How to Choose a WordPress Maintenance Plan

What plans cost

Published Australian figures vary widely, and most come from companies that sell maintenance, so treat them as indications rather than benchmarks. One agency's 2026 guide puts small business or lead-generation sites at $200 to $800 a month excluding GST, personal sites and blogs at $50 to $150 a month, and WooCommerce stores at $500 to $2,500 or more a month ^[1]. An independent cost guide suggests budgeting $100 to $500 a month for hosting, licences and maintenance combined once a site is live ^[2].

The spread reflects different sites and different service levels. A plan priced well below the market may be fine for a simple site, or may leave out the parts that matter most when something breaks.

Seven questions to ask

1. How are updates applied?

Keeping software current is the first item in the WordPress hardening guide ^[4], so any plan should update regularly. The difference is in how. Ask whether updates are applied straight to the live site or tested on a copy first, and whether that differs for plugins that handle payments or bookings.

2. Where are backups stored, and are they tested?

The WordPress guide recommends regular backups of files and database, protected from tampering ^[4]. Ask whether copies are kept outside the hosting account, how long they are kept, and when the provider last restored one on a test copy. "We back up daily" is not an answer to "when did you last restore one".

3. What is monitored?

Uptime checks are common. File change monitoring, new admin account alerts and Google Search Console security messages are less so, and they are the ones that catch hacks early. Ask who receives the alerts and what happens next.

4. How fast is the response, and when?

Response times should be written down, with business hours stated. Be wary of plans that say "round-the-clock" without saying who is available at 2am. Some Australian plans publish tiers from next business day responses at the basic end to priority responses within hours at the premium end ^[1]; decide which your site actually needs.

5. Is hack cleanup included?

Some plans include incident work, some offer a discount, some charge separately at an emergency rate. One agency guide lists emergency development at $150 to $300 an hour with an after-hours premium on top ^[1]. Knowing which applies before a bad day avoids an argument on it.

6. Whose name is on everything?

Hosting, domain, backup storage, premium plugin licences and Google Search Console should all be owned by your business, with the provider given access. That way, changing providers is a handover, not a rescue.

7. What does the monthly report say?

A good report is short and specific: what was updated, whether backups ran, any alerts and what they were, and anything you should decide. A report that only shows green ticks without detail tells you little.

A quick test before you sign

Before committing, ask a prospective provider two practical questions and see how they answer. First: "If my site were hacked tonight, what would happen between now and Monday?" A good answer names who would notice, how you would be told, and what the plan does or does not cover. Second: "Can you show me a sample monthly report?" A real sample, with names removed, tells you more about the service than any feature list.

It is also reasonable to ask how they would hand the site over if you left. A provider who has thought about that usually keeps your accounts tidy while you are with them.

Doing it yourself instead

A plan is not the only option. If the site is simple and someone in the business is comfortable with WordPress, they can apply updates, keep an off-site backup and check Search Console each month. The hardening checklist includes a ten-minute monthly routine for exactly that. The trade-off is time and attention: the routine only works if it actually happens, and someone needs to know what to do when an update goes wrong.

Reading the contract

Look for the scope, the price, the notice period, and what happens to your data if you leave. Consumer guarantees for services, such as acceptable care and skill, cannot be excluded by a contract, and the ACCC says misleading customers about those rights is against the law ^[3]. A contract that claims to exclude all responsibility for anything should prompt questions.

Reviewing the plan each year

Sites change. A brochure site that adds online bookings, or a shop that doubles its orders, may need faster updates, more frequent backups or a shorter response time than the plan it started on. Once a year, compare what the site does now with what the plan was scoped for, and adjust.

Warning signs

• Promises that the site will never be hacked or will have a fixed uptime percentage on hosting the provider does not control.
• Backups stored only in the same hosting account.
• No written response times, or response times with no stated hours.
• Accounts set up in the provider's name rather than yours.
• Reluctance to tell you which plugins and versions the site runs.

What a good handover looks like

Whichever plan you choose, ask at the start what you will receive if you leave. A provider that answers this calmly is usually one that keeps tidy records anyway. A useful handover pack contains:

• a list of every plugin and theme, with a line on why each one is there;
• where backups are stored, how often they run, and how to download the most recent one without the provider's help;
• every account the provider used, so you can remove them, and confirmation that they have been removed;
• any custom code, snippets or settings changes they made, with a plain description of what each does;
• open issues they knew about but had not yet fixed.

The last point is the one most often left out. A plugin waiting on a compatibility fix, a form that sometimes fails or a warning in the hosting panel are all things the next person needs to know on day one.

Also check who owns the important accounts. Your domain registration, hosting account and Search Console property should be in your business's name and under an email address you control. A provider can be given access to each of them, but if the account itself belongs to them, leaving becomes slow and stressful. Asking for this early is not a sign of distrust. It protects both sides, and a careful provider will expect the question.

Matching the plan to the site

Start from what the site does. If it only displays information, a basic plan with automatic updates, off-site backups and uptime checks may be enough. If it takes payments, bookings or sign-ups, tested updates, frequent database backups and faster response become worth paying for. Our maintenance plans are scoped this way, and our pricing page explains how we quote.