What a WordPress Maintenance Plan Should Include, and What It Costs in the US

Most people searching “WordPress maintenance” are looking for the maintenance-mode page WordPress shows while it updates. This article is about the other thing: the ongoing service that keeps a business website updated, backed up and working. It is the pillar of our “Keeping a WordPress site alive” series, and every other article in the series goes deeper on one part of it. We wrote it because owners ask us two questions in the same sentence, what should be in a plan and what should it cost, and the published answers are scattered across the pages of companies that sell one.

What a plan has to do

Seven jobs make a maintenance plan. A plan that leaves out one of them leaves you doing it yourself, or not doing it.

1. Update the core, the theme and the plugins

WordPress core installs its own minor releases, which include maintenance and security fixes, by default. Major core releases update themselves by default only on sites first installed with WordPress 5.6 or later, and plugins and themes are not updated by default except in special cases the WordPress security team controls. So on an ordinary business site, the plugin and theme updates, which are where most of the risk sits, wait for a person or for a setting somebody chose.

WordPress 7.0 was released on May 20, 2026 and 7.1 on August 19, 2026, and the current release, 7.1.3, is dated October 6, 2026, seven weeks after 7.1¹. The core project’s handbook describes a release cycle that usually lasts around four months from scoping to launch, with minor releases following to fix what is found after launch². Plugins and themes keep their own schedules. A plan should say how quickly security updates are applied and how often everything else is.

2. Keep backups, and say where they are kept

WordPress’s documentation says a backup has to include both the database and the files, because “you need both to be able to fully restore a typical WordPress site.” It advises backing up regularly and always before an upgrade, weekly for a small site and daily for a busy one, keeping at least three to five recent copies, and storing them in different places, such as the hosting server, cloud storage and a local computer³.

The part a plan should add is a restore test. The documentation recommends checking that automated backups work, and we would go further: a backup nobody has restored is a hope. Ask when the last restore was tried.

3. Watch for security problems

Plugins are where WordPress sites are attacked. Patchstack’s 2026 report counts 11,334 new WordPress vulnerabilities disclosed in 2025, 42% more than in 2024; 91% were in plugins, 9% in themes, and 6 in WordPress core⁴. It found that 46% had no fix from the developer when they were made public, and that the weighted median time to mass exploitation for heavily targeted vulnerabilities was 5 hours⁴. Monitoring in a plan means someone is looking at those disclosures against your plugins, not that a scanner runs once a week. Our companion article, what thousands of plugin vulnerabilities a year mean for a ten-plugin site, works through the numbers.

4. Check that the site is up

An uptime check is a service that requests your home page every few minutes from outside your managed servers and tells someone when it fails. It sounds minor, and it is the only way a business owner hears about an outage before a customer does. A plan should say who receives the alert and who acts on it.

5. Test big updates on a staging copy

A staging copy is a private duplicate of the live site where an update is tried before it reaches visitors. It matters most for the updates that can change how the site looks or works: a major WordPress version, a page builder, an e-commerce or booking plugin. Staging is not universal: some plans offer it only in their top tier, so ask which updates are tried there first.

6. Make the changes you ask for

A site changes: a new service, a new phone number, a new photo. Many plans include a small block of edit time each month, counted in hours on the cheaper ones and advertised as unlimited at higher tiers. Check what counts as an edit and whether unused time carries over.

7. Report what was done

A report is the proof. It should list what was updated, what was backed up and when, how long the site was down, and what was found. A plan with no report cannot be audited by the owner.

What a plan is not

A plugin that updates itself is not a plan. It can apply updates, which is useful, and it cannot tell you that the update broke the booking form, it does not hold a second copy of your site somewhere else, and nobody answers when it fails. The same goes for a hosting plan’s automatic updates: the host runs its servers, and the content and code of your WordPress site are yours. Patchstack tested hosting-level defenses in two experiments and found they blocked 12% of WordPress-specific vulnerability attacks in the first and 26% of total attacks in the second⁴. That is a layer, not a substitute. The difference is covered in hosting vs a maintenance plan: who fixes what when the site goes down.

What it costs in the US

Published monthly plans in the US run from about $49 to over $300 a month for an ordinary small-business site, as of November 2026. That is what providers publish, not what a particular small business will pay, and the plans at the top of the range add developer hours that the cheaper ones leave out.

