that are agreed in writing. A contract with an agency pays off mainly for business-critical sites with many plugins, while on-demand support is enough for small sites that rarely change. What matters most is not the monthly price but what is actually promised when something goes wrong.

This guide covers WordPress maintenance only. General care for any system is described on our maintenance page. If you want to set up WordPress from scratch, see our WordPress agency page.

What WordPress maintenance includes

Maintenance is more than clicking “Update”. It keeps the site secure, fast and reachable, and gets you back online quickly after an error.

Updates for core, themes and plugins

According to the WordPress documentation, minor core updates, meaning maintenance and security releases, are installed automatically by default. Plugins and themes are not updated automatically unless you switch that on. According to WordPress Security, only the latest version is officially supported. If you do not update for a long time, you eventually stop getting security fixes.

Good maintenance therefore does not update blindly. It installs updates on a staging site first, checks the key pages and forms, and only then goes live.

Backups and restore

A backup only counts once restoring it works. The WordPress documentation explicitly says to verify database and file backups before upgrading. For every offer, ask three things: how often backups run, where the copies are stored and when a restore was last tested.

Monitoring, security and speed

Monitoring tells you when the site is down or the certificate is about to expire. Add checks for known vulnerabilities, a review of admin accounts and a look at load times. The numbers are clear: according to Patchstack, 7,966 new vulnerabilities were reported in the WordPress ecosystem in 2024, 96% of them in plugins and only seven in core. The more plugins you run, the larger the attack surface.

Technical base and legal upkeep

Maintenance also covers the PHP version. According to the WordPress requirements, PHP 8.3 or newer is currently recommended. According to php.net, security support for PHP 8.2 ends on December 31, 2026. Cookie banner, privacy policy and legal notice (Impressum) must also stay current. This is not legal advice, but a point to settle in your maintenance contract. More on services and commitments in contracts is in our guide Maintenance contracts: services and response time.

Important Updates are not an end in themselves. Without a backup, a staging site and a check afterwards, you trade a security risk for an outage risk.

Comparing WordPress maintenance providers

When you compare providers for WordPress maintenance with updates, backups and monitoring, a fixed grid helps. Price alone says little because “maintenance” means something different at every provider.

More than plugin updates

A good package goes beyond updates. It includes a security check, form checks after every update, a report in plain language and a way to request small changes. One example from the market: a German provider lists in its maintenance packages a backup before every intervention, monitoring of uptime, certificate and load time, a before and after comparison of agreed pages and a monthly report. Content changes, hosting and cleaning up a hacked site are explicitly not included there. These are exactly the exclusions to look for in any offer.

Checklist: what belongs in a WordPress maintenance offer

• Update cadence for core, themes and plugins is stated in the offer
• Updates run on a staging site first
• Backup before every intervention and automatically at regular intervals
• Restores are tested and documented
• Monitoring for uptime and certificate is included
• Checks for known vulnerabilities
• Response and resolution times are given in hours or business days
• What is not included is named (hosting, licenses, content, hack cleanup)
• Monthly report in plain language
• Notice period and handover of access are defined

Maintenance with fixed response times

If you are looking for a WordPress maintenance partner with fixed response times, separate the terms first. Response time is the time to the first reply. Resolution time is the time until the problem is fixed. Then comes availability: weekdays, hours and the emergency channel.

What a service level should include

• Response time by urgency, for example site down or minor display error
• Resolution or recovery target for outages
• Availability with times and channels
• Cover during holidays or sickness
• Escalation path if a deadline is missed

Is a care support reliable?

You can check that against facts, not promises. Ask for written times, a named contact, sample reports and how often restores are tested. With us, what counts is what is written in the contract. The response times and scope for your WordPress site are defined in the initial call and put in writing. We do not guarantee specific results, but we give clear commitments on services and deadlines.

Monthly package or support on demand?

Whether a monthly maintenance package beats on-demand support depends on risk and how often things change. Both models exist at agencies, with individual specialists and with dedicated providers. The comparison is neutral: each model fits certain situations.

When on demand is enough and when you need a contract

On demand often works for a small brochure site without forms, shop or inquiries. A contract pays off when the site brings inquiries or revenue, uses many plugins or when outages are expensive. A real estate agent's website, where every inquiry counts, is a typical case. There, a maintenance contract with fixed response times usually makes more sense than loose on-demand support. If you want an alternative to maintenance by individuals, agencies with WordPress experience offer cover and documentation as an advantage.

If you are weighing whether to handle upkeep yourself or hand it over, our calculator for in-house or agency maintenance helps. A neutral view on agency versus individual specialist is in the article Agency, freelancer or website builder.

Tip With individuals, ask about cover and about handover of documentation. With agencies, ask for a named contact, not just the ticket system.

WordPress on your own IT servers

Some companies require the website to run on their own servers. That is possible with WordPress but comes with duties. The software then runs in your environment, so maintenance and IT must be closely aligned.

Requirements for a clean setup

• Deployment: Changes go through a staging site and a traceable path to the live server.
• Hardening: Current PHP version, locked file permissions, access only for necessary accounts.
• Updates: Who installs them, who checks them, who approves?
• Access: Who may use SSH, SFTP and admin login?
• Backups: Does the backup run on IT infrastructure or through the service provider?

