A customer rang us because their website was not displaying properly. No maintenance plan, so this was the first we had heard of it. We took a look: WordPress was showing its little error box, and we could not get into the dashboard at all. We asked when they had last updated their plugins. Months ago.
We gave them two options. Pay us to investigate properly, or we roll the site back to a working version for a fixed fee and bring it up to date. They rang back in a panic, because they had just worked out they had not received a single lead in over a week.
The fix came to just under £150 plus VAT. That is not the expensive part. The expensive part is a week of enquiries that likely went to a competitor, and the fact that nobody noticed until the phone stopped ringing.
That is what a maintenance plan is really for. Not updates. Somebody noticing.
Key takeaways
- A maintenance plan should cover hosting, SSL, daily backups, uptime and security monitoring, and CMS updates and patches as the baseline. Ours starts at £39 a month plus VAT.
- Plugins are the biggest risk, not WordPress core. In 2025, 91% of new WordPress vulnerabilities were found in plugins and only six were in the core software.
- The three things agencies do not tell you: breakage often gets billed as “out of scope”, “rapid response” usually means a ticket queue, and the “fix” is frequently just restoring a backup while the real problem goes unsolved.
- Ask what happens when an update breaks the site. That question separates a real plan from a hosting resale.
- You can absolutely do this yourself. The full routine is below. Read it honestly and decide whether you will actually do it every month.
What is actually included
Here is what we cover at each tier, in plain English.
| £39/mo | £89/mo | £189/mo | |
|---|---|---|---|
| UK managed hosting and SSL | Yes | Yes | Yes |
| Daily backups | Yes | Yes | Yes |
| 24/7 uptime monitoring | Yes | Yes | Yes |
| Security monitoring | Yes | Yes | Yes |
| CMS updates and patches | Yes | Yes | Yes |
| Expert help and advice | Yes | Yes | Yes |
| Edits and changes | No | Up to 2 hours a month | Unlimited requests, one at a time |
| If an update breaks the site | Rolled back, then we wait for the plugin fix | Rolled back, then fixed on staging | Rolled back, then fixed on staging |
All prices exclude VAT.
What counts as an edit on the £89 and £189 plans: changes to page content, uploading new content, blog posting, changing settings, installing plugins, uploading and optimising images, and CSS adjustments. You send the instructions and any text, images or files, and we do the work within the time available.
What “unlimited” means on £189: unlimited requests, not unlimited scope. Send as many as you like and we work through them one at a time, in the order they arrive. Each request is a task: change this copy, swap that image, post this blog, adjust that setting. What it is not is a project. Rewriting or restructuring your whole site is a rebuild, and we will quote for it rather than quietly absorb it. We would rather draw that line here, in public, than spring it on you in a support ticket.
What does not count as an edit: custom PHP, HTML or JavaScript coding, new plugin development or modification, theme building, updating custom code, graphic design, building new websites, or new page layout templates. Those are real development work, and we quote for them separately rather than pretending two hours a month covers them.
Out of hours, the site is still monitored remotely. What happens next depends on your plan.
Why plugins cause most WordPress maintenance problems
WordPress core is rarely the main risk. In 2025 there were 11,334 new vulnerabilities found across the WordPress ecosystem, 91% of them in plugins, and only six in the core software itself, all of those low priority.
That is why our rescue client’s site fell over. Not because WordPress is fragile, but because thirty-odd plugins had been sitting unpatched for months while their developers shipped fix after fix that nobody installed.
The same report found that around half of high-impact vulnerabilities are exploited within 24 hours of being disclosed, and the most heavily targeted within about five hours. Monthly updates are the minimum, not the gold standard.
Where maintenance plans really fall down
Maintenance is usually sold as a vague peace-of-mind insurance policy, leaning on the fear of hacks and broken plugins. The real problem is not the fear. It is the lack of transparency. Agencies pitch proactive risk management, but the contract often only covers basic automated updates with no active testing or troubleshooting behind them.
The gap between the pitch and what happens when something actually breaks comes down to three things.
The Scope Trap. The site breaks after an update. The agency classifies the fix as a new feature request, or as outside the scope of a basic retainer, and bills you by the hour. You were paying monthly precisely so this would not happen.
Response times. “Rapid emergency response” in the sales pitch. In reality the ticket joins a standard queue, and out-of-hours support carries a hefty emergency premium.
Wait and see. Some agencies run updates automatically on a staging server. If the site breaks, the fix is frequently just restoring an older backup, leaving the site vulnerable while somebody works out the root cause. Sometimes nobody ever does.
The same three questions, asked of us
It would be easy to list those three and let you assume we are different. Here is the honest version, including where our own entry plan does not win.
