How Much Should Website Maintenance Cost a Small Business?

What does website maintenance actually include?

Maintenance is everything that keeps the site you already paid for working, safe and findable. It is not a redesign and it is not marketing. When we price it, we break it into five buckets.

Hosting. The server or platform the site lives on. On Webflow or Squarespace the platform fee covers this. On WordPress you rent it from a host.

Software updates. WordPress core, the theme, every plugin, and the PHP version underneath. Each one ships updates on its own schedule, and any one of them can break the others.

Security. A firewall, malware scanning, and someone who will clean the site if it gets hacked. This is the bucket that grows fastest on WordPress.

Backups and recovery. Daily copies stored somewhere other than the server, and a tested way to restore them.

Small content changes. New service area pages, updated pricing, a photo swap, a holiday hours banner.

A cheap "care plan" often covers only the first two and calls it maintenance. Ask which of the five buckets you are getting before you compare quotes. If nobody on the plan is named as responsible for cleanup after a hack, the security bucket is empty, whatever the sales page says.

Why does WordPress maintenance cost more than Webflow or Squarespace?

Because on a hosted platform the vendor does the patching, and on WordPress you do. That one difference drives most of the cost gap.

The numbers on plugin risk are not small. Patchstack, the company that coordinates vulnerability reports for more than 1,000 WordPress plugin vendors, counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, a 42% increase over 2024, in its State of WordPress Security in 2026 report. That works out to about 31 new vulnerabilities a day (11,334 divided by 365). The same report found 91% of them were in plugins and 9% in themes. WordPress core itself was rarely the problem.

The part that should change how you budget: Patchstack found 46% of those vulnerabilities did not have a patch available when they were publicly disclosed. So "just keep everything updated" does not fully protect you. Sometimes there is no update to install yet, and the fix is removing or replacing the plugin.

On Webflow, the platform handles its own code and hosting, so the vulnerability list you personally have to track is close to empty. You are paying for that in the platform fee and in less flexibility. We have written about the trade-off in more depth in the hidden bill behind WordPress plugin security.

What is the PHP 8.2 deadline, and does it affect my site?

PHP is the programming language WordPress runs on. Each version gets two years of active support and then a period of security-only fixes, after which the PHP project stops patching it entirely.

According to the PHP project's own supported versions page, PHP 8.2 gets security support until December 31, 2026. PHP 8.3 is covered until December 31, 2027, PHP 8.4 until December 31, 2028, and PHP 8.5 until December 31, 2029. Versions older than 8.2 are no longer on the supported list at all.

Now look at what WordPress sites are actually running. The WordPress.org statistics page, checked in November 2026, shows 23.22% of sites on PHP 8.2 and another 31.39% on versions older than that (8.1 at 9.46%, 8.0 at 3.46%, 7.4 at 14.98%, and smaller slices of 7.3, 7.2, 7.1 and 7.0). Add those together and 54.61% of WordPress sites will be running PHP with no security support from the PHP project on January 1, 2027.

To check yours, log into WordPress and open Tools, then Site Health, then the Info tab. The Server section lists the PHP version. If it says 8.2 or lower, put this on your list for November or December.

The upgrade itself is usually a dropdown in your hosting control panel. The cost is in testing. Older plugins and custom themes can throw errors on a newer PHP version, and the time to find that out is on a staging copy, not on your live site during a busy week.

What do the line items cost in 2026?

Here are real published prices we checked this week, so you can build your own budget instead of trusting a care-plan package. All of these are the vendors' own listed prices as of November 2026 and they change often.

Sources: Webflow pricing, WP Engine plans, Kinsta pricing, Sucuri plans and the Bureau of Labor Statistics. Check each tier's features yourself before you buy; plan names and limits move around.

A quick worked example. A WordPress site on WP Engine Essential ($28) with Sucuri Basic Platform ($19.08 a month) is $47.08 a month before anyone touches it. Add two hours of update checks and fixes a month, valued at the BLS median wage of $47.85 an hour, and you are at $142.78. That wage figure is what an employee earns, not what a freelancer or agency bills, so a real invoice will be higher. We could not find a reliable published figure for typical Phoenix-area maintenance rates, so we are not going to invent one.

