A WordPress maintenance plan at $500 a month should buy you five things: updates that are tested on a staging copy before they touch the live site, offsite backups you own and that someone has actually restored, a written response time for when the site goes down, malware cleanup included rather than billed as an emergency, and two to four hours of real developer time each month that you can direct. If a provider cannot tell you the number of hours and the response-time commitment, you are looking at a $50 plan with a $500 price on it.
That is the short answer. The rest of this article shows where the money goes, what the cheap tiers quietly leave out, and the questions that separate a real plan from a cron job with an invoice attached.
What does a WordPress maintenance plan cost?
The market sorts itself into four bands. These ranges are consistent across the agencies and platforms publishing pricing in 2026:
| Monthly price | What it typically covers | Developer time included |
|---|---|---|
| $30–$100 | Automated core and plugin updates, a backup plugin, uptime pings, a monthly PDF report | None |
| $100–$300 | The above plus a support inbox, security scanning, sometimes a staging environment | 0–1 hour |
| $300–$500 | Staging-tested updates, offsite backups with retention, malware remediation, priority support | 1–3 hours |
| $500–$2,500+ | All of the above plus a named contact, performance work, release coordination | 3–8 hours |
One published plan ladder is useful here because it prices the hours openly: $99/month with no development time, $199 with one hour, $349 with three hours, and $599 with eight. The jump in price between those tiers is almost entirely labour. Everything else — the scanning, the backups, the monitoring — barely changes between the $99 plan and the $599 one.
WooCommerce stores sit a tier higher than their traffic suggests. A plugin update on a store has to be checked against cart, checkout, payment gateway and order emails before it ships, and that is a fixed amount of work regardless of how many orders you take. Plans for stores commonly start where brochure-site plans end, around $500.
Where the $500 actually goes
Tooling is the small part. Here are current list prices for the software a competent plan runs on a single site:
| Line item | List price | Per month, per site |
|---|---|---|
| Virtual patching / vulnerability protection (Patchstack) | From $5/month per site | ~$5 |
| Offsite backup with staging (BlogVault Business) | $299/year per site | ~$25 |
| Offsite backup, WooCommerce tier | $499/year per site | ~$42 |
| Uptime and transaction monitoring | Varies; often bundled | $0–15 |
Call it $40–$60 a month for a standard site. That leaves roughly $440 of the $500 as labour and margin. At the $80–$120 per hour that experienced WordPress contractors are commonly advised to charge, $440 is between 3.5 and 5.5 hours of billable time — before the provider’s own overhead, tooling for their team, and the unbilled minutes spent reading update changelogs. Two to four hours of actual work on your site is a realistic expectation at this price. Anyone promising twenty is either subsidising you with another client or not doing the work.
This arithmetic is the most useful thing you can do before signing. Take the monthly fee, subtract $50 for tools, divide by $100. If the answer is under an hour, the plan is automation plus an inbox — which may be fine, but you should know that is what you bought.
Why “we keep your plugins updated” is not worth $500
Running updates is a button. The value is in catching what the button breaks.
WordPress has built real safety nets into core. Version 6.3 added rollback for failed manual plugin and theme updates, and 6.6 extended that to automatic updates: core runs a loopback request to the homepage after an auto-update, and if it comes back with a fatal error, the previous version of the plugin is restored and the administrator gets an email.
Read what that protects against, though. It catches PHP fatal errors and failed loopbacks. It does not catch an update that installs cleanly and quietly breaks something: a checkout step that now fails validation, a form that stops sending, a layout that collapses on mobile, a caching rule that starts serving logged-in pages to everyone. Those are the failures that cost money, and no automated rollback will ever see them. Someone has to look. That is what the staging step in a real plan is for, and it is the single biggest difference between a $99 plan and a $500 one. We wrote about the specific failure modes in what actually breaks when you auto-update WordPress.
Update volume is not trivial either. The WordPress 7.1 branch shipped three patch releases — 7.1.1, 7.1.2 and 7.1.3 — within about three weeks of the branch opening, with 7.1.3 landing on 6 October 2026. That is core alone. A site with thirty plugins sees update activity most weeks of the year.
What the security line item is really buying
The case for paying someone is in the disclosure numbers. Patchstack’s security report covering 2025 recorded 11,334 new WordPress vulnerabilities, up 42% from 7,966 the year before. Plugins accounted for 91% of them; WordPress core itself had six. The weighted median time between public disclosure and first observed exploitation was five hours. Twenty percent of heavily exploited vulnerabilities were being attacked within six hours, 45% within a day, 70% within a week. And 46% had no patch available at the moment they were disclosed.
