Website Maintenance Cost in 2026: The Four Bills Behind One Number

A maintenance quote almost never explains itself. One number arrives, usually somewhere between $30 and $400 a month, attached to a phrase like ongoing care or peace of mind, and nothing in it tells you whether you are buying a server, a scanner, a person, or a subscription somebody is reselling you at a markup.

We sell one of these, so read it as an interested party showing its arithmetic. Every price below was read off the seller's own pricing page on 8 August 2026. The vulnerability figures come from Patchstack's published 2026 security report. The platform and PHP numbers come from the WordPress.org statistics API, which counts live installs rather than surveying opinions. Where the honest answer is that you should spend nothing, the article says so.

The 30-second answer

Website maintenance costs roughly $30 to $400 a month at published 2026 rates, and the range is that wide because one phrase covers four separate purchases. Managed WordPress hosting is $25 a month at Flywheel and $30 at WP Engine on annual billing, and already includes platform updates and daily backups. The monitoring software on top is close to free, $1 to $2 per site per month at ManageWP. A care plan with people behind it is $39 a month per site at GoWP or $99 at WP Maintainer, which then bills hands-on work at $99 an hour. Design and conversion work is not maintenance at all. As for why any treadmill exists, 11,334 new vulnerabilities were reported in the WordPress ecosystem during 2025, 91% of them in plugins, and for the heavily attacked ones the median time to first exploitation is five hours.

The four bills inside one invoice

Split the quote before you compare it to anything else. Maintenance is four purchases wearing one label, and they are not equally worth paying for.

The server and the platform. Hosting, certificates, PHP and database versions, the core updates a host applies whether or not anyone is watching. Cheapest of the four, and the easiest to buy well.

The update treadmill. Watching for plugin and theme vulnerabilities, applying fixes without breaking anything, and having a plan for the days no fix exists yet. This is the part people picture when they hear the word maintenance.

Somebody being responsible. A named human who notices the site is down, restores the backup and replies on a Sunday. No software supplies this, which is why the price jumps the moment it appears in a plan.

The changes you will ask for. New pages, a price update, a staff photo, one more form field. Most businesses need more of this than they budget for, and most quotes treat all of it as extra.

Priced separately, those four are simple to shop. Rolled into one figure they cannot be compared at all, which is a large part of why they usually arrive rolled into one figure.

Bill one, the server and the platform

Start here, because good managed hosting already covers more than most owners realize, and this is where paying twice is easiest. WP Engine publishes Startup at $30 a month, Professional at $55, Growth at $109 and Scale at $276, each published as a "starting at" figure on annual billing, with a Core plan from $400. Startup covers one site, 25,000 visits a month and 10 GB of storage. Scale covers 30 sites and 400,000 visits. Flywheel publishes a similar shape at $25 a month for a single site billed at $300 a year, $96 for its Freelance plan and $242 for Agency, with extra sites at $20 a month each.

The tiers matter less than the feature list every plan carries: "Daily & on-demand backups", "Managed WP, PHP & MySQL updates", "Security patching & plugin risk scans" and round-the-clock WordPress support. Hold a care plan proposal next to that list and a good share of the proposal is often the same work, sold a second time.

So the first question to ask about any maintenance quote is dull and worth asking out loud: which of these lines is my host already doing? If the answer is most of them, what you are being offered is supervision rather than labor. Supervision has real value on a busy site. It is not worth $200 a month on five pages that change twice a year.

Bill two, the update treadmill

This is the bill you cannot responsibly skip, and the underlying numbers got worse last year. Patchstack's State of WordPress Security in 2026, with data updated 25 February 2026, counted 11,334 new vulnerabilities in the WordPress ecosystem during 2025, a 42% increase on 2024. Of those, 4,124 (36%) were serious enough to require a protection rule and 1,966 (17%) carried a high severity score, meaning they were likely to be picked up by automated mass-scale attacks. Highly exploitable issues rose 113% year over year.

Where the flaws live is the useful part. 91% of the new vulnerabilities were found in plugins and 9% in themes. WordPress core accounted for six, all low priority. The platform is not what puts your site at risk. The stack of plugins bolted onto it is.

