WordPress Website Maintenance Services: What UK Firms Pay
WordPress website maintenance services keep the software, plugins, theme and server stack updated, backed up and patched so the site stays secure and usable. In the UK, a basic managed package for a small business site typically runs from about £25 to £80 a month; heavier sites with WooCommerce or custom plugins cost more.
What the work actually is
WordPress is not a finished product. Core, PHP, your theme and every plugin ship updates. Leave them, and you get broken layouts, failed forms, or a site that search engines treat as unsafe. Maintenance is the scheduled work that stops that.
A competent service does more than click Update. It tests on a staging copy where possible, checks PHP compatibility, watches error logs, confirms backups restore, and rolls back if a plugin fight appears. That is the difference between a cheap auto-update plugin and a person who is accountable when checkout stops working on a Friday.
Typical tasks you should see listed
- WordPress core, theme and plugin updates, with notes of what changed
- Security patches and malware scans; removal if something gets in
- Daily or weekly backups stored off the live server, with a restore test
- Uptime monitoring and a named contact when the site is down
- PHP and SSL certificate checks so hosting does not silently expire support
- Database cleanup: spam comments, revisions, transients that bloat MySQL
- Form and checkout smoke tests after updates
- A short monthly report: what ran, what failed, what needs a decision
Content writing, new pages and redesigns are not maintenance. Treat those as separate jobs so you are not paying a retainer for work that never happens.
UK price ranges in 2026 terms
Freelance and small-studio WordPress care plans for a brochure site usually sit at £25 - £60 a month. Add WooCommerce, membership or several custom plugins and £70 - £150 is common. Agency white-glove retainers with a dedicated account manager often start around £200 - £400. One-off emergency clean-ups after a hack typically cost £150 - £600 depending on how deep the infection went.
Hosting is sometimes bundled, sometimes not. Cheap shared WordPress hosting at £5 - £12 a month is fine for a quiet brochure site; WooCommerce usually needs a VPS or managed WordPress host at £20 - £80. If the maintenance quote excludes hosting, add that cost yourself or you will under-budget.
I build sites as one-off projects and also as pay-monthly plans that include hosting, updates and ongoing management after a setup fee. Exact figures sit on arlowebstudio.com rather than here, because packages change with scope.
What you get for the money
| Level | Typical UK monthly | Fits |
|---|---|---|
| Self-serve plugins only | £0 - £15 tools | You update, you restore, you own the risk |
| Basic managed | £25 - £60 | Small brochure site, few plugins |
| Commerce / custom | £70 - £150 | Shop, bookings, several integrations |
| Agency retainer | £200+ | Multiple sites, SLA, named manager |
How to choose a provider without getting a hollow plan
- Ask what is excluded. Many plans skip theme customisations, WooCommerce conflicts and malware cleanup, then charge extra the first time something breaks.
- Confirm backup location and restore time. A backup on the same disk as the live site is not a backup.
- Check PHP and WordPress version policy. If they will not move you off PHP 7.4, walk away.
- Get the update window in writing. Overnight midweek is kinder than Friday 4pm.
- Ask who does the work: a named person in the UK, or a ticket queue overseas with no staging.
- Read the exit clause. You should be able to take backups, a copy of the database and the files without a ransom fee.
Doing it yourself versus paying
If you have 30 - 60 minutes a week, a staging site, and you understand plugin conflicts, you can maintain a simple site. Use a backup plugin that writes to independent storage, enable auto-updates only for trusted plugins, and keep a local copy of wp-config and .htaccess.
Skip DIY if the site takes payments, holds personal data, or you cannot restore from backup in under an hour. GDPR still applies to a forgotten contact form. A hacked WordPress install that emailed spam can get the domain blacklisted; cleanup then costs more than a year of a modest plan.
WordPress-specific risks people miss
Nulled or pirated plugins are a common infection route. Premium licences that lapsed stop getting patches. Page builders that dump shortcodes make updates slower and more fragile. Multisite and heavily customised themes need a developer, not a generic update bot.
Image bloat and unused plugins slow Time to First Byte. Maintenance should include a quarterly cull: deactivate what you do not use, then delete it. Leaving 40 inactive plugins still increases attack surface because the files remain on disk.
When a redesign is cheaper than endless patches
If the theme is five major versions behind, or the builder is abandoned, maintenance quotes climb because every update is a gamble. At that point a rebuild on a supported theme, or a move to a simpler stack, often costs less over 18 months than fighting conflicts. Pay-monthly builds suit firms that cannot fund a lump-sum rebuild; one-off builds suit those who want to own the files outright and handle hosting themselves.
Get a written inventory first: PHP version, WordPress version, plugin list with last-updated dates, last successful restore, and uptime for the past 90 days. That list tells you whether you need a care plan or a rebuild, which is a different job.
Frequently asked questions
How often should WordPress be updated?
Core security releases should go on within days. Plugin and theme updates weekly is a sensible rhythm for a small business site, with a staging check first if you take payments or use several custom plugins.
Does WordPress maintenance include hosting?
Not always. Some UK plans bundle hosting; others assume you already pay a host. Always add hosting (£5 - £80 a month depending on traffic and WooCommerce) if it is missing from the quote.
Can I pause maintenance for a quiet season?
You can, but updates and backups should not stop. Attackers do not wait for your busy months. A cheaper backup-only month is safer than switching everything off.
What happens if a plugin update breaks the site?
A proper service restores from the last good backup or rolls the plugin back, then tells you. If the contract has no restore SLA, you are buying hope, not maintenance.
Is a security plugin enough on its own?
No. Firewalls help, but unpatched core and plugins remain the usual way in. Pair a firewall with timely updates, off-site backups and strong admin passwords or 2FA.