How fast do hackers move once a plugin flaw is public?

Faster than a monthly care plan checks in. Patchstack's 2026 report puts the median time to mass exploitation for heavily exploited vulnerabilities at 5 hours, and found that roughly half of high-impact vulnerabilities get exploited within 24 hours.

Think about what that means for a typical "we update your plugins once a month" plan. If a serious flaw in one of your plugins goes public on the 3rd and your update window is the 28th, you are exposed for more than three weeks against attackers who need hours. That is the gap a monthly plan cannot close by itself.

This is why we push owners toward fewer plugins rather than better update schedules. Every plugin you remove is one less thing on the 31-a-day list. A contact form, an SEO plugin, a caching plugin and a backup tool is a reasonable WordPress setup. Twenty-five plugins, half of them installed by a designer who left in 2022, is a liability you are paying to maintain.

A web application firewall or virtual patching service helps here because it can block an exploit before the plugin vendor ships a fix. Some managed hosts include one; some security vendors sell it separately. Ask your host directly whether their firewall rules cover WordPress plugin vulnerabilities, and get the answer in writing.

What does a hacked site cost a business that runs Google Ads?

More than the cleanup fee. If you run ads, a compromised site can switch off your lead flow.

Google's Compromised sites policy says ads will be disapproved for destinations that are "hijacked and hacked," and one of its listed examples is "operating a website using a content management system with known security vulnerabilities, where it has been exploited." In plain terms: an out-of-date WordPress install that gets hacked can get your ads pulled.

On the organic side, Google's Search Central documentation on malware explains that suspected files show up in the Security Issues report in Search Console, and that once the site is cleaned and follows the guidelines you request a review from that same report.

Here is the arithmetic that matters to an HVAC or plumbing owner. If your ads normally produce 10 booked calls a week and they are disapproved for six days while you clean up and wait on review, you lost a week of booked calls in your busiest season, plus whatever the cleanup cost. The $229 to $549 a year for a cleanup plan looks different once you put it next to that. If ads are a big part of your pipeline, our Google Ads agent watches for disapprovals so you hear about them the same day, not when the phone goes quiet.

Should I pay a monthly care plan or pay by the hour?

It depends on how often you change the site and what it is built on.

Pay monthly if you are on WordPress with more than a handful of plugins, if you run Google Ads to the site, or if the site takes bookings or payments. In those cases the value is someone watching between updates, and an hourly arrangement means nobody is watching until you call.

Pay by the hour, or not at all, if you are on a hosted platform and change the site a few times a year. Webflow or Squarespace already handles patching and hosting, so a $200-a-month care plan on top of that is mostly paying for edits you could batch into one or two small invoices a year.

Either way, read the contract for three things. First, who owns the site, domain and hosting account, which we covered in who owns your website when you leave your web designer. Second, whether hack cleanup is included or billed extra. Third, how many hours of content changes are included and what happens to unused hours. Plans that roll nothing over are common, and owners routinely pay for hours that never get used.

Can I do website maintenance myself?

Some of it, yes, and you should know how even if you hire it out.

The safe do-it-yourself list on WordPress: check Site Health once a month, confirm backups are running and stored off the server, delete plugins you do not use, and keep your admin users to people who still work for you. On a hosted platform: update your hours, photos and service pages yourself. None of that needs a developer.

What we would not do ourselves as an owner: PHP upgrades without a staging copy, major plugin updates on a site that takes bookings, or malware cleanup. Cleanup is easy to do halfway, and a half-cleaned site is still a hacked site. Owners rarely have the tools to tell the difference.

The honest test is your time. If an hour of your day is worth more than an hour of a developer's, and for most owners running crews it is, hand off the technical work and keep the content updates.

Google's Search Central team made a short overview of how hacked sites happen and how owners usually find out, and it is still the clearest plain-English explanation we have found even though it dates from 2013. Watch the first few minutes for the part about vulnerable plugins. Credit: Google Search Central on YouTube.

