How much does website maintenance cost in the UK? (2026 guide)

Website maintenance costs at a glance

Maintenance cost tracks what your site does for the business - page count barely matters. Four bands cover the UK market in 2026, the same bands we published in our care plans guide, cross-checked here against every UK page ranking for this question.

Two costs sit outside these bands in most quotes: hosting, which the majority of care plans exclude (£15 to £40 a month for something decent), and premium plugin licences on a WordPress site (typically £200 to £600 a year). Ask about both before comparing anything - the hidden-extras section covers what else gets left out.

Why quotes vary so much: three products share one name

The single biggest reason maintenance quotes look incomparable is that "maintenance" describes three different products. Until you know which one a quote is for, the number tells you nothing.

The trap is the word "managed". A managed hosting plan manages the server - if a plugin update breaks your checkout, the host's responsibility ends at the server and the fix is yours. Hosting companies tend to imply their plans replace maintenance; maintenance specialists point out they don't. Both are marketing their side of a real gap: managed doesn't mean maintained, and plenty of UK businesses pay for one believing they've bought the other.

The gap is also why some providers - we're one of them - bundle the two, so the team that runs the server is the team that maintains the site and there's nobody to pass the blame to. More on how that changes the arithmetic below.

The 2026 UK price ladder: what each rung actually buys

Here's the whole UK market on one ladder, with named providers and July-2026 prices on every rung. The pages that rank for this question stop explaining at about £150 a month; the rungs above that are where the interesting decisions live.

The ladder starts at £0 - DIY, which is free until you cost the £38-a-month tool stack and your own hours honestly (the DIY section does those sums). Above it sit four paid rungs.

£15-£30 - automation-only

Software applies updates to your live site and an alert lands in an inbox if something looks wrong. Nobody tests anything first; nobody checks the site afterwards - at this price, an outage alert reaches an unmanned inbox and the site stays down until someone starts work. Fine for a hobby site; a false economy for a site that earns.

£40-£150 - proper human maintenance

The band most UK business sites should be in. Updates tested before they go live, daily off-site backups that get restore-checked, malware scanning with a human response and a monthly report a person actually wrote. Published UK examples (July 2026, ex VAT): ThriveWP £49-£89, WP Care Pros £49-£149, Gilmour £40-£99, WPmaintain £79-£99, EJK Web Solutions £90-£149, Pixelish £49-£99.

£130-£400 - partnership and retainer tier

Everything above, plus retained development hours, performance work, priority response and someone who knows your roadmap. This is where WooCommerce stores belong, because checkout-breaking updates need testing against payments, stock and shipping extensions every time. Published examples: Toast SiteCare to £240, feelingpeaky £95-£245, EJK's top plan £350, WP Care Pros' Partner plan £379.

£400-£1.5k+ - engineering-led

The rung nobody explains, so let's be the first. The money buys engineering discipline: a staging pipeline where every change is rehearsed and regression-tested before production, version control and code review on anything custom, monitoring that pages an engineer rather than emailing an inbox, backups that are restore-tested on a schedule, a contractual response SLA and named people who know your codebase. That's what business-critical means in practice: the site is treated like the software asset it is.

It's also the least transparent corner of the market. Of six leading UK enterprise WordPress agencies we checked in July 2026, not one publishes a retainer price. The published evidence that does exist puts the band beyond doubt: ALT Agency in Birmingham lists £800 to £1.2k+ a month for ecommerce and high-traffic retainers, Codeable's expert maintenance plans reach roughly £740+ a month at their enterprise tier - with staging and regression testing on every tier, even the entry one - and WordPress VIP, the enterprise platform from WordPress's parent company, starts at around £1.5k a month. Our own engineering-led tier is £1,295, published below like everything else we charge.

What should you be paying? Check in under a minute

Four questions, and you'll get the band the UK market would quote you, what that price must include, what doing it yourself really costs and where our own plans land - real published prices, with no estimate gated behind a sales call. No ranking page for this question has anything interactive; we checked.

