WordPress Maintenance: What Actually Needs Doing, How Often, and What It Costs in the UK

Quick answer

A WordPress site needs about 30–60 minutes of genuine attention a month: core/plugin/theme updates applied promptly, backups verified (not just assumed), a security scan, and a quick front-end check that forms and checkout still work. Done consistently, WordPress is a reliable workhorse; neglected for six months, it becomes the statistic — the overwhelming majority of hacked WordPress sites were running outdated components with known vulnerabilities. UK care plans run £30–£150/month; DIY is perfectly viable if you’ll actually do it.

The maintenance that matters (and the cadence)

The three failure patterns we see

1. The frozen site. Nobody updated anything for two years because “it works”. It does — until the contact form silently stops sending (nobody noticed for four months), or a patched vulnerability gets exploited. Frozen isn’t stable; it’s accumulating risk and an eventual big-bang rebuild bill.
2. The update gambler. Auto-updates everything, no backups, no staging. Fine for a brochure site until one plugin conflict takes the site down on a Friday night with no restore point. Updates need a rollback path — that’s what the backup discipline is for.
3. The plugin hoarder. Forty-three plugins, nine active. Each one is code someone must maintain forever; abandoned plugins are the classic breach vector. The quarterly audit rule: if you can’t say what it does, deactivate it; if nothing breaks in a month, delete it.

DIY vs a care plan: the honest split

DIY costs £0 plus discipline — the tooling (managed WP hosting, or free backup/security plugins) makes the tasks easy; the failure mode is that “monthly” quietly becomes “never”. A paid care plan (£30–£80/month for maintenance; £80–£150 with content-change time and priority support included) buys consistency, someone to call when it breaks, and updates tested by people who see the same plugin conflict across fifty sites before it reaches yours. The economics: if your site produces enquiries worth having, one prevented week of downtime or one avoided hack cleanup (£300–£1,000+) pays for years of plan. Our management and hosting plans bundle this with hosting itself — and what good hosting should cost is covered in website hosting cost UK.

What maintenance is not

Maintenance keeps the site healthy; it doesn’t make it better. Adding pages, improving conversion, SEO work and content are growth activities with their own budgets — a care plan that promises “SEO included” at £50/month is doing neither properly. Keep the two mentally separate: maintenance is insurance priced like insurance; growth is investment priced like investment. And if you’re paying for custom-built plugins, their upkeep is part of the deal — see plugin development costs for what ongoing compatibility work looks like.

WooCommerce raises the bar

Everything above applies double to an online shop, plus a layer of its own:

• Updates carry money risk. A plugin conflict on a brochure site is embarrassing; on a store it’s a dead checkout — and dead checkouts are silent, discovered days later as “quiet week” becomes “no orders since Tuesday”. Every WooCommerce update should be followed by a live test transaction, and larger stores should apply updates on a staging copy first.
• The payment stack has its own cadence. Payment gateways, WooCommerce core and its extensions version together; letting them drift apart is the classic source of checkout bugs. Update them as a set, not piecemeal over weeks.
• Backups must be real-time-aware. A nightly backup of a store can lose a day of orders. Stores taking regular orders need database backups at hours-not-days frequency, or a host with point-in-time recovery.
• Compliance surface: customer personal data under UK GDPR and card handling via your gateway mean access hygiene (who has admin?), TLS validity and plugin provenance are audit questions, not niceties.

Practical translation: a content site can live on the £30–£80/month tier or disciplined DIY; a trading store belongs on the higher tier with test transactions and staging in the routine — the plan is protecting revenue per hour, not a website per month.