Do the arithmetic for a year: the range works out to roughly $600 to $3,600 or more. Against that, price the alternative: a few hours of emergency work at a developer’s hourly rate when an update breaks the site, or a malware cleanup that some plans quote separately or include only at a higher tier. We do not know your site’s hourly rate or your odds, so we will not pretend the comparison has one answer. It does show that the cheapest plan is cheap partly because it leaves things out, and the seven jobs above say which.

Hosting against a plan

Hosting is the computer your site runs on. A plan is the person who looks after what runs on it. Cheap shared hosting normally includes the first and not the second; managed WordPress hosting normally includes some of the second and not the testing, the changes or the report. When you compare, put the two on the same sheet and ask which of the seven jobs above each one does. Our article on monthly website costs lists the line items.

Questions to ask a provider

Ask these before you sign, and keep the answers in writing:

1. Who updates plugins, and how soon after a security fix is released? A number of hours or days, not “promptly.”
2. Are updates tried on a staging copy first? For which updates, and for every site or only the top tier?
3. Where are the backups kept, how often, and when was a restore last tested? A copy on the same server as the site is not a backup against a server failure.
4. What is monitored, and who gets the alert? At night and on weekends too.
5. What is included in the hours, and what is billed extra? Malware cleanup is the item most often quoted separately.
6. Do I get a report, and how often?
7. Who owns the accounts? The domain, the hosting and the WordPress administrator login should be in your name. We learned why in what to do when your web developer disappears.
8. What happens when I leave? You should be able to take a full copy of the files and the database with you.

What happens without one

Nothing, for a while, which is the problem. Sites with no plan keep running until an update is overdue, a plugin has a published flaw, or a server setting changes. Patchstack’s figures put a number on how short the window can be: for heavily targeted vulnerabilities the median time to mass exploitation was 5 hours, and 46% of vulnerabilities had no developer fix on the day they were made public⁴. A site left alone is not safe because nothing is touching it. What goes wrong then is covered in the first hour after a hacked redirect, and a different failure, a slow site, in why your Elementor or Divi site is slow.

Some problems are not about upkeep at all. Whether the site meets accessibility standards, and what to do when a demand letter arrives, are in the accessibility demand letter article and the overlay widget article. Changing builder versions is in Divi 5: should an existing site migrate.

What we do about it

On the sites we manage, we manage the servers, so hosting and upkeep are one job and one person to ask. Updates go onto a staging copy first and reach the live site after they have been tried. Backups are daily and kept off the server. The themes are ones we write ourselves, with no page builder, which leaves fewer moving parts to update. The service is described on our website management page. It is a fit for some sites and not for others, and an inexpensive plan is the right answer for a small brochure site with few plugins.

When to get help

Get help when the site makes money or takes bookings, when it has more than a handful of plugins, when it was built with a page builder, or when nobody knows the last time a backup was restored. Do not pay for the top tier of anything if the site is five pages and has not changed in a year. The consultation is free, and we will tell you if an inexpensive plan is enough.

Frequently Asked Questions

What does a WordPress maintenance plan include?

Updates to the core, theme and plugins, backups kept off the web server, security and uptime monitoring, a staging copy for large updates, a small number of changes, and a report. Check each in writing.

How much does WordPress maintenance cost per month in the US?

Published monthly plans in the US run from about $49 to over $300 a month for an ordinary small-business site, as of November 2026. Prices change, and the plans at the top add developer hours.

How often does WordPress need to be updated?

WordPress core installs minor and security releases by itself by default, and major versions arrive about every three to four months: 7.0 on May 20, 2026 and 7.1 on August 19, 2026¹². Plugins and themes update on their own schedules and are not updated by default.

Can I maintain my WordPress site myself?

Yes, if you can update plugins, take a backup, and restore it. The WordPress documentation describes how to back up and why to do it before every upgrade. The risk is the update that breaks the site on a day you are busy, with no staging copy to have caught it.

Is a self-updating plugin enough?

No. WordPress can be set to update plugins and themes automatically, but that does not test the result, keep a second copy of the site, or tell anyone when something fails. It is one tool a plan can use.

Does my host's maintenance cover this?

Partly. Patchstack’s tests found hosting-level defenses blocked 12% of WordPress-specific vulnerability attacks in one experiment and 26% of total attacks in another⁴. Ask the host in writing what it updates, and what it leaves to you.

Sources