The bands behind the checker

What maintenance includes at each price

Feature grids hide the thing that matters: whether a human tests changes before they hit your live site. Here's what each band genuinely buys - and what it quietly doesn't.

The automated tier deserves its own sentence, because it's where most disappointment is bought: "updates and backups" on a £20 plan and a £90 plan are the same words for different products. One is software applying updates to your live site and hoping; the other is a person rehearsing the change somewhere safe first. If a provider can't tell you where updates get tested, you have your answer.

Why the £20 plan can cost you more

The arithmetic makes this case on its own. Price the tools a proper maintenance service runs for one site, at ordinary retail prices, and the floor appears by itself.

Providers pay less per site than you would - multi-site platforms amortise tooling to a few pounds per site - which is how honest £25 to £40 plans exist at all. But the human layer doesn't amortise: the margin between a plan's price and its tooling cost is the time somebody can afford to spend actually looking at your site. On a £19 plan that margin rounds to zero, which is why what you get is automation with a logo. UK providers who publish their workings say the same thing from the other side: one warns outright that "from £29 a month" advertised prices double or triple for any store or custom-theme site.

What are you buying that time against? In 2025, 11,334 new WordPress vulnerabilities were disclosed - up 42% on the year before - and 91% of them were in plugins, exactly the layer a £20 plan updates blind, with 46% still unpatched at the moment they were made public (Patchstack, 2026).

Exploitation is industrialised: the median gap between a vulnerability being disclosed and mass exploitation attempts is about five hours, and Wordfence's network alone blocked 13.8 billion password-guessing attacks in the last quarter of 2025. Sucuri's remediation team found 39.1% of infected sites were running outdated software at the point of compromise. Out of date and unwatched is precisely the state cheap maintenance leaves you in.

Then comes the bill. Specialist cleanup and restoration runs £450 to £800+ per incident at 2026 market rates, and security firms charge £180 to £430 a year for unlimited-cleanup cover.

The wider damage is measured too: the median cyber breach costs a UK micro or small business £800 in direct costs alone, and the worst 5% exceed £15,000 (Cyber Security Breaches Survey 2025/26). Downtime piles on top - we've covered what an hour of downtime costs a UK business separately. A year of the £90 plan costs about £1.1k; one skipped-testing incident routinely costs more.

WordPress specifically - and what custom-built sites cost instead

WordPress runs 41.2% of all websites and 59.1% of sites built on a CMS (content management system - the editing software behind most business websites), so most UK maintenance quotes are WordPress quotes. Its economics have two quirks worth budgeting for - and if your site is custom-built, the model changes entirely.

First, the treadmill is faster than it looks. WordPress shipped two major releases in the last eight months (6.9 in December 2025, 7.0 in May 2026, with 7.1 due in August), and officially supports only the latest version - security fixes for older branches are a courtesy.

Underneath, PHP versions expire annually: 8.1 reached end of life in December 2025, and 8.2's security support ends this December. A site nobody maintains isn't standing still; the ground under it is moving.

Second, the plugin economy is a real budget line: a typical UK business site carries three to eight paid plugins at £200 to £600 a year in licences, which good plans manage for you and cheap plans quietly leave in your name to lapse.

WooCommerce adds an overlay on both: more extensions to licence, and a checkout that must be tested against every update because payments, stock and shipping integrations are where conflicts land. That's why every credible provider prices store care a band higher - £150 to £400 a month against £75 to £150 for a comparable non-trading site - and why "we lose revenue when it breaks" is the question that should move you up the ladder.

Beyond WordPress: bespoke, .NET and headless sites

None of the pages ranking for this question mentions sites that aren't WordPress, so here's the missing paragraph. A custom-built site swaps the plugin treadmill for a dependency one: framework patches, package upgrades, security releases and hosting platform changes, applied by developers who understand the codebase - there's no marketplace of £49 care plans because no two codebases are alike. Budget it as a small retainer with the team that built it (or one like us that inherits estates): the top of your site-type band and up, with the same non-negotiables - version control, staging, tested deployments and a response commitment in writing. This is our home turf as a software consultancy; it's exactly the engineering-led model described above, whatever the stack.

