There are three common ways to buy WordPress help: a monthly maintenance plan, ad-hoc (pay-as-you-go) support, or a retainer of hours. A monthly plan suits most business sites, because someone is watching between problems. Ad-hoc help suits simple sites with an owner who keeps up with updates, and a retainer suits sites that change often.
Key takeaways
- A monthly plan pays for prevention: updates, backups, scans and monitoring happen whether or not anything breaks.
- Ad-hoc support looks cheapest, but nobody is watching, and emergency fixes usually cost the most.
- A retainer buys hours of someone’s time, which may or may not include the routine care.
- Compare what each option leaves out, not just the monthly price.
What are the three ways to buy WordPress help?
Each model answers the same question differently: who looks after the site when nothing seems wrong? Here’s how they compare side by side.
| Monthly plan | Ad-hoc | Retainer | |
|---|---|---|---|
| How you pay | Fixed monthly fee | Per job or per hour | A block of hours each month |
| Routine updates and backups | Included | Only if you ask | Sometimes, using your hours |
| Someone watching | Yes, through scans and monitoring | No | Depends on the agreement |
| Content changes | Minor ones, on some plans | Charged per job | Yes, from your hours |
| Hidden cost | Paying in quiet months | Problems found late, fixed at urgent rates | Unused hours that lapse |
What does a monthly WordPress maintenance plan include?
A monthly plan is a fixed fee for ongoing care. A good one covers WordPress, theme and plugin updates, off-site backups, malware and vulnerability scans, uptime monitoring and a regular report. Better plans add testing after updates and repairs when an update breaks something.
The point is prevention. Patchstack recorded 11,334 new WordPress vulnerabilities in 2025, 91% of them in plugins, and the heavily exploited ones were attacked at scale within a median of 5 hours (Patchstack). A plan means someone is checking for those updates every week, not when you remember.
To see the jobs involved, our WordPress maintenance checklist lists them by week, month and year. Our own WordPress maintenance services page shows how we handle each one.
The hidden cost of a monthly plan
You pay in the quiet months too. That’s the trade: a steady cost in exchange for fewer surprises. The other risk is a plan that’s thin on detail. “Updates included” means little if nobody checks the site afterwards.
When is pay-as-you-go WordPress support enough?
Ad-hoc support means you call someone when you need them and pay for the job. It can work for a small brochure site that rarely changes, where the owner logs in every week, runs updates and checks a backup exists.
It goes wrong when nobody is doing that routine work. Sucuri found that 39.1% of content management systems were out of date when they were infected (Sucuri). On an ad-hoc arrangement, the first sign of trouble is often a customer telling you the site looks wrong.
The hidden cost of ad-hoc help
- Urgent work costs more. After-hours and emergency rates are common, and a hack clean-up takes far longer than routine updates would have.
- Nobody knows the site. Each job starts with someone working out how your site was built.
- Backups may not exist. If nobody set them up and checked them, there may be nothing to restore.
What is a WordPress support retainer?
A retainer is a set number of hours each month, paid in advance, usually with a developer or agency. It suits businesses that change their site often: new landing pages, campaign updates, small features or regular design tweaks.
The hidden cost of a retainer
Unused hours often lapse at the end of the month. And a retainer buys time, not outcomes. If an update breaks the site or a hack needs cleaning, that work comes out of the same hours, and your planned changes wait. Ask whether updates, backups and security scans are included, or whether they’re extra.
Some businesses combine the two: a monthly care plan for the routine work, and a designer or developer for bigger changes. That keeps maintenance from competing with new work.
How much does WordPress maintenance cost?
Prices vary with what’s included, so compare the list of tasks, not just the number. As a reference point, our website maintenance plans are $40, $80 and $120 a month + GST, with a one-off setup fee that covers a full security audit and lockdown.
- Essentials ($40): updates, daily off-site backups, daily malware scans, firewall and login protection, uptime monitoring and a monthly report.
- Advantage ($80): adds backups four times a day, checks after updates, repairs if an update breaks something and minor content changes (fair use).
- Elite ($120): adds hourly backups, checkout and payment gateway checks, database and image optimisation and unlimited minor content changes.
Weigh that against the cost of a bad day. The ASD’s latest annual report puts the average cost of a cybercrime reported by a small business at $56,600 (ASD).
What should I ask before choosing?
Whichever model you pick, get clear answers to these questions in writing:
- How often are plugins, themes and WordPress updated, and is the site tested afterwards?
- Where are backups stored, how long are they kept and how fast is a restore?
- Who fixes the site if an update breaks it, and is that included?
- What happens if the site is hacked? Is the clean-up included or extra?
- Do I get a report showing what was done?
Our guide to what WordPress maintenance services should include goes through each answer in detail. If you’re still deciding whether the platform itself is a risk, read is WordPress secure for an honest view.
Maintenance also depends on where the site lives. A plan works best on fast, well-managed servers, which is why we pair it with WordPress hosting in Australia built for the platform.
Frequently asked questions
Is a WordPress maintenance plan worth it for a small site?
If the site brings in enquiries or sales, usually yes. Plugin updates arrive constantly, and the most targeted flaws are attacked within hours of being published. A plan costs less than most clean-ups, and someone is checking the site even when you’re busy running the business.
Can I just do WordPress maintenance myself?
Yes, if you have the time and the habit. You’ll need to update plugins, themes and WordPress, keep off-site backups, test restores and scan for malware. The risk is that it slips when you get busy. Use a checklist and set a weekly reminder.
What’s the difference between a retainer and a maintenance plan?
A maintenance plan pays for defined tasks, such as updates, backups and scans, done on a schedule. A retainer pays for a block of someone’s time, which you can spend on anything. Retainers suit ongoing development work. Maintenance plans suit keeping a site safe and working.
Does my web host maintain my WordPress site?
Usually not. Most hosts look after the server, not your plugins, themes or forms. Some run WordPress core updates, but few test the site afterwards. Check your hosting agreement for exactly what’s covered.
Can I switch from ad-hoc support to a monthly plan?
Yes. A good provider starts with an audit to find outdated plugins, missing backups and security gaps, then fixes them before regular care begins. Our setup fee covers that audit and lockdown. It doubles if the site is already compromised, because the clean-up is a bigger job.
Sources
- State of WordPress Security in 2026, Patchstack
- 2023 Hacked Website and Malware Threat Report, Sucuri, June 2024
- Annual Cyber Threat Report 2024–25, Australian Signals Directorate, October 2025