What WordPress maintenance actually costs

Why the same site gets a $20 quote and a $500 quote

The two quotes are rarely the same service at different margins. At $20 a month you buy a subscription with a support queue: automated updates, a cloud backup, an uptime ping. At $500 you buy scheduled human time, staging, a tested restore, a named person, and a response commitment that costs the vendor when missed.

Most buyers land in the middle, where the feature list is least useful. Three lines decide whether a $150 plan is good: who does the work, what is tested before production, and what happens after a failed restore. They are cheap to promise and expensive to deliver, so they go first when prices are cut.

What a monthly retainer actually pays for

A retainer is not a block of hours sold at an hourly rate. It is a share of a maintenance window, a queue position and a set of tools. These are planning ranges for one brochure site, not survey data.

The last column totals more than a small-studio plan. That gap is not a trick: tools are shared, updates are batched, and the plan caps your hours.

A restore test is the only proof a backup works, which is why WordPress update documentation treats a backup as part of updating; without a dated test you own a file, not a recovery plan.

What the three price tiers buy

$20–$50: a plugin subscription

Automated updates, off-site backup, uptime alerts and a ticket queue. No staging, no restore test, no named engineer, and a scan result you interpret yourself. The OWASP Top Ten covers what a scan will not find. Fine for a brochure site; thin for a store.

$100–$250: a small studio or specialist

A named person, staging before updates, a monthly restore test, scans someone reviews, a short report, capped hours (usually one to three) and a business-day response. Most teams should start here.

$400 and up: multi-asset or revenue-critical

Several sites or a store, daily backups, checkout monitoring, four-business-hour response, quarterly review and sometimes security-questionnaire evidence. You pay for coverage and documentation, not more plugins. Not 24/7 cover unless contracted.

What a very low monthly fee hides

Two things go missing first, and neither appears on a feature list.

The tested restore. Backups are easy to show and cheap to store. Restoring one to staging, checking the database, uploads and checkout, then writing down the date is an hour with no visible feature. Ask for last month's restore date; a plan without one has a backup, not a recovery plan. CISA's StopRansomware guidance treats tested, offline backups as a recovery control.

A named human. At $20 the person answering the ticket has probably never opened your site. They follow a script, escalate when it runs out, and the clock restarts. Accountability is what automation cannot supply.

The third cost arrives after an incident. Cheap plans cover monitoring but not removal, so a compromised site becomes a separate clean-up quote. Compare the annual fee plus one incident.

Four ways to cover the work, compared

The hour-by-hour comparison for the first row is in DIY WordPress maintenance vs a care plan. This table is about who carries the risk.

The middle of the table is where the money goes. A care plan and an agency retainer run the same updates; the difference is coverage, evidence and who answers on Monday.

What changes the price

Seven variables explain most of the gap between quotes for similar sites.

• Number of assets. Every site adds an update window, backup, scan review and report line. As a planning assumption, a second site adds roughly 40–60% rather than 100%, because tools are shared.
• WooCommerce or brochure site. A store adds checkout testing, payment plugin compatibility and order data. Updates take longer and a failed test costs revenue. The WooCommerce security checklist shows the extra surface.
• Compliance pressure. A SOC 2 or ISO request turns care into evidence collection: access lists, patch records, restore dates. That is billable work, and no plan should imply certification.
• Page builder. Elementor, Divi and WPBakery updates can break layouts per template. More templates means more post-update checking: hours, not a license.
• Hosting quality. A managed host with staging, object cache and backups removes firefighting. A cheap shared host adds it and may block the tests you need.
• Legacy plugins. An abandoned plugin is a permanent surcharge until replaced. A quote that maintains it without a removal plan will rise after the first incident.
• Number of environments. Production plus staging is the minimum. A QA, multilingual or wholesale environment adds sync work and another place for changes.

Five questions to ask before you sign

Send these with the quote; a good vendor answers in writing.

1. Can you show the date of my last restore test? Worry if the answer is nightly backups. A backup is not a restore. Without a dated test, nobody knows how long recovery takes.
2. Who does the work, and who do I call when it breaks? Worry if the answer is a department, a portal or a salesperson. You want a name, timezone and escalation path.
3. What sits outside the monthly fee? Worry if removal, emergency response or migrations are quoted separately with no rates. Ask for the rate card and who approves work.
4. What does the response time cover? Worry if same day has no business hours, timezone or definition of response. An acknowledgement is not a fix, and 24/7 is a staffing claim.
5. What happens if the site is compromised on your watch? Worry if the answer is that it will not happen, or that it is not covered. Ask what gets isolated first, what clean-up costs and what the report covers.

Where Keelpost's plans sit, and what they leave out

Care starts at $129 a month for one site, one hour and a two-business-day response. The $249 plan doubles the hours and moves response to one business day; the $449 plan is for a store with checkout, with four hours and a four-business-hour response. Updates, backups, monitoring and a monthly report are included. Compare the care plans and their hour limits.

Support runs 09:00–18:00 GMT+8, Monday to Friday, and we are not a 24/7 SOC. If you need out-of-hours incident cover, we will say no. We also do not hold ISO 27001 or SOC 2 and do not sell certification. What monthly care covers is written out in full.

The plans exclude unlimited edits, malware clean-up (a separate fixed-scope job from $750) and any promise of a specific security outcome. Those exclusions are why the price is fixed. If you want a review first, the one-off security audit starts at $490.