DIY: what looking after it yourself really costs

DIY is genuinely fine for some sites - but "free" isn't the right number, and the pages that quote one disagree with each other by a factor of four on the hours. Here's the honest calculation.

The tools: about £38 a month at single-site retail prices for hosting with staging, restore-capable backups, scanning, vulnerability alerts and uptime monitoring - roughly £59 with a typical premium plugin stack.

The hours: published estimates range from 1 to 12 a month; a defensible middle is 2 hours for a brochure site, 4 for a business site and 8 or more for a store, assuming nothing breaks.

Your time: even at the UK median wage of £19.67 an hour (ONS, April 2025) that's £39 to £157 a month - and if you're the owner, your hourly value is a multiple of the median. The risk: DIY means you are the incident response. The £450 to £800 cleanup, the Friday-evening checkout failure at £125-an-hour emergency rates, the restore that was never tested - all yours now.

Put together: a business site maintained "free" typically consumes £115 to £140 a month in tools and median-priced time before any incident - against £50 to £150 for a plan where the testing, the tooling and the 2am problem belong to someone else. When DIY genuinely wins: a simple, low-stakes site you rarely change, run by someone capable who keeps offsite backups, tests restores occasionally and accepts the risk knowingly. That's a real category - it just isn't "my business runs through this site".

Hourly, retainer or plan: which pricing model fits

Three models, three failure modes. The right one depends on how much predictable work your site generates - here's each with 2026 UK numbers.

Rate context while you compare: UK freelance day rates for WordPress work average around £397 (Malt's live figure, July 2026), senior contractor day rates £476 to £609 (YunoJuno's 2026 report) and agency hourly rates actually fell 4% last year - the first drop on record - so a quote that's jumped sharply deserves a question. And one rule of thumb to ignore: "budget 15 to 20% of your build cost per year" is repeated everywhere and sourced nowhere we could trace; cost scales with what your site does and how it's built rather than with what you once paid for it.

Hidden extras and red flags

The headline price is rarely the whole bill. Before you sign anything, get written answers on these - each one is a real charging practice in the UK market.

• Hosting sold separately. Most care plans exclude it - add £15 to £40 a month, and note who you call when it's unclear whether the site or the server is at fault.
• Plugin licences passed through. £200 to £600 a year on a typical WordPress site. Ask whether they're included, and whose name the licences are in - they should renew even if you leave.
• Onboarding fees. £150 to £500 one-off is common for taking on an existing site; a neglected one may need a paid catch-up first.
• Out-of-hours emergencies. Billed separately on most plans, at premium rates around £125 an hour. If weekend trading matters to you, treat out-of-hours cover as a tier decision from the start.
• Major version migrations. PHP upgrades and platform majors (a WooCommerce major, a framework jump) are frequently "quoted separately" - the fine print that turns a £49 plan into a £600 year.
• "Unlimited" small edits. Read the definition: unlimited usually means unlimited minor text changes, queued, within fair use. Nobody sells unlimited development for £79 a month.
• Exit friction. Rolling monthly is the norm in this market - question a 12-month lock-in, and confirm you leave with your backups, your licences and your domain in your own name.

How we price it - and the like-for-like sum

We sell maintenance the bundled way: managed WordPress hosting with the care built in, so the team that runs the infrastructure is the team that maintains the site. Four tiers, all published, all ex VAT, two months free on annual plans: Essentials at £99 a month for brochure and business sites, Business at £329 for busier sites and stores (staging, Redis cache, WooCommerce-ready), Professional at £1,295 - the engineering-led tier, with 24/7 engineer support, geo-redundant backups and an enhanced SLA - and Enterprise from £2,950, priced per engagement.

