DIY WordPress maintenance vs a care plan

What DIY maintenance actually involves

Maintenance is six jobs, not one. Most owners do the first well and meet the rest during an incident. Ranges assume 15 to 30 plugins, staging and managed hosting; a store sits at the top.

Add the hours column: 3.25 at the low end, 8 at the high. An experienced developer does it in one to two hours; this estimate is for the owner, including the remembering.

WordPress documents the update steps and the hardening baseline, both assuming staging and a rollback path. That is the part most DIY setups lack.

Scanning gets skipped because a clean scan shows nothing. It is also a common entry point: an outdated plugin or theme, which OWASP lists among its top ten risks.

What your own time actually costs

Pricing DIY at zero is the mistake. At a 10 to 100 person company, $60 to $150 an hour loaded is what a contractor or senior hire costs, not what you pay yourself on a Friday night.

Context switching is the second line. A plugin update is 20 minutes of work plus 20 of remembering where you were. Four sessions at 25 minutes of re-entry adds 1.7 hours. A failure at 2am is billed at the same rate.

At the midpoint, the monthly cost is about $370 at $60 an hour and about $930 at $150, both above the $129 plan. The range is a market assumption, not a quote.

If you have never restored a backup, you do not know whether it works. Treat that as an unknown probability, not a low one. A restore test takes 30 to 60 minutes on staging. The line items are in our guide to what WordPress maintenance costs.

The failures the hours do not cover

Time is the visible cost. The expensive part is that you own the failure, and failures do not arrive on schedule.

• An update breaks checkout on a Friday and no orders land until Monday, with a weekend-rate fix if you cannot do it yourself.
• A plugin abandoned for 14 months still runs, until its replacement has to be scoped in a week and every template rebuilt.
• A backup that cannot restore turns a bad afternoon into three days of rebuilding content, orders and settings from a dump you do not recognize.
• A hacked site noticed by a customer means cleanup plus blacklist removal, a written explanation and a breach assessment.
• A certificate that expired puts a browser warning in front of every visitor, including the ones at checkout.

None of this is certain. Plenty of DIY sites run for years without an incident. If a customer has noticed, start with the hacked-site sequence. If you cannot find how they got in, a fixed-scope security audit from $490 is cheaper than guessing.

Which site are you running?

The plan column prices hours, not risk. The store row moves toward a plan; the brochure row rarely does.

When DIY is the right answer

Stay on DIY when all five of these are true.

• The site is pages, a form and a blog. No checkout, no customer accounts, no member area.
• Your host handles PHP patches, TLS renewal and daily off-site backups, and you have restored one.
• You have staging, or can accept a short maintenance window.
• Three to four hours a month is a real block in the calendar, not a hope.
• You get some satisfaction from it. Unenjoyed maintenance is the work that gets skipped.

If that is your site, stay on DIY and spend the $129 on hosting. A plan would buy back an hour you do not need.

What a $129 care plan has to include

A care plan earns $129 when it does the work, not when it watches the site.

At Keelpost, Basic is $129 for one site: updates, weekly backups with a monthly restore check, uptime, SSL and domain monitoring, one hour of work, a monthly report and a two-business-day response. That covers four of the six jobs. Care at $249 raises the allowance to two hours, moves response to one business day and adds a monthly malware and vulnerability scan, hardening and login protection. Store Care at $449 raises the allowance to four hours and adds a four-business-hour response, daily backups, checkout monitoring and a quarterly review. Annual billing is two months free on every tier.

On a brochure site, $129 buys the loop, the restore test and the monitoring. On a store it buys the loop but not checkout monitoring. Compare the three care plans before choosing.

Four questions that separate a plan from a monitoring subscription

1. When an update breaks the site, is the fix inside the monthly hours or a change order?
2. When did you last restore a backup, and will you send the result? A date, not a policy page.
3. Who answers, and in which time zone? Keelpost's support runs 09:00–18:00 GMT+8, Monday to Friday, and is not a 24/7 SOC.
4. What is excluded, and what happens when the hours run out? Work beyond the included hours is billed at $150 per hour, approved in writing first; feature work is a separate quote.

If a vendor cannot produce a restore test date, you are buying alerts. Ask for the date in writing.

What no care plan will do

A care plan is not strategy: it will not tell you which pages to cut. It is not feature work: a template, integration or migration has its own project scope. It is not compliance: no plan here produces ISO 27001 or SOC 2 evidence, and we do not hold those certifications. And it is not a promise that nothing goes wrong. It is hours, a named responder and a written record.