A small-business owner in Albuquerque opens her WordPress dashboard for the first time in eighteen months. There are forty-seven plugin updates waiting, two of which have already been removed from the official repository. The contact form stopped sending emails sometime in March. The site is still up, but a security scanner now flags two known vulnerabilities. None of this is dramatic — and that is the problem. WordPress sites rarely break in one big crash. They degrade quietly, on a schedule of their own.
WordPress maintenance is the work that prevents that quiet degradation. It is not a single service but a set of recurring tasks — some technical, some judgment calls — that keep a site secure, fast, and aligned with what the business actually needs from it.
What a real maintenance plan covers
The core of WordPress maintenance is roughly the same across every site, regardless of size or industry:
- Core, theme, and plugin updates. WordPress releases minor security and bug-fix updates throughout the year, and a major release or two — version 6.9 shipped in December 2025. Most breakage does not come from core itself: 92% of successful WordPress breaches in 2025 traced back to plugins and themes, not core. Keeping those updated is the highest-leverage task there is.
- Backups. Daily for active sites, weekly minimum for static ones, kept in at least two separate locations. A backup that only lives on the same server as the site is not a backup — it is a hostage waiting to happen. Most current guidance suggests keeping at least thirty recent restore points.
- Security monitoring. Malware scans, file integrity checks, and login monitoring. SolidWP’s vulnerability tracker reported 476 new disclosures across plugins and themes in October 2025 alone. Most get patched quickly; a site that is not being watched cannot tell which ones matter to it.
- Uptime and performance checks. A status ping every few minutes, paired with a quarterly look at Core Web Vitals and page-load times. A site that has slowed from 1.2 seconds to 4 seconds did not break — it drifted.
- Broken link sweeps and small content fixes. Pages get renamed, links rot, images go missing. Catching that monthly is cheap. Catching it after a customer reports it is expensive.
How much does WordPress maintenance cost?
For most New Mexico small businesses with a standard WordPress site, a maintenance plan runs $50 to $200 per month. That range covers ongoing core, theme, and plugin updates, daily backups, security monitoring, uptime checks, and a small bucket of developer time for the inevitable thirty-minute fix that always comes up. WooCommerce stores, membership sites, and sites with custom plugins land at the higher end of that range because they have more moving parts. Sites that need a malware cleanup after a compromise typically pay an additional $200 to $1,500 for the cleanup itself — which is one of the stronger arguments for paying for prevention.
Cost is also a function of what you would otherwise pay yourself in attention. An hour of poking at the dashboard once a week, badly, is not free.
What maintenance is not
This is where small-business owners get caught. A maintenance plan is not:
- A redesign. Updating WordPress and updating the look of the site are different jobs. A maintenance plan keeps the existing site running well — it does not reshape it.
- New features. A new landing page, a new contact-form workflow, a new HubSpot or Mailchimp integration — those are development projects, billed separately. Some maintenance plans include a few hours of dev time per month that can be used for small features, but anything substantial is its own engagement.
- Content writing or SEO strategy. Maintenance keeps the technical layer healthy. It does not generate blog posts, rewrite product descriptions, or build a content calendar.
- A guarantee that nothing will break. Plugins occasionally release bad updates. Hosting environments change. The honest version of a maintenance plan is “we catch and fix it quickly,” not “nothing will ever go wrong.”
Pretending maintenance covers all of the above leads to friction. Naming the boundary up front prevents the awkward conversation where a client expected a homepage rebuild as part of the $99 monthly fee.
Why the cost of neglect compounds
WordPress sites that go unmaintained for a year or more do not stay still. Plugin authors abandon their work — over 150 plugins were pulled from the official WordPress repository in December 2025 alone for unpatched security issues or developer inactivity. PHP versions deprecate. Database tables bloat. Hosting plans expire or get migrated without warning. Each of these is a small problem in isolation; together, they turn a six-hour update job into a forty-hour recovery project.
The math is almost always lopsided. Six months of a $150-per-month plan costs $900. A recovery from a compromised, outdated site — including malware cleanup, plugin replacements, hosting reconfiguration, and the time the site is offline — routinely runs $2,500 to $7,500. That does not count the customer trust lost in the meantime.
DIY versus hiring it out
Plenty of small-business owners can run their own updates if they have the time and the temperament for it. The pattern that gets people into trouble is not ignorance — it is intermittence. Maintenance only works if it happens on a schedule. Doing it yourself once a quarter, in a panic, after a friend mentions their site got hacked is worse than doing nothing on a calendar.
The strongest argument for outsourcing maintenance is not the technical skill. It is that a paid relationship gets put on a schedule. Someone is watching whether you do or not.
What to ask before you sign
Before agreeing to any maintenance plan, ask:
- What is the response time when something breaks?
- How many recent backups are kept, and where are they stored?
- Is malware removal included, or billed separately?
- How many hours of developer time are included each month, and what happens to unused hours?
- Will you tell me when a plugin needs to be replaced rather than just updated?
Vague answers to any of these are a signal to keep looking. A longtime collaborator like Virginia Williams, who has worked with Patrick Iverson across contracts, events, websites, and e-commerce projects, has described that kind of partnership as a function of someone who is “smart, easy to work alongside, and able to interpret concepts and ideas into something functional.” That description is more useful than a price tier — maintenance, in practice, is a working relationship.
The honest version
A good maintenance plan is unglamorous on purpose. Most months, nothing happens that the business owner needs to know about. The plugin updates, the security patches, the broken-link sweep, the backup — all of it is invisible when it is working. The plan is doing its job when no one mentions it.
Patrick Iverson works with small and mid-sized businesses across Albuquerque, Santa Fe, Rio Rancho, and Las Cruces who want their website to be a quiet, dependable asset rather than a worry that lives in a tab somewhere. If you are considering custom WordPress development — or just a maintenance relationship for the site you already have — that is the bar to aim for.