The like-for-like sum, done honestly: a business site buying separately needs a proper care plan (£75 to £150), decent hosting (£15 to £50) and its plugin licences (£8 to £17 a month) - call it £98 to £217 a month across two or three suppliers. Essentials is £99 on one bill, with one team owning the whole stack. Buying separately still wins in two cases: you're locked into hosting you're happy with, or your estate is so custom that a specialist retainer fits better - in which case the ladder above tells you what to pay for it.

How we compiled these figures: market bands are drawn from the published prices of 13 named UK providers plus the ranking UK cost guides, all captured in July 2026 and listed in the sources; wage and rate anchors are ONS, Malt and YunoJuno data; security statistics are taken directly from the named primary reports. Where a figure couldn't be traced to a source - like the "15-20% of build cost" rule - we've said so rather than repeated it.

How to compare maintenance quotes like for like

Two quotes with the same price can be entirely different products. Normalise them with eight written answers before you compare a single pound:

1. Scope: exactly which updates are covered - core, plugins, themes, PHP version moves - and how often.
2. Testing: where updates are tested before production, and what happens when one fails.
3. Backups: frequency, retention, storage location - and the date of the last tested restore.
4. Monitoring: what's watched (uptime, security, performance), and who responds, how fast, in and out of hours.
5. Included time: how many hours of edits or development per month, and the rate once they're used.
6. Exclusions: hosting, licences, migrations, emergencies - priced, in writing.
7. Reporting: what you'll see each month proving the work happened.
8. Exit: notice period, and confirmation you keep backups, licences and your domain.

Then weigh the answers against the band for your site type - the checker above gives you the range - and treat any quote well below it as the automation tier wearing a suit. Dearer isn't automatically better; unexplained cheapness always means something's missing.

Sources

Pricing, wage and security figures in this guide are drawn from the sources below, checked in July 2026.

• Patchstack. State of WordPress Security in 2026 (vulnerabilities disclosed in 2025, plugin share, exploitation speed). patchstack.com. 2026.
• Sucuri. Hacked Website Threat Report (outdated software on compromised sites); Website Security Platform pricing. sucuri.net. 2024-2026.
• Wordfence. Quarterly WordPress Threat Intelligence Report, Q4 2025. wordfence.com. 2026.
• W3Techs. Usage statistics of content management systems. w3techs.com. July 2026.
• WordPress.org. Release announcements and security/support policy. wordpress.org. 2025-2026.
• The PHP Group. Supported versions and end-of-life dates. php.net. 2026.
• Office for National Statistics. Annual Survey of Hours and Earnings, employee earnings in the UK. ons.gov.uk. April 2025 data.
• YunoJuno. Freelancer Rates Report 2026 (UK contractor day rates). yunojuno.com. June 2026.
• Malt. Average freelance rates: WordPress developer, UK. malt.uk. July 2026.
• Department for Science, Innovation and Technology. Cyber Security Breaches Survey 2025/26 (breach costs, micro and small businesses). gov.uk. April 2026.
• The Wow Company. BenchPress 2025, State of the Agency Nation (agency rate movement). thewowcompany.com. 2025.
• Codeable. WordPress maintenance cost data and expert plan pricing. codeable.io. 2026.
• Automattic / Jetpack. WordPress VIP enterprise platform pricing guidance. jetpack.com. Accessed July 2026.
• ALT Agency. Published WordPress maintenance and retainer pricing. altagency.co.uk. Accessed July 2026.
• UK provider published prices, accessed July 2026: ThriveWP, WP Care Pros, WPmaintain, Toast SiteCare, feelingpeaky, Pixelish, Gilmour Web Design, EJK Web Solutions, Rubber Duckers, Little Nerd Web Design, Solve, The Smart Bear, fmeos.
• Vendor pricing pages, accessed July 2026: Krystal, BlogVault, Wordfence, Patchstack, UptimeRobot, UpdraftPlus, Jetpack, ManageWP, MainWP, ACF, Gravity Forms, WP Rocket, Yoast.

Frequently asked questions