Two further findings should change what a sensible plan looks like. On speed, roughly half of high impact vulnerabilities are exploited within 24 hours, and once the figures are weighted by how intensely each one was attacked, the median time to first exploitation is five hours. On coverage, 46% of vulnerabilities had received no fix from the vendor by the time they were publicly disclosed, so for almost half of them, keeping everything updated is not an option that exists on day one.

The network layer does not rescue you either. Patchstack tested common defenses against known exploited vulnerabilities and found they blocked 12% of WordPress-specific attacks. A broader test across popular hosting companies still blocked only 26% of vulnerability attacks. On relying on updates alone, the report's verdict is short: "not a viable defence".

None of that means a five-page brochure site is under constant siege. It means the honest description of the security half of a care plan is fast reaction and clean restores, not prevention. Anyone selling prevention as a guarantee is selling something that nobody currently has.

What skipping it looks like across the whole web

Most sites are behind, and you can check that yourself rather than take our word for it. The WordPress.org statistics feed, read on 8 August 2026, puts 65.1% of installs on the current major version, 7.0. About 35% report something older, and the tail runs all the way back to releases from the early 2010s.

The PHP figures are starker. 17.7% of WordPress sites still run PHP 7.4, which reached end of life on 28 November 2022. Another 11.9% run 8.1, which stopped receiving security fixes on 31 December 2025, and 4.3% run 8.0, finished since 26 November 2023. Add everything on 7.3 and below, and 40.0% of WordPress sites are on a PHP version that receives no security fixes at all. Only 8.2, 8.3, 8.4 and 8.5 are still supported, and 8.2 loses its security support on 31 December 2026, which will move another 24.9% of WordPress sites into the dark bars on that date unless they are upgraded first.

This is the strongest argument for the boring half of maintenance. Nobody skips a PHP upgrade deliberately. It happens because the upgrade might break a plugin, because nobody owns that risk, and because the site keeps loading either way, so the decision slides to next quarter until it is four years late and the afternoon job has quietly become a project.

Bill three, somebody actually doing the work

Here is the number that reframes the whole category: the software costs almost nothing, and the people cost everything. ManageWP, one of the dashboards agencies run this work through, is free forever for update management, monthly cloud backups, security checks and performance checks across unlimited sites. Its premium add-ons are billed per website per month at $1 for uptime monitoring, automated security checks, automated performance checks and client reports, and $2 for backups and vulnerability protection. Agencies can bundle each add-on for up to 100 sites from $25 a month, or take everything for $150.

Attach a person and the price multiplies by a factor of twenty or more. GoWP publishes a maintenance plan at $39 a month per site covering WordPress updates, 90 days of off-site backups, daily security scans with malware cleanup and a visual check on every update. WP Maintainer publishes a $99 a month subscription covering core, theme and plugin updates, scheduled backups and security scanning with cleanup, then bills on-demand developer work at $99 an hour, only with your approval first.

Compare the first aqua bar with the three below it. Monitoring a site costs about two dollars a month. Having somebody accountable for it costs $39 to $99, and the moment that person has to make a judgment call it becomes an hourly rate. That is the right shape for the pricing, because automation is cheap to run and judgment is not. Nobody is charging you $99 to click update. They are charging for the decision at eleven at night when the update took the checkout down.

Two things follow from that. Cheap plans are being honest about being thin rather than cutting corners, and even the priciest line on the chart costs less than one incident handled badly. If your site takes bookings or payments, price an hour of downtime before you price any plan. That arithmetic is what our work with online stores usually turns on.

Bill four, the changes you will ask for anyway

Budget for monthly changes, because you will want them, and check whether they are included, because usually they are not. GoWP prices content edits as a separate product at $99 a month per site, sitting on top of the $39 maintenance plan rather than inside it. WP Maintainer bills the same kind of work hourly at $99. If you would rather have a named person than a ticket queue, GoWP publishes dedicated staff from $1,299 a month for a developer, copywriter or designer, and $1,099 for a virtual assistant.

