How much does website maintenance cost in 2026? Published care plan prices, platform fees and what to skip

The short answer

Website maintenance costs from about USD 40 to 360 a month for a WordPress care plan from a specialist service, and from about USD 750 to 7,500 a month when an agency retainer buys you design and development hours on top. Those are the published prices we read on 17 October 2026: GoWP starts at USD 39 a site, FixRunner at USD 69, WP Buffs at USD 89, and Webflow agencies sell hour blocks from USD 750 to 7,500 a month.

The platform is a separate bill. WordPress hosting runs from a few dollars a month on a long promotional term to USD 35 a month on managed hosting, Webflow site plans cost USD 15 or 25 a month billed yearly, and Shopify starts at USD 29 a month billed yearly. A static or coded site can skip most of the plugin work, but not monitoring, backups or content changes.

Our free website cost calculator adds a yearly maintenance line to any estimate, by market. This guide shows what each tier of a care plan includes, so you can tell a USD 39 plan from a USD 359 one before you sign.

What a maintenance plan pays for

Every plan we read sells some mix of the same seven things. The price follows how many of them are done by a person rather than a script, and how fast:

• Updates: CMS core, plugins, themes or code dependencies, ideally tested on a copy first.
• Backups: how often, how long they're kept, where they're stored, and whether anyone has tested a restore.
• Security: scans, a firewall, and who cleans up after a hack.
• Monitoring: uptime, SSL certificates, domain expiry and form delivery.
• Change time: minutes or hours a month for content and design edits.
• Response time: how fast someone answers, in which hours, and whether it's written down.
• Reporting: what was done, what broke and what's next.

A cheap plan usually automates the first four and leaves the last three thin. An expensive one buys people: edit hours, faster response and someone who knows your site.

Published WordPress care plan prices (read 17 October 2026)

Three things stand out once the plans sit side by side.

The jump from USD 39 to USD 99 is people. GoWP's two paid tiers share the same updates and backups; the extra USD 60 buys five human edits. FixRunner's tiers are mostly support minutes: at the top, USD 300 for 8 hours works out to USD 37.50 an hour if you use them all, and USD 69 for 90 minutes works out to USD 46.

"Updates" means different things. WP Buffs runs updates weekly on Maintain and adds updates on a staging copy only on Custom, at USD 359. WebFX applies upgrades and security patches quarterly and bills fixes caused by those patches at USD 150 an hour. Ask how often, and whether a copy of your site is tested first.

Hourly rates converge. WebFX bills extra work at USD 150 an hour; the Webflow agency in the next section sells hours at USD 150 to 180. Above the entry tiers, you're buying hours at agency rates, so compare the hours included, not the plan name.

Webflow and Shopify care plans

On hosted platforms the provider runs the servers and the core software, so care plans are sold mostly as hours. Webflow says its hosting needs "no updates to run, packages to install, or capacity planning", that it deploys security updates automatically and keeps automatic backups you can restore (Webflow hosting). Shopify says every store on its platform is PCI DSS compliant by default (Shopify).

If your team edits a Webflow or Shopify site itself, you may not need a plan at all: the platform covers hosting, certificates and core updates. You're paying for hours when you buy one, so a retainer only makes sense when there's a steady queue of work.

Platform and hosting costs outside the care plan

A care plan rarely includes hosting. These are the platform bills that sit next to it, in US dollars:

Some plans bundle tools you could also buy yourself. UptimeRobot Solo covers 10 monitors with SSL and DNS checks at a 60-second interval for USD 9 a month billed annually. Jetpack Security (backups, scanning and a firewall for WordPress) costs USD 9.95 a month for the first year and USD 19.95 after, billed yearly. Sucuri's security platform starts at USD 229 a year with malware cleanups. A plan is worth more than its tools only if a person watches the alerts and acts on them.

What pushes the price up

Plugins and the speed of attacks

WordPress plugins are where most of the work comes from. Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 42% more than in 2024, and found 91% of them in plugins, 9% in themes and only 6 in core (Patchstack). It also concluded that the first 24 hours after a vulnerability is published are critical. Each plugin is another thing to update, test and watch, so trimming the plugin list is often the cheapest maintenance decision you can make.

WordPress itself only officially supports its latest version; its security team backports fixes to older versions "as a courtesy" (WordPress.org).