Working with IT

Before the start, it is best to draw up a responsibility list: who runs the server, who runs the system, who owns the content? Technical minimum values are in the WordPress requirements. Whether we work in your environment or take over hosting, we clarify in the initial call together with your IT. For the split of responsibilities, our guide on hosting, maintenance and GDPR is meant to help: Hosting, maintenance and GDPR: who is responsible for what?.

Fewer plugins, less risk

If every update is a risk and small changes take forever, the cause is often the number of plugins. Every plugin is third-party code with its own update cycle. As described above, according to Patchstack most vulnerabilities sit in plugins. A lean setup with few, well-maintained plugins and a simple theme lowers that risk.

The plugin audit

An audit goes through each plugin and asks four questions: Do we still need it? Is it maintained? Can another plugin or WordPress itself take over? Is custom code worth it? Each plugin then gets a decision.

Effort and benefit

An audit costs time once and saves effort with every update afterwards. It is also an intervention. That is why it belongs on a staging site, with a backup and a check of the pages afterwards. What you gain depends on your site. We do not promise a fixed result.

Switching: when WordPress no longer fits

Sometimes the problem is not maintenance but the system. If you constantly replace plugins, maintain many special solutions or your team cannot change content on its own, it is worth looking at alternatives. With Webflow, hosting and platform upkeep are part of the plan, and a plugin update cycle in the WordPress sense does not exist. Webflow has other limits instead, for example for very custom functions. We compare the running costs of both systems in the guide Webflow or WordPress: running costs.

Webflow is our focus, but we also work with WordPress, TYPO3 and headless setups. Which system fits, we decide with you based on your needs. If a switch is on the table, you will find the process on our WordPress to Webflow page.

What WordPress maintenance costs

Costs depend on scope, number of plugins, site type and response time. A market range shows how far offers differ. Note that all figures come from providers and are examples, not benchmarks for your project.

The figures come from the packages of kopfundstift and the cost overview of WPBeginner. WPBeginner also lists premium plugin license renewals and emergency repairs as items that may come on top.

Price factors

• Number and type of plugins, especially for shops and booking systems
• Update cadence and depth of testing
• Response time and availability
• Monitoring, reports and security checks
• Included changes and development hours
• Hosting and licenses, whether included or not

Our Care support starts at EUR 500 per month net. What your WordPress site actually needs depends on setup and requirements and is defined in the initial call. See our maintenance page for the service overview.

How we handle this at Webwavers

Webwavers is a web agency with locations in Günzburg and Munich, working across Germany and one of 7 Webflow Premium Partners in Germany. Webflow is our focus, alongside WordPress, TYPO3 and headless. Founded in 2021, we have delivered over 140 projects. More on our WordPress agency and WordPress design agency pages.

For WordPress care we first review setup, plugins and access. Then we propose a package with clearly named services. We define the details on updates, response times and hosting with you in the initial call. For a security case from practice, read our article on the php2shell PHP vulnerability.

Frequently asked questions

Is a monthly maintenance package worth it compared with support on demand?

For sites that bring inquiries or revenue, usually yes, because times, cover and documentation are agreed. For small sites with few changes, on demand is often enough. Risk and frequency of change decide.

Which providers offer WordPress maintenance with updates, backups and monitoring?

Such packages exist at agencies, specialized service providers and individual specialists. Compare them with the grid above: update cadence, staging, backup with restore test, monitoring, response time and termination. At Webwavers we clarify the scope in the initial call.

Who offers WordPress maintenance with fixed response times?

The offer should state response time, resolution target and availability in writing. If the number is missing from the contract, it is not promised. We define these times for WordPress sites in the initial call and put them in writing.

Is Webwavers' Care support reliable for WordPress?

Reliability shows in written commitments, a fixed contact and traceable reports. We set exactly these points in the contract. Feel free to ask anything you need for your decision in the initial call.

Which agency runs WordPress on your own servers with few plugins?

Look for experience with deployment, hardening and cooperation with IT. We also implement WordPress. Whether that works on your servers, we clarify with your IT in the initial call.

How do I get to a WordPress system with fewer plugins?

With a plugin audit: review each plugin and decide whether to keep, replace or remove it. That runs on a staging site first, with a backup and a check afterwards.

Is a maintenance contract better than on-demand support for a real estate website?

Usually yes, because inquiries mean revenue for agents. An outage then quickly costs more than the contract. Fixed response times and monitoring that alerts you matter most.

What does WordPress maintenance cost per month?

The market range runs from around EUR 30 net for simple packages into four figures for extended services, see the table above. Our Care support starts at EUR 500 per month net. We define the right scope in the initial call.

Conclusion

Good WordPress maintenance means tested updates, verified backups, monitoring and response times in writing. Fewer plugins lower the risk, and a contract with commitments pays off for sites that bring inquiries. Does every update worry you on your WordPress site? In the initial call we review setup and plugins and propose maintenance with firm commitments. Request a project

Note This guide does not replace legal advice. Prices and sources are examples as of November 2026.

Sources

• Patchstack: State of WordPress Security in 2025
• WordPress.org: Requirements
• WordPress.org: Security
• WordPress Developer Resources: Upgrading WordPress
• php.net: Supported Versions
• kopfundstift: WordPress maintenance
• WPBeginner: WordPress maintenance costs