WordPress Maintenance Plans: What They Cover and What They Cost
Steven Dey 6 min read Updated 22 July 2026 
A WordPress maintenance plan is a monthly service that keeps the software your site runs on updated, backed up, monitored and repaired when it breaks. In Australia they typically run between $70 and $250 a month depending on how often that work happens.
That is the short answer. The longer answer is that plans at those two ends of the range are not the same product, and most comparison pages will not tell you what separates them, because the difference is unglamorous.
What is actually in a plan
Strip away the marketing and every legitimate maintenance plan does five things.
Updates. WordPress core, plus themes and plugins. This is the bulk of the work and the bulk of the risk, because an update can break a site as easily as a missing update can expose one.
Offsite backups. Copies of files and database, stored somewhere that is not the same server. A backup on the same machine as the site is not a backup, it is a second copy of the same single point of failure.
Security monitoring. Scanning for malware and unexpected file changes, plus watching for the specific vulnerabilities disclosed against the plugins you happen to run.
Uptime monitoring. Something checking the site is actually responding, on an interval, and telling a human when it is not.
Support time. A defined allowance of hands-on work for the things automation cannot do.
If a plan does not clearly include all five, you are buying something narrower than a maintenance plan.
The axis that actually separates plans: frequency
Here is the thing the comparison pages skip. The features list is nearly identical across price tiers. What changes is how often each thing happens, and that single variable is what you are paying for.
Take our own tiers as a worked example:
| Essential $70 | Professional $150 | Executive $230 | |
|---|---|---|---|
| Updates | Monthly | Weekly | Daily |
| Offsite backups | Monthly | Weekly | Daily |
| Security monitoring | Weekly | Daily | Real time |
| Uptime checks | Every 30 min | Every 30 min | Every 2 min |
| Support time | Discounted rate | 30 min included | 60 min included |
Read that as exposure windows rather than features.
On monthly updates, a vulnerability disclosed the day after your update runs sits unpatched on your site for up to 29 days. Attackers scan for newly disclosed WordPress vulnerabilities within hours of publication, because the disclosure itself tells them exactly what to look for. Monthly is fine for a brochure site nobody is specifically targeting. It is not fine for a site taking payments.
Backup frequency is the same logic pointed at a different risk. Monthly backups mean that a compromise discovered today could cost you up to a month of orders, form submissions and content. The question is not whether you have backups, it is how much work you are willing to redo.
Uptime checks are where the number sounds trivial and is not. A 30 minute interval means an outage can run 29 minutes before anyone knows. A 2 minute interval catches it before most of your customers do.
So the honest way to choose a tier is to work out what an exposure window costs you, not to compare feature lists. A site that generates nothing overnight can absorb a lot of window. A store cannot.
What maintenance plans do not cover
This is the part that causes the arguments, so it is worth being blunt about it.
A maintenance plan keeps the site you have working. It does not change the site you have. That means these are normally excluded, by us and by most reputable providers:
- Design work. New graphics, layout changes, brand assets.
- Copywriting. Writing or rewriting your content.
- SEO campaigns. Technical fixes that arise from maintenance are in scope. Ongoing keyword and content strategy is a different service.
- New features. Building a booking system is a project, not maintenance.
- Third party licence fees. Premium plugins and themes bill separately. A plan covers keeping them updated, not paying for them.
Included support time is for small changes and fixes, and it is genuinely capped. Thirty minutes is enough to swap out a phone number, fix a broken form or troubleshoot a plugin conflict. It is not enough to build a new page, and any provider implying otherwise is either not counting or about to invoice you.
The reason to state this plainly is that vague scope is where maintenance relationships fail. Both sides are happier when the boundary is written down.
Maintenance, hosting and support are three different things
People use these interchangeably and then get surprised by what they did not buy.
Hosting is the server your site runs on. It is infrastructure. Good hosting includes server level security and isolation, but it does not touch your WordPress installation.
Maintenance is the ongoing care of the WordPress software itself. Updates, backups, monitoring. It sits on top of hosting and is a separate service, though most providers bundle them.
Support is a human doing a specific thing you asked for. Maintenance plans include some. Beyond the allowance it is billed.
You can buy all three from one provider, and we would argue you should, because when a site goes down at 2am the last thing you want is three companies each explaining it is the other one’s problem. But they are separate services and should be priced separately so you can see what you are paying for.
What we find when we take over a neglected site
We onboard sites that have been running without maintenance, and the findings are consistent enough to be predictable.
Plugins several major versions behind, at least one with a publicly disclosed vulnerability. Backups configured years ago to a destination that stopped accepting them, failing silently since. Abandoned plugins still active, no longer maintained by their author, quietly unpatchable. Admin accounts belonging to contractors who finished up long ago. And frequently a site that has already been compromised, running spam pages the owner has never seen because they only ever look at the homepage.
None of this is exotic. It is what accumulates when nobody is looking, and it is why “the site seems fine” is not evidence of anything. Most WordPress compromises are not defacements. They are quiet, because a site that still looks normal keeps working as a spam host for longer.
Do you actually need one?
Not everyone does. Be honest about which you are.
You probably do not need a plan if your site is a static brochure, you are comfortable running updates yourself, you actually do it, and you have tested that your backups restore. That last clause disqualifies most people who think they qualify.
You probably do if the site generates revenue, holds customer data, or you have nobody in-house who will notice a failed update. The tell is simple: if you cannot say when your last backup was tested, you are not maintaining the site, you are hoping.
What it costs, in context
At $70 a month, a maintenance plan is roughly the cost of a phone bill. A single malware cleanup, in Australia, typically runs several hundred dollars and comes with days of downtime and, if you handle customer data, a disclosure conversation.
The plan is not insurance against a site ever having a problem. It is the difference between problems being caught early and cheaply, or late and expensively. Most of what maintenance prevents is invisible, which is exactly why it is easy to cancel and hard to value until the month you need it.