PHP deadlines

WordPress runs on PHP, and PHP versions have fixed end dates. PHP 8.2 gets security fixes only until 31 December 2026, PHP 8.3 until 31 December 2027 and PHP 8.4 until 31 December 2028 (PHP). A site still on PHP 8.2 needs its theme and plugins tested on a newer version in the next ten weeks or so. That's a one-off job some plans include and others quote separately; ask which.

Certificates that expire faster

TLS certificates are getting shorter lives on a published schedule. The CA/Browser Forum's Baseline Requirements cap a certificate's validity at 200 days for certificates issued from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029 (CA/Browser Forum). Renewal is automatic on most hosts, but an automatic renewal that fails quietly shows visitors a browser warning. Monitoring every hostname's expiry, not only the main domain, is now part of the job.

E-commerce and forms

A store adds checkout, payments and stock to the list of things that can break after an update. In the plans above, that's where tiers split: FixRunner adds store support on Rocket, WP Buffs adds e-commerce plugin management on Perform, and WebFX prices WooCommerce sites on its USD 550 tier. A lead-generation site has a smaller version of the same risk: a contact form that stops sending. A plan worth paying for tests form delivery on a schedule.

Change hours and response times

Change time is the biggest lever. Five human edits a month at GoWP costs USD 60 more than none; 8 hours at FixRunner costs USD 300; 25 hours at BX Studio costs USD 4,250. Response times move the price too: WebFX charges USD 250 an hour when you ask for a one-business-day turnaround. Decide how much work you expect each month and how fast you need it, then price that, rather than buying the biggest tier "to be safe".

Compliance

If your site has to meet accessibility rules, keeping it conformant is ongoing work: every new page and component can break it. Our guide to ADA website compliance explains what US law asks. Sites that take payments are simpler on a hosted checkout, because Shopify or the payment provider carries most of the PCI DSS burden.

What a static or coded site lets you skip

A site built as static pages, such as an Astro site served from Cloudflare (dardo.studio is one), has no plugins, no PHP and no database to patch on the public side. That removes the biggest line in a WordPress plan. It doesn't remove everything:

If speed is the reason you're paying for maintenance, check first whether the platform is the cause. Our website platform speed report shows how sites on each platform pass Core Web Vitals for real visitors, and our website speed optimization page covers fixing it in place.

Three years of maintenance, five ways

An illustration from the prices above, for one small business site over 36 months. It leaves out the domain, which costs the same in every case, and assumes you use the plan as published:

The cheapest row isn't the best buy for everyone. The budget WordPress row has no human edits and renews at a higher hosting price after year four. The Webflow row is cheap because your team does the work. The store row is the most expensive because a checkout is the thing you can least afford to break.

What Dardo charges

Our website maintenance plans start at USD 79 a month for the Monitor tier: uptime, SSL, domain and form monitoring with alerts, backups with a periodic restore test, urgent security updates and a short monthly report. Maintain adds updates tested on staging, security scans and change hours; Evolve adds a larger block of design and development hours. We confirm each plan's price after an initial audit, because the same tier costs different amounts on a static Astro site and on a WordPress store with dozens of plugins. Prices are on our pricing page.

If your site is on Webflow, your team handles edits and you only need to know when it's down, a USD 9 uptime monitor and the platform plan may be all you need. We'd rather say that than sell a plan you won't use.

How to compare maintenance quotes

Ask every provider the same questions and get the answers in writing:

1. How often are core, plugins and themes updated, and is each update tested on a copy first?
2. How often are backups made, how long are they kept, where are they stored, and when was a restore last tested?
3. What's monitored: uptime only, or also SSL, domain expiry and form delivery?
4. How many minutes or hours of changes are included, and do unused hours roll over?
5. What are the response times, in which hours, and for which kinds of problem?
6. What's excluded: malware cleanup, plugin licences, hosting, PHP upgrades, new features?
7. What's the minimum term, and what do you hand over when the plan ends?
8. Who owns the hosting, domain and admin accounts? They should be in your company's name.

If you're also weighing a rebuild, our guides to what a website costs in the US and what a website redesign costs price the one-time work, and Webflow vs WordPress compares their running costs over three years.

Next step

Run your site through the website cost calculator to see the yearly running and maintenance costs published for your market, then use the checklist above on every quote. If you want Dardo to look after the site, start with the initial audit on our website maintenance page.