The monthly hour, minute by minute

“Thirty to sixty minutes a month” is easy to agree with and hard to act on. Here is that hour as an actual run sheet, in the order that minimises damage if something goes wrong:

1. Minutes 0–5: take a fresh backup and confirm it completed. Not the scheduled one — a manual one, now, so the restore point is minutes old rather than hours. Check the file size looks like previous backups; a suspiciously small archive is the classic sign of a backup that has been silently failing.
2. Minutes 5–20: update in tranches. Least critical plugins first, then the important ones, then the theme, then core. Load the front page between tranches. If something breaks you know which tranche did it, which turns a mystery into a two-minute fix.
3. Minutes 20–30: walk the money paths. Submit the contact form and confirm the email arrives in the inbox it should arrive in. Click the main call to action. If there is a shop or a booking flow, complete one. Roughly half the faults found in a monthly check are silently broken forms, and they had usually been broken for weeks.
4. Minutes 30–40: users, logins and scan. Review the admin user list and remove anyone who has left. Check the security plugin’s log for anything odd. Confirm nobody has created an account you did not expect — the fuller hardening routine, which is mostly a one-off afternoon, is in the WordPress security guide for small businesses.
5. Minutes 40–50: performance and errors. Run one page-speed test and compare it against last month’s number. Plugin bloat shows up here long before customers complain, and a sudden drop usually has one identifiable cause you can still remember; what to do when the numbers slide is covered in why slow sites lose UK customers.
6. Minutes 50–60: write two lines in a log. Date, what was updated, anything odd. Six months of that log is what makes the next problem diagnosable, and it is what any developer inheriting the site will ask for first.

Do this on a weekday morning, never on a Friday afternoon, and never on the day of a campaign or a big quote going out.

Premium licences: the line item nobody budgets

A maintained site usually depends on four to eight paid components, and they renew annually whether you noticed or not. When one lapses, it does not usually break — it just stops receiving updates, which is the exact condition that turns into a security incident eighteen months later.

Most small sites land somewhere between £150 and £500 a year in licences before anyone has done any work. Keep a single sheet listing each licence, its renewal date, which email account it renews to and whose card is on file — the last two are what strand people when a member of staff leaves. Where a care plan quotes suspiciously low, check whether licences are included or billed on top, because that is where the gap between advertised and actual usually lives; the broader pricing picture is in what website maintenance should cost in the UK.

When an update breaks it: the twenty-minute drill

Panic causes more damage than the fault. Work the sequence. First, stop updating anything else. Second, identify the last thing you changed, because on a site that is updated regularly the culprit is almost always the most recent action. Third, deactivate that single plugin — via the admin if you can still log in, or by renaming its folder over SFTP if you cannot, which is the standard route back into a white-screened site. Fourth, if the site returns, you have a compatibility conflict rather than a catastrophe: report it to the plugin author, keep it deactivated, and find a replacement if no fix lands within a few weeks. Fifth, only if none of that works, restore the backup you took at minute zero.

Two things make this drill survivable and both must exist before you need them: SFTP or file-manager access with credentials you can actually find, and a hosting control panel login that is not stored solely in the departed web designer’s password manager. Confirm you have both today. The other preventative measure is a staging copy — most decent managed hosting includes one-click staging, and using it turns a Friday-night emergency into a Tuesday-afternoon shrug.

What to check in a care plan before you sign

Ask where backups are stored and whether they are off-site from the hosting account, because a backup living on the same server as the site is not a backup. Ask for a stated restore time. Ask what is included versus billed — content edits, new pages, licence renewals, emergency work outside hours. Ask who owns the hosting and domain accounts and whether you hold the master credentials, since the most common ugly ending to these relationships is a site you cannot move. Ask whether updates are tested on staging or applied straight to live. Ask what the response time actually is, in hours, on a working day. And ask what happens at the end: what you receive on exit, and in what format.

None of that is adversarial; a good provider answers all seven in a couple of sentences each. If performance work, content changes or speed optimisation are on the same invoice as maintenance, ask for them itemised anyway — bundling makes it impossible to tell whether you are buying insurance or improvement.

Sources & Further Reading

• Updating WordPress — WordPress.org
• OWASP Top Ten — OWASP Foundation
• Small Business Cyber Security Guide — NCSC