CentriWebWebsite maintenance cost comes down to how much work your site needs each month: software updates, backups, security monitoring, hosting and a set amount of small content changes. A five-page WordPress site with a handful of plugins needs far less of that work than an online store or a site with bookings and integrations, so the fair way to judge a quote is to compare what is included, how fast problems get fixed and who carries the risk when an update breaks something.
CentriWeb builds websites on WordPress and looks after them with managed hosting, so weigh our view with that in mind. Below is what the work involves, what moves the price, and a checklist for reading any WordPress care plan, whoever offers it.
What website maintenance covers
Maintenance is everything that keeps a live website working, safe and current after launch. It falls into five jobs:
- Updates. WordPress itself, the theme and every plugin release new versions. Some fix security holes, some add features, and some break other parts of the site.
- Backups. Regular copies of the files and the database, stored somewhere other than the server the site runs on, and tested.
- Security. Watching for malware and suspicious logins, a firewall, and a plan for cleaning up if the site is compromised.
- Hosting and uptime. The server, the security certificate that gives you the padlock in the browser, and someone watching for the site going down.
- Small changes. New staff photos, a changed price, a holiday notice, a new page built from an existing layout.
Some plans add speed checks, search reports and a monthly summary. Those are useful extras. The first four jobs are the ones that cost you money when nobody does them.
What drives website maintenance cost
Two sites that look alike can need very different amounts of care. These are the things that move the price, roughly in order of weight:
- How many plugins, and how they were chosen. Each plugin is a separate piece of software with its own author and update cycle. A site with eight well-supported plugins is cheaper to look after than one with forty, some of them abandoned.
- What the site does. A brochure site holds little that changes. An online store, a booking system, a members area or a form that feeds your CRM has moving parts, and every update has to be checked against them.
- How updates are tested. Pressing “update all” on the live site is quick and cheap. Running updates on a staging copy first, checking the key pages and forms, then pushing them live takes longer, and it is what protects you.
- Backup frequency and storage. Daily off-site backups kept for a month cost more than a weekly copy kept on the same server. A store taking orders all day may need more often than daily.
- Response time. A plan that promises to start on a broken site within a few business hours costs more than one that gets to it when it can.
- Included change time. Some plans include a set amount of editing each month. Others charge for every change.
- Whether hosting is included. Many care plans bundle managed hosting. Others assume you already pay a host separately.
What a WordPress care plan should include
A WordPress care plan is a monthly or yearly agreement under which someone else handles the jobs above. Plans vary widely, so a good one states each of these in writing:
- How often WordPress, theme and plugin updates are applied, and whether they are tested on a staging copy first.
- What happens when an update breaks something: who rolls it back, and how quickly.
- How often backups run, where they are stored, how long they are kept, and when a restore was last tested.
- What security monitoring is in place, and whether cleaning up after a hack is included or charged separately.
- Uptime monitoring, and who is alerted when the site goes down.
- How much content change time is included, and the rate for work beyond it.
- Response times for urgent problems and for ordinary requests, and the hours those apply.
- Who holds the logins, the domain name and the hosting account, and how you get all of it if you leave.
That last point matters more than it looks. Your domain name and hosting should be in your business’s name, or easy to move into it. Our guide on who owns your website lists the questions to ask.
Updates are the hard part
WordPress looks after its own minor releases on most sites. Its upgrade documentation says that “By default, automatic updates of WordPress are enabled on most sites”, and minor updates include maintenance and security releases. Plugins and themes are different. They come from many separate authors, and the same page says automatic background updates for them happen only in special cases unless they are switched on.
Switching on automatic updates for everything is cheap and keeps the software patched. The trade-off is that a plugin update can change how a form, a payment page or a layout behaves, and nobody notices until a customer does. Testing first takes time, which is why careful plans cost more than automatic ones.
A sensible middle ground for many small sites: automatic minor WordPress releases, plugin updates applied weekly after a fresh backup, a quick check of the homepage, contact form and any checkout, and a staging test before any major version change.
Backups and security
The WordPress documentation advises backing up before you update, and says to check that your backups are there and usable, calling that step “essential”. A backup you have never restored is a hope rather than a plan, so ask when the last test restore was done.
For security, the basics are: up-to-date software, strong unique passwords with two-step sign-in for every administrator, removing old user accounts and unused plugins, a firewall, and malware scanning. Our website security checklist goes through them one by one, and the guide to website backups covers how often to back up and where to keep the copies.
Ask whether cleaning up a hacked site is included. If it is not, find out the rate before you need it, because that is the moment you have least room to negotiate.
Comparing the ways to maintain a website
| Option | Who does the work | How it charges | Suits |
|---|---|---|---|
| Do it yourself | You or a staff member | Your time, plus hosting and any premium plugin licences | Simple sites, and an owner comfortable in WordPress with time each week |
| Updates handled by your host | Your hosting company, usually automatically | Included in some managed hosting plans | Sites with few plugins and nothing that takes payments or bookings |
| Care plan | A developer or studio, often the one who built the site | Monthly or yearly fee, sometimes with change time included | Sites that bring in enquiries or sales, where downtime costs money |
| Pay as you go | A developer, when you ask | Hourly or per job | Sites that rarely change, with an owner willing to carry the risk between check-ins |
Our guide to managed WordPress hosting explains what hosting companies tend to include and what they leave to you.
How to work out what maintenance is worth to you
Start from what the site does for the business. A worked example with made-up numbers: if your website brings in ten enquiries a month and one in four becomes a job worth $2,000, the site is producing about $5,000 of work a month. A week offline, or a broken contact form nobody notices for a fortnight, costs a share of that. Compare the monthly fee with your own version of that figure, rather than with what a friend pays for a hobby blog.
Then count your own time. If you or a staff member spends two hours a month on updates and small fixes, price that time at what it is worth to the business, including the jobs it pulls you away from.
For a site that rarely changes and earns little, a basic plan or doing it yourself is reasonable. For a site that takes bookings, payments or most of your enquiries, pay for tested updates, off-site backups and a fast response.
Questions to ask before you sign
- What exactly is included each month, and what costs extra?
- Do you test updates before they go live, and how?
- Where are backups stored, how long are they kept, and when did you last test a restore?
- If the site is hacked, is the clean-up included?
- How fast do you respond to an urgent problem, and in which hours and time zone?
- Is there a minimum term, and how much notice do I give to leave?
- If I leave, what do I get: files, database, logins, and access to the domain and hosting?
If a provider cannot answer these clearly, the monthly fee is hard to judge, however low it is. If the answers are clear and match what your site does for the business, you have a plan worth paying for.