What it costs
Maintenance pricing in the UK splits into three honest bands and one dishonest one. The dishonest one is "included free", which almost always means nobody is doing it.
| Level | Typical monthly | What it realistically covers |
|---|---|---|
| Hosting only | £5 – £25 | A server and an SSL certificate. Nobody is updating anything or looking at it. This is not maintenance; it is a shelf. |
| Small business care plan | £20 – £100 | Updates, backups, uptime monitoring, security patching, and a person who answers when something breaks. |
| E-commerce or high-traffic care | £150 – £500+ | The above plus staging, performance work, integration monitoring and a response-time commitment. |
| Cybrial hosting and care | £50 flat | Managed hosting, SSL, platform and plugin updates, daily off-site backups, uptime monitoring, small fixes, and keeping the site current with browser and Google changes. |
Source: Cybrial pricing correct at 4 September 2026. Ranges from plans quoted and run for UK clients.
The £50 is a starting price rather than a tier, and the distinction matters. There are no bronze, silver and gold plans here, because tiers give the person you are paying a reason to argue about which tier a broken form belongs in. Instead there is one plan, and one number, set by what the site actually costs to host and look after — how big it is, how much traffic it takes, and how much there is to keep working.
What should actually be in a maintenance plan
Ask for the list. A plan that cannot be itemised in six lines is either very thin or being deliberately vague. Mine is:
- Managed hosting and SSL. Where the site lives, kept fast, with the certificate renewed before anyone notices it existed.
- Platform, plugin and theme updates. Applied, then checked — because the update is the easy half and the collision it causes is the expensive half.
- Daily off-site backups. Off-site is the load-bearing word. A backup on the same server as the site is not a backup; it is a copy that dies with it.
- Uptime monitoring. So that I find out the site is down, not your customer.
- Small fixes as they come up. Text and image changes, a broken link, a form that stopped sending, a plugin conflict after an update. Minutes, not days.
- Keeping the site current with the technology around it. Browsers change what counts as fast, Google changes what it rewards, payment providers change their rules. A site that was excellent in 2024 and untouched since is not excellent now.
Why WordPress maintenance costs more than the rest
WordPress runs a large share of the business web, and it is the platform with the most genuine maintenance burden. That is not a criticism; it is the price of an open ecosystem. Three things drive it.
- Plugins update independently of each other and of WordPress. Every update is a small chance of a collision, and the collision usually surfaces on a page nobody was looking at.
- Plugins are the security surface. Core WordPress is well maintained. The abandoned plugin someone installed in 2021 to add a slider is not.
- PHP versions move underneath you. Hosts deprecate old versions on their own schedule, and a site that was never tested against the new one goes white.
This is measurable in the market: the WordPress-specific phrasing of “website maintenance service” carries roughly three times the click price of the platform-agnostic one. Advertisers pay three times as much for that click because the WordPress owner in trouble is worth three times as much to them.
The single biggest reduction in WordPress maintenance cost is not a cheaper plan. It is being built as a bespoke theme rather than assembled from a page builder and fourteen plugins. Pro Pave, a bespoke WordPress build, renders its homepage from 11 requests. Fewer moving parts is fewer things to update, fewer collisions, and a faster site as a side effect.
What happens to a site with no maintenance
Nothing, for about eighteen months. That is the trap: the failure mode is slow and then sudden, so the decision to skip maintenance looks correct for a year and a half and then looks catastrophic in one afternoon.
The order it usually goes in:
- Months 1–6: nothing visible. Updates queue up.
- Months 6–12: the site gets slower as unpatched plugins accumulate and images are uploaded at full size. Nobody notices because the owner visits it on office wi-fi on a laptop.
- Months 12–18: something breaks quietly. Usually the contact form. Enquiries stop, and because they stop silently, it can be weeks before anyone connects the quiet phone to the website.
- Month 18+: a PHP deprecation, a plugin vulnerability or an expired certificate takes the site down properly, on a weekend, and the person who built it has moved on.
A hacked WordPress site is recoverable if there is an off-site backup and expensive if there is not. Cleaning a compromised install, checking what was injected into the database, and getting a site out of a Google safe-browsing warning routinely costs more than three years of a £50 plan. That is not a scare figure to sell a plan; it is the reason the plan is £50 rather than £5.
Can you do it yourself?
Yes, and for some businesses that is the right answer. If you are comfortable in a WordPress dashboard, you can run updates, take backups and keep an eye on things. What you should be honest about is the three parts that are genuinely hard to do alone:
- Knowing whether an update broke something. Updates rarely break the homepage; they break the checkout on mobile, or the form, or a page you never open.
- Restoring. Having a backup and being able to restore it under pressure at 9pm are different skills, and the second one is only learned by doing it.
- Noticing. Uptime monitoring, error logs and search-console coverage warnings only help if someone is actually reading them.
A reasonable middle path: run it yourself, but pay for hosting that takes daily off-site backups you can restore in a click, and put a free uptime monitor on the site today. That covers the two failures that cost the most.
How to choose a maintenance provider
- Ask what is not included. The clarity of the answer tells you more than the price.
- Ask where backups are stored and how long a restore takes. "On the server" is the wrong answer.
- Ask what counts as a small fix, with examples. Everyone means something different.
- Ask about response time, and whether it is a promise or an aspiration. Mine is one working day, and it is a promise.
- Ask whether you can leave, and what you get when you do. You should own the site, the domain and the content, and receive a working copy. There should be no exit fee.
- Ask whether they built the site. Someone maintaining a site they know is materially cheaper and faster than someone learning it in an emergency — but a good provider will take on a site they did not build after a health check, and mine will.
The last point is worth pressing. A provider who will only maintain their own builds is telling you something about how portable their work is.