Two things follow from that. First, a monthly update cycle is not a security control — a five-hour median exploitation window means the question is whether anyone is watching the disclosure feed for your specific plugin set, not whether updates run on the first Tuesday. Second, for the 46% with no patch available, updating is not even an option; the only defence is a virtual patch at the firewall layer or disabling the plugin. That capability is what the $5–$15 security line in the table above pays for.
Do not assume your host covers this. In the same research, conventional defences blocked 12% of attacks against known exploited vulnerabilities in one test set and 26% in a broader one. The best-performing host outside the vendor’s own stack blocked 60.7%; several blocked under 17%.
If this is already a live problem rather than a hypothetical one, the emergency path is different from the maintenance path — start with what to do in the first 60 minutes, and the Japanese keyword hack walkthrough if your symptom is spam pages in search results.
The five contract questions that actually matter
Most published advice on choosing a plan stops at the feature list. These are the terms that decide what happens on your worst day, and they are usually absent from the sales page.
1. Who owns the backups, and can you download them?
Many plans store backups inside the provider’s account on the provider’s tooling. That is fine operationally and dangerous contractually. Ask whether you can export a full backup — database and files — on demand without asking them, and where it lives. If the answer is “we’d generate one for you,” you do not own your backups.
2. When was a restore last tested, on your site?
A backup that has never been restored is a hypothesis. Ask for the date of the last test restore of your site specifically, and how long the full restore took. “Daily backups with 30-day retention” tells you nothing about recovery time.
3. What is the response time, in hours, and does it apply at 2am Saturday?
“Priority support” is not a commitment. Get a number, and get the hours it applies in. A four-hour response during business days is a reasonable mid-tier commitment; if your revenue runs overnight or at weekends, you need to say so before signing, not during an outage.
4. Is malware cleanup included, or billed?
This is the most common gap in the $30–$100 tier: scanning is included, cleanup is a separate incident fee, frequently $200 or more. At $500 a month, remediation of an infection should be inside the plan. Ask explicitly, and ask whether reinfection within a defined window is covered.
5. What happens when an update breaks the site — whose time fixes it?
If the provider deploys the update, the provider fixes the regression, and that time does not come out of your included hours. Get it in writing. The alternative — your monthly hours being consumed by cleaning up their deployments — is how a plan quietly delivers nothing.
Worth adding a sixth if the plan advertises “unlimited edits”: ask what an edit is. In practice the cap is usually around 20–30 minutes per request, with anything larger quoted separately. That is a reasonable policy, but it should be written down rather than discovered.
If you want to compare what a provider says they do against what the work actually involves, our WordPress maintenance checklist lists the tasks task by task, including the ones that are easy to skip and invisible when skipped.
Not sure whether your current plan covers these five points? Send us your plan and the last three monthly reports and we will tell you which of the five terms are missing and what it would cost to close them.
What should be on the roadmap, not just the checklist
A plan at this price should be doing scheduled work, not only reactive work. The clearest current example is PHP. Security support for PHP 8.2 ends on 31 December 2026. PHP 8.3 runs to 31 December 2027, and 8.4 to 31 December 2028. If your site is on 8.2, the migration is a known, dated piece of work — compatibility scan, staging upgrade, plugin-by-plugin verification — and it should already be on a calendar your provider can show you. A plan that only reacts to breakage will find out about this at the wrong time, usually when the host force-upgrades the PHP version on your behalf.
The same applies to anything with a date attached: certificate renewals, abandoned plugins that will need replacing, a theme whose author has stopped shipping updates, database growth trending toward a performance problem. Ask to see a twelve-month view. If the provider cannot produce one, the plan is maintenance in name only.
When $500 a month is the wrong number
It genuinely is, sometimes. A five-page brochure site with no forms, no logins, no commerce, a handful of plugins and a few hundred visits a month does not need $500 of attention. Good managed hosting plus a $30–$100 plan is a defensible choice, and the honest version of that conversation is one worth having. The risk calculation is simple: what does a day of downtime cost you, and what does a cleanup cost if a breach puts spam pages in your search results?
The number flips fast in the other direction. If the site takes orders or bookings, holds customer accounts, runs ads to landing pages, or is the main channel by which anyone finds you, a day of downtime and a week of deindexing will cost more than a year of the plan. At that point the question is not whether $500 is a lot. It is whether the $500 plan you are looking at buys the five things at the top of this article, or four of them and a report.
Next step
The fastest way to know what you are paying for is to compare the last three monthly reports against what actually changed on the site. If the reports say “12 plugins updated” and nothing else, there is nothing in them that a free scheduler could not produce.
Tell us what your site runs on and what your current plan costs, and we will send back a straight comparison: what is covered, what is not, where the hours go, and whether moving is worth it for your site. If your current plan is fine, we will say so.