WordPress Maintenance: What Actually Needs Doing, How Often, and What It Costs in the UK

What does WordPress maintenance involve, and what does it cost in the UK?

WordPress maintenance means applying core, plugin and theme updates, keeping verified off-site backups, checking security and testing that forms and checkout still work: about 30 to 60 minutes a month. In the UK you can do it yourself for £0 plus that time, pay a freelancer by the hour, or pay a care plan £30 to £150 a month (£30 to £80 for core maintenance, £80 to £150 with content changes and priority support). Check your PHP version once a year too: PHP 8.2 stops receiving security fixes on 31 December 2026, and WordPress recommends PHP 8.3 or greater.

Updated October 2026: PHP support dates checked on php.net and WordPress.org. Care plan prices are typical UK ranges.

If the site itself is the problem rather than the upkeep, a rebuilt WordPress website on a current stack removes most of this list.

The maintenance that matters (and the cadence)

The three failure patterns we see

1. The frozen site. Nobody updated anything for two years because “it works”. It does, until the contact form silently stops sending (nobody noticed for four months), or a patched vulnerability gets exploited. Frozen isn’t stable; it’s accumulating risk and an eventual big-bang rebuild bill.
2. The update gambler. Auto-updates everything, no backups, no staging. Fine for a brochure site until one plugin conflict takes the site down on a Friday night with no restore point. Updates need a rollback path; that’s what the backup discipline is for.
3. The plugin hoarder. Forty-three plugins, nine active. Each one is code someone must maintain forever; abandoned plugins are the classic breach vector. The quarterly audit rule: if you can’t say what it does, deactivate it; if nothing breaks in a month, delete it.

If the worst has already happened, our guide on what to do in the first 24 hours after a hack sets out the order to work in and the real costs.

DIY vs a care plan: the honest split

DIY costs £0 plus discipline: the tooling (managed WP hosting, or free backup/security plugins) makes the tasks easy; the failure mode is that “monthly” quietly becomes “never”. A paid care plan (£30 to £80/month for maintenance; £80 to £150 with content-change time and priority support included) buys consistency, someone to call when it breaks, and updates tested by people who see the same plugin conflict across fifty sites before it reaches yours. The economics: if your site produces enquiries worth having, one prevented week of downtime or one avoided hack cleanup (£300 to £1,000+) pays for years of plan. Our management and hosting plans bundle this with hosting itself, and what good hosting should cost is covered in website hosting cost UK.

What maintenance is not

Maintenance keeps the site healthy; it doesn’t make it better. Adding pages, improving conversion, SEO work and content are growth activities with their own budgets. A care plan that promises “SEO included” at £50/month is doing neither properly. Keep the two mentally separate: maintenance is insurance priced like insurance; growth is investment priced like investment. And if you’re paying for custom-built plugins, their upkeep is part of the deal; see plugin development costs for what ongoing compatibility work looks like.

WooCommerce raises the bar

Everything above applies double to an online shop, plus a layer of its own:

• Updates carry money risk. A plugin conflict on a brochure site is embarrassing; on a store it’s a dead checkout, and dead checkouts are silent, discovered days later as “quiet week” becomes “no orders since Tuesday”. Every WooCommerce update should be followed by a live test transaction, and larger stores should apply updates on a staging copy first.
• The payment stack has its own cadence. Payment gateways, WooCommerce core and its extensions version together; letting them drift apart is the classic source of checkout bugs. Update them as a set, not piecemeal over weeks.
• Backups must be real-time-aware. A nightly backup of a store can lose a day of orders. Stores taking regular orders need database backups at hours-not-days frequency, or a host with point-in-time recovery.
• Compliance surface: customer personal data under UK GDPR and card handling via your gateway mean access hygiene (who has admin?), TLS validity and plugin provenance are audit questions, not niceties.

Practical translation: a content site can live on the £30 to £80/month tier or disciplined DIY; a trading store belongs on the higher tier with test transactions and staging in the routine. The plan is protecting revenue per hour, not a website per month.

The monthly hour, minute by minute

“Thirty to sixty minutes a month” is easy to agree with and hard to act on. Here is that hour as an actual run sheet, in the order that minimises damage if something goes wrong:

1. Minutes 0 to 5: take a fresh backup and confirm it completed. Not the scheduled one, but a manual one, now, so the restore point is minutes old rather than hours. Check the file size looks like previous backups; a suspiciously small archive is the classic sign of a backup that has been silently failing.
2. Minutes 5 to 20: update in tranches. Least critical plugins first, then the important ones, then the theme, then core. Load the front page between tranches. If something breaks you know which tranche did it, which turns a mystery into a two-minute fix.
3. Minutes 20 to 30: walk the money paths. Submit the contact form and confirm the email arrives in the inbox it should arrive in. Click the main call to action. If there is a shop or a booking flow, complete one. Roughly half the faults found in a monthly check are silently broken forms, and they had usually been broken for weeks.
4. Minutes 30 to 40: users, logins and scan. Review the admin user list and remove anyone who has left. Check the security plugin’s log for anything odd. Confirm nobody has created an account you did not expect. The fuller hardening routine, which is mostly a one-off afternoon, is in the WordPress security guide for small businesses.
5. Minutes 40 to 50: performance and errors. Run one page-speed test and compare it against last month’s number. Plugin bloat shows up here long before customers complain, and a sudden drop usually has one identifiable cause you can still remember; what to do when the numbers slide is covered in why slow sites lose UK customers.
6. Minutes 50 to 60: write two lines in a log. Date, what was updated, anything odd. Six months of that log is what makes the next problem diagnosable, and it is what any developer inheriting the site will ask for first.