What we would do

This is our opinion, not an industry standard.

If you are on WordPress and your PHP version is 8.2 or lower, book the upgrade for November. Have someone clone the site to staging, switch staging to PHP 8.3 or 8.4, click through every page and form, then switch production. That is a few hours of work, not a rebuild. Doing it before December 31 means you are not one of the 54.61% running unsupported PHP on New Year's Day.

While you are in there, cut plugins. If a plugin has not been updated in a year, or you cannot say what it does, remove it on staging and see what breaks. Usually nothing does.

Buy cleanup coverage separately from your host unless your host's contract explicitly includes malware removal with a response time. Something like Sucuri's $229-a-year tier is cheap insurance next to a week of disapproved ads.

For a WordPress site that runs ads or takes bookings, we think $150 to $400 a month is a fair range for real maintenance with weekly checks, a firewall and included cleanup. Under $100 a month on WordPress, ask what is being skipped. Over $400 for a ten-page service site, ask what you are getting that the line items above do not cover.

When not to buy a care plan from anyone, including us: if your site is on Webflow or Squarespace, you change it twice a year, and you do not run ads to it. Pay the platform fee, keep a list of edits, and pay for a couple of hours when the list gets long. You can see what we charge on our pricing page, and if you want a second opinion on your current setup, our free audit checks your PHP version, plugin count and hosting in one pass.

If your WordPress site is old and heavy, run the numbers on moving it instead of maintaining it. Three years of $250-a-month maintenance is $9,000. For some service businesses a rebuild on a platform that handles its own patching costs less than that over the same period. Our website services page lays out what that involves.

Questions owners ask

How much should website maintenance cost per month for a small business?

In our view, about $50 to $100 a month for a hosted-platform site like Webflow that rarely changes, and $150 to $400 a month for a WordPress site with real security monitoring and update testing. Platform fees alone start at $15 a month billed yearly on Webflow and $28 a month on WP Engine's Essential plan, as listed in November 2026. Labor is the rest.

What happens when PHP 8.2 reaches end of life?

After December 31, 2026, the PHP project stops releasing security fixes for PHP 8.2, according to php.net. Your site keeps working, but any new security flaw found in that version will not be patched. The fix is upgrading to PHP 8.3 or newer after testing your plugins and theme on a staging copy.

How do I check which PHP version my WordPress site uses?

In your WordPress dashboard, go to Tools, then Site Health, then the Info tab, and open the Server section. It lists your PHP version. Your hosting control panel shows it too, and that is usually where you change it.

Is a WordPress care plan worth it?

For a site that runs Google Ads or takes bookings, usually yes, because Patchstack found heavily exploited vulnerabilities reach mass exploitation in a median of 5 hours and 46% had no patch at disclosure. For a simple site on Webflow or Squarespace that changes a few times a year, usually no. Pay hourly for edits instead.

Can a hacked website get my Google Ads disapproved?

Yes. Google's Compromised sites policy disapproves ads that point to hijacked or hacked destinations, and it names an exploited content management system with known vulnerabilities as an example. You have to clean the site before ads will run again.

Does Webflow or Squarespace need maintenance?

Much less than WordPress. The platform handles hosting and its own software patching, so your maintenance is mostly content updates, checking forms still deliver, and keeping the domain and billing current. That is why we would skip a monthly care plan for most hosted-platform sites.

Sources

• Patchstack: State of WordPress Security in 2026 (2026)
• PHP.net: Supported Versions (2026)
• WordPress.org: Statistics, PHP versions in use (2026)
• Google Ads: Compromised sites policy (2026)
• Google Search Central: Malware and Unwanted Software Overview (2026)
• Webflow: Plans and pricing (2026)
• WP Engine: Plans and pricing (2026)
• Kinsta: WordPress hosting plans (2026)
• Sucuri: Website Security Platform pricing (2026)
• U.S. Bureau of Labor Statistics: Web Developers and Digital Designers, Occupational Outlook Handbook (2026)