That $1,299 line is the most instructive number on this page, because it marks the edge of the category. Below it you are buying upkeep. At it you are buying capacity. A business that sends three small requests a week is usually buying upkeep when it needs capacity, and paying for both.

What each option covers, side by side

That grid settles nothing on its own. It exists because these four options are almost never quoted in the same units, and once they are, most owners spot their own answer inside a minute.

When you can safely spend nothing

Plenty of sites need no maintenance plan, and we would rather say so than sell one. If your site sits on Squarespace, Wix or Shopify, updates and patching are the platform's job and already inside the subscription. If it is a handful of static pages with no forms, no logins and no payments, hosted somewhere sensible, there is very little that can rot. If your traffic is a few hundred visits a month and the business runs on referrals, the risk of an outage is measured in mild embarrassment.

The honest floor in those cases is a backup you have tested restoring at least once, a renewal reminder for the domain, and someone's phone number for the day something breaks. That is a few dollars a month, not a few hundred, and a plan sold against those conditions is selling comfort rather than protection. Our comparison of builders and hiring a designer walks through where that line usually falls.

The moment the calculation changes is the moment the site starts carrying revenue. Paid traffic landing on it, bookings running through it, patient or client information passing through a form. At that point an outage costs money on a schedule, and the maintenance question stops being about tidiness.

Does a site built without WordPress escape all this

Partly, and it is worth being precise about which part. A static site has no plugin layer, so the 11,334 vulnerabilities counted above are almost entirely somebody else's problem, and there is no database or PHP process on the public internet to keep patched. That is the single biggest reason we build the way we do, which our comparison of WordPress and modern static builds covers in detail.

What does not go away: dependencies still age. Node.js 20 reached end of life on 30 April 2026 and Node.js 18 on 30 April 2025, so a codebase left untouched for two years ends up on a runtime with no security fixes, exactly like the PHP 7.4 sites above. Frameworks ship major versions. Forms, analytics, booking widgets and payment scripts are third-party code with their own risk, which is the thread running through our piece on what a healthcare practice site has to do. And content goes stale on every platform ever built.

So a static build changes the shape of the maintenance bill rather than deleting it. Less urgent patching, no weekly plugin roulette, more attention on content and conversion. Anyone telling you their stack needs no upkeep at all has either not run one for three years or is not counting.

What we charge, and what sits inside it

Our prices are public for the same reason the ones above are. A focused build is $1,499, flat and one time. For continuing work we charge $2,499 a month, which is not a care plan with a nicer name: hosting, updates, backups, monitoring, content changes and design work all sit inside it, which is why it is priced against the capacity line rather than the upkeep line. The full breakdown is on the pricing page.

More than 200 projects have shipped under that model. One named result: 20% more website conversions at Cornerstone Healing Center once the redesign was live. Another: Eden Digital, a site we built, grew revenue 10X. A focused build usually goes live in about two weeks, and partnership requests get an answer inside 48 hours.

Who it suits: businesses whose website has to keep earning after launch, in fields where trust is doing most of the selling, such as healthcare practices and the service businesses competing for the same searches every day. Who it does not suit: a five-page site that changes twice a year. Buy a $39 plan for that one and spend the difference on something that grows.

Five questions before you sign anything

Ask these of any provider, including us, and the answers will separate a real plan from a line item in about ten minutes.

What does my host already do? Get the overlap in writing. If the plan repeats what managed hosting includes, the price should reflect that it is oversight rather than work.

Who applies updates, and when? Weekly, monthly or automatically, on staging or straight to live, and what happens when a plugin has no patch available. Given a five-hour median to exploitation, monthly is a posture, not a policy.

Where are the backups, and has a restore been tested? Retention, storage location and the date somebody last restored one successfully. An untested backup is a hope.

What counts as an edit? Get examples, a turnaround time and a monthly cap. This is where most maintenance relationships actually break down.

Who picks up the phone at 11pm, and what does that cost? A named person and a response time, or an admission that there is not one. Both answers are fine. Only the vague version is a problem.

Anything that survives those five questions is worth the money. Anything that does not is a subscription you will forget you are paying for, which is a fairly common way to spend $1,200 a year on nothing.