Do this on a weekday morning, never on a Friday afternoon, and never on the day of a campaign or a big quote going out.

Lost your login? Our guide to getting back into a locked WordPress admin covers six ways back in.

Premium licences: the line item nobody budgets

A maintained site usually depends on four to eight paid components, and they renew annually whether you noticed or not. When one lapses, it does not usually break; it just stops receiving updates, which is the exact condition that turns into a security incident eighteen months later.

Most small sites land somewhere between £150 and £500 a year in licences before anyone has done any work. Keep a single sheet listing each licence, its renewal date, which email account it renews to and whose card is on file. The last two are what strand people when a member of staff leaves. Where a care plan quotes suspiciously low, check whether licences are included or billed on top, because that is where the gap between advertised and actual usually lives; the broader pricing picture is in what website maintenance should cost in the UK.

When an update breaks it: the twenty-minute drill

Panic causes more damage than the fault. Work the sequence. First, stop updating anything else. Second, identify the last thing you changed, because on a site that is updated regularly the culprit is almost always the most recent action. Third, deactivate that single plugin, via the admin if you can still log in, or by renaming its folder over SFTP if you cannot, which is the standard route back into a white-screened site. Fourth, if the site returns, you have a compatibility conflict rather than a catastrophe: report it to the plugin author, keep it deactivated, and find a replacement if no fix lands within a few weeks. Fifth, only if none of that works, restore the backup you took at minute zero.

Two things make this drill survivable and both must exist before you need them: SFTP or file-manager access with credentials you can actually find, and a hosting control panel login that is not stored solely in the departed web designer’s password manager. Confirm you have both today. The other preventative measure is a staging copy: most decent managed hosting includes one-click staging, and using it turns a Friday-night emergency into a Tuesday-afternoon shrug.

The yearly jobs a monthly checklist misses

The monthly hour keeps a site patched. A handful of jobs come round only once a year, and because nobody does them often, nobody remembers them until one fails. Put these in the calendar against a fixed month:

The PHP check is the one most often skipped, because the site carries on working on an old version. WordPress recommends PHP 8.3 or greater, and the PHP supported versions page shows when each version stops receiving security fixes. Most hosts let you switch version from the control panel, but test on a staging copy first: old plugins and themes are what break, and that tells you which ones need replacing.

An expired certificate is one of the most common maintenance slips; here is how to fix the "Not secure" browser warning, usually for free.

What to check in a care plan before you sign

Ask where backups are stored and whether they are off-site from the hosting account, because a backup living on the same server as the site is not a backup. Ask for a stated restore time. Ask what is included versus billed: content edits, new pages, licence renewals, emergency work outside hours. Ask who owns the hosting and domain accounts and whether you hold the master credentials, since the most common ugly ending to these relationships is a site you cannot move. Ask whether updates are tested on staging or applied straight to live. Ask what the response time actually is, in hours, on a working day. And ask what happens at the end: what you receive on exit, and in what format.

None of that is adversarial; a good provider answers all seven in a couple of sentences each. If performance work, content changes or speed optimisation are on the same invoice as maintenance, ask for them itemised anyway; bundling makes it impossible to tell whether you are buying insurance or improvement.

WordPress maintenance in the UK: what to ask a provider

Most of what a maintenance plan does is the same anywhere, but a UK business has a few questions of its own to settle before choosing who looks after the site.

• Personal data in your backups. Contact form entries, customer accounts and orders all sit in the database, so every backup is a copy of personal data. A provider handling that data on your behalf is a processor under UK GDPR, and the ICO’s guidance explains the contract that relationship needs. Ask where backups are stored, how long they are kept and who can reach them.
• Response times in UK working hours. A plan answered overnight from another time zone may be fine for routine updates and slow for a broken checkout at 10am. Ask for the response time as a number, on a UK working day.
• VAT on the monthly fee. A VAT-registered provider adds 20% to a quoted price unless the quote says VAT is included, which turns £50 a month into £60. Luxbranding Ltd is not VAT registered, so no VAT is added: the price shown is the price you pay.

Our website management and hosting covers UK hosting, SSL, daily off-site backups kept for 30 days, malware scanning, a firewall, automatic WordPress core and plugin updates, uptime monitoring and an hour of content changes a month. It runs month to month, and every price is on the price list.

Sources & Further Reading

• Updating WordPress, WordPress.org
• OWASP Top Ten, OWASP Foundation
• Small Business Cyber Security Guide, NCSC