The website is finished, the supplier has handed over the passwords, and a month later you receive a quote for monthly maintenance and wonder whether it is necessary or a subscription for nothing. This article covers what proper WordPress maintenance includes, what happens to a site left on its own, with public figures, what our tiers look like, and how to compare two quotes that share a name and differ in content.
What happens to a site left on its own
WordPress is not a finished product, it is a system of three layers that change separately: the core, the theme and the plugins. Each one receives new versions, and some of those versions fix published security holes.
Patchstack’s figures for 2025 (source: patchstack.com, “State of WordPress Security in 2026”, checked on 15 September 2026): 11,334 new vulnerabilities in the WordPress ecosystem, 42% more than in 2024; 91% in plugins, 9% in themes and only 6 in the core; 46% had no patched version at the time of disclosure. Translated: the core is safe, plugins are the problem, and almost half of the problems are published before a fix exists, so someone has to know that a given plugin needs to be disabled or replaced.
What breaks, concretely, without anyone noticing:
- The contact form stops sending e-mails after a change at the e-mail provider or after an update; you find out weeks later, from a customer complaining that you never replied.
- PHP on the server moves to a new version, the old theme does not support it, the site shows a blank page.
- A plugin abandoned by its author stays installed with a known vulnerability; the site ends up sending spam or redirecting visitors.
- The backup exists in theory, but sits on the same server that went down, or has never been restored as a test.
- Speed drops month after month: the database grows, the media library fills up, every new plugin adds a script, and Google takes speed into account when it ranks results.
None of these is dramatic on its own. Together they are a website that no longer brings customers and that nobody can update without breaking it.
What proper maintenance includes
The list we apply ourselves and that you can ask of anyone:
- Updates of core, theme and plugins, done by a person, first on a test copy, then on the live site, with the main pages checked afterwards.
- Backups daily, stored somewhere other than the site’s server, with a restore tested at least once. A backup that has never been restored is a hope, not a backup.
- Monitoring: uptime, errors, response time, with alerts going to the supplier, not to your customers.
- Security: an application firewall, two-factor authentication on admin accounts, file scanning, removal of abandoned plugins, PHP on a supported version.
- Performance: cache, images, database, a Core Web Vitals check after every major change.
- Hours for small work: content changes, a new form field, a new page, an integration to fix, from the monthly allowance.
- Response time for incidents, written in the contract, with priorities.
- A short monthly report: what was updated, what was fixed, what comes next.
If the quote does not say who performs the updates and whether someone checks afterwards, it is not maintenance, it is a subscription to a plugin.
What the market charges
The orders of magnitude below are published by other suppliers in Romania; we quote them with the source, they are not ours. A 2026 guide splits the market into three tiers: basic (updates, backup, monitoring), standard (plus active security, priority support, a monthly report) and extended (plus written response times, content changes, periodic audits), with monthly fees starting at a few hundred Romanian lei and reaching, on the extended tier, close to a thousand lei; work without a contract is charged by the hour (source: webage.ro, “Care e prețul corect pentru mentenanța WordPress”, 2026, checked on 15 September 2026). The same guide notes that very cheap offers, under a hundred lei a month, usually cover only automated backups and updates, with no human check.
Our cost is agreed after an assessment, because it depends on what has to be maintained: an eight-page presentation site and an online shop with payments, couriers and e-invoicing are not maintained the same way.
Our tiers: Basic, Standard, Extended
- Basic, for stable presentation sites: monitoring, updates, backups and hours for small interventions. Hours and response time set in the contract.
- Standard, for online shops, customer portals and sites that orders depend on: everything above, plus a monthly allowance of development hours and a shorter response time for incidents, set in the contract.
- Extended, for systems that daily operations depend on: more hours, out-of-hours intervention for critical incidents, periodic architecture review.
The tier can change from one month to the next as the site evolves. The rule for unused hours is written in the contract before the first month. Details on the Maintenance and support page.
How to compare two quotes
Two quotes with “Standard” in the title can mean completely different things. The questions that separate them:
- Who presses “update”? A person, on a test copy, or a script, on the live site?
- Where does the backup live, and when was it last restored?
- What is included in the hours and what is billed separately? Is a new page a “small intervention” or a project?
- What is the response time for “the site does not load”, and is it in the contract?
- What do I receive each month as proof that work was done?
- What happens to access and data if I leave? The right answer: the accounts are yours from the start and you receive everything.
- Do you take over sites built by someone else, and with what process?
What we have seen in projects
We maintain WordPress sites and shops for customers across several industries, plus the infrastructure of our own products, and we take over sites built by other suppliers. The takeover has four steps, always the same: a written assessment (code, hosting, accounts, plugins, risks), taking over access and documenting what is undocumented, stabilisation (critical errors and mandatory updates first), then monthly support from the following month. What we find most often at the assessment: plugins installed “to try” and forgotten, backups on the same server, PHP not updated for years, admin accounts belonging to people who no longer work there. We know what an update that breaks a page feels like; that is why the test copy is not optional. When the assessment shows that repairs would cost as much as a new site, we say so; the Websites and online shops page describes the presentation tier. The practices that keep a site healthy from the start are in A website that works.
Questions. Short answers.
How much does WordPress maintenance cost?
On the Romanian market, public guides put maintenance between a few hundred and close to a thousand lei a month, depending on what is included (source: webage.ro, 2026). Our cost is agreed after an assessment, because it depends on the site: presentation, shop or portal, with which integrations and which risks.
Do I really need maintenance for a presentation site?
Yes, on the basic tier. Plugin vulnerabilities are published daily (over 11,000 in 2025, source: Patchstack), certificates expire, PHP changes. A presentation site left a year without updates usually ends up unable to update without repairs.
What does WordPress maintenance include, at a minimum?
Updates done by a person on a test copy, daily backups stored elsewhere with a tested restore, monitoring with alerts, basic security and a written response time. The rest (development hours, performance, reports) is what separates the tiers.
Do you take over a site built by another company?
Yes. We start with a written assessment; if the site is worth maintaining, we take it into support from the following month, after stabilisation. If it is not worth it, we say that too, with the reasons.
We maintain WordPress websites and shops, the ones we built and the ones we took over from others, on three tiers with terms written in the contract. The Maintenance and support page shows what each tier includes and how a takeover works.