The Scope Trap: here is our line. If an update breaks the site, we roll it back. If the breakage is caused by code we wrote, we fix it, no argument and no invoice. What is chargeable is damage caused by something you did to the site yourself. That line is easy to state and we state it upfront, which is the whole point.
Response times: on £39 you wait, on £89 you do not. Every plan is monitored around the clock, out of hours included. The difference is what happens next. On £39, if a plugin breaks your site, we roll it back and you wait for the plugin developer. On £89 and £189 there is no fix window to sit through, because the rollback puts you back in service straight away and the real fix happens in the background, on staging, while your site carries on working. You are trading the whole time.
Wait and see: our £39 plan does exactly what we just criticised. If a plugin breaks your site on the entry plan, we roll it back and wait for the plugin developer to publish a fix. That is rollback as the fix, which is the thing we said not to accept.
On £89 and £189 it is a different process. We take a copy of the site onto staging, roll the live site back so you are trading again, then work on the problem offline. When it is solved, we migrate the fixed site from staging to live. The rollback is a holding action, not the answer.
So: £39 keeps you patched, backed up and watched. £89 is where the rollback buys time rather than being the answer, and the fix gets made behind the scenes with no loss of service. That is the real difference between the tiers, and it is more useful to you than another row of ticks.
One caveat worth knowing, because it applies to everyone and not just us: 46% of disclosed WordPress vulnerabilities had no developer patch available at the time they went public. Sometimes waiting for the plugin author genuinely is the only option. Any agency telling you otherwise is selling you something.
What to ask any agency before you sign
Four questions. The answers tell you more than the feature list.
1. If an update breaks my site, who pays to fix it? Get it in writing. This is where the scope trap lives.
2. What is the actual fix time, and does out of hours cost extra? Not “rapid response”. A number.
3. When something breaks, do you fix it or just roll it back? And if you roll it back, what happens next?
4. Where are the backups stored, and have you ever restored one? A backup on the same server as the website is not a backup.
If a provider gets vague on any of those, that is your answer.
If you would rather do it yourself
Some people should. If you are confident with updates and you genuinely keep an eye on your site, you do not need us. But you should know what the job actually involves.
A sensible routine looks like this:
- Update WordPress core, plugins and themes at least once a month
- Take a full backup before every single update
- Store that backup away from the website server, not on it
- Know how to restore it. Not assume the backup works: know
- After every update, check forms, menus, mobile layouts, key pages and any checkout
- Monitor uptime and failed form submissions
- Review security alerts, storage limits and expired licences
- Test your backups from time to time
None of that is difficult. The hard part is consistency.
Most website owners can press the update button. The problems start when an update conflicts with another plugin, a form quietly stops sending, a backup turns out to be incomplete, or the site breaks on mobile only and nothing looks wrong on your desktop.
That is exactly what caught out the client at the top of this article. They were not careless. They believed the site was being managed properly, right up until a problem exposed the gaps.
Read the list again and be honest about whether you will do it every month, in a busy month, when the van needs an MOT and you are three quotes behind. Some people will. Others will look at that list and decide £39 a month is reasonable. Both are fine. What is not fine is assuming it is happening when nobody is doing it.
The cost nobody puts in the brochure
Just under £150 plus VAT to fix. A week with no leads.
For many trade businesses, a week of missed enquiries can be worth considerably more than a year of maintenance. That is the sum, and it is the only one that matters. A maintenance plan is not insurance against hackers. It is the difference between finding out on day one and finding out when you notice the phone has stopped ringing.
If you want to talk through which tier fits, get in touch and we will tell you honestly if you do not need one. You can also see the full maintenance plans and what each one includes.
Frequently asked questions
Do I really need a website maintenance plan?
Not if you will genuinely update monthly, back up before every change, test restores and check the site after every update. If you will do all of that consistently, manage it yourself. If you are honest that you will not, a plan may be cheaper than finding out after a week of lost enquiries.
What happens if an update breaks my website?
On our plans, we roll it back so you are trading again. On £39 we then wait for the plugin developer to publish a fix. On £89 and £189 we take a copy to staging, fix it offline, and migrate the working site back to live. If the breakage came from code we wrote, we fix it at no charge.
Is hosting included in website maintenance?
In ours, yes. UK managed hosting and SSL are included from £39 a month plus VAT, along with daily backups, uptime and security monitoring, and CMS updates. Some providers charge hosting separately, so check what the monthly figure actually buys.
How often should a WordPress site be updated?
At least monthly, and sooner for security releases. Around half of high-impact WordPress vulnerabilities are exploited within 24 hours of disclosure, so a site left for months is a site waiting for trouble.
What is not covered by a maintenance plan?
Ours does not cover custom PHP, HTML or JavaScript development, plugin development or modification, theme building, graphic design, new page layout templates or new websites. Those are separate quoted work. Damage caused by changes you make to the site yourself is also chargeable.
