WordPress Maintenance, Hosting and Support: What You're Actually Paying For

Three different things get sold under overlapping names, sometimes by the same supplier, sometimes bundled into one invoice. Most owners we talk to can’t tell you which of the three they’re paying for, and that’s not a knock on them. The industry hasn’t made it easy. This page separates hosting, maintenance and support, tells you what each one should cover, where each one stops, and what it costs in the UK in 2026.

On this page: Three different products · What hosting covers · What maintenance covers · What support covers · What none of them cover · UK cost bands · Matching the level to your site · Ten questions to ask before you sign · Inherited a site nobody’s looking after? · FAQ

Hosting, maintenance and support are three different products

Here’s the comparison most provider websites never spell out plainly:

You can buy all three from one supplier, which is common and usually convenient. You can also buy them from three different places. What causes the trouble isn’t the arrangement, it’s not knowing which arrangement you have. A business owner who thinks their host “handles updates” often means something narrower than they think, and a business owner paying an agency £40 a month for “support” is sometimes only covered for text edits, not a hacked site.

Read the three sections below and you’ll know which one you’re actually buying.

What hosting covers, and where it stops

Hosting is the server. That’s it. A hosting company’s job is to keep that server switched on, patched, and reachable.

What a decent host does:

• Keeps the physical or virtual server running and connected
• Patches the server’s own operating system and software
• Takes server-level backups (usually kept for a much shorter window than you’d want, often 7 to 14 days)
• Issues and renews an SSL certificate, so your site shows the padlock rather than a “not secure” warning in the browser

Where it stops. Your host does not check whether your plugins still work together after WordPress releases a core update. It does not notice a broken contact form. It does not review your site visually after an automatic update reshuffles a layout. Managed WordPress hosts (Kinsta, WP Engine, Rocket.net and similar) often apply WordPress core updates automatically, which sounds like maintenance and gets marketed close to it, but “the server didn’t fall over” and “the site still works the way it did yesterday” are different claims.

The trap we see most often: an owner assumes “our host does updates, so we’re covered” and skips maintenance altogether. Eighteen months later a plugin conflict has been quietly breaking a booking form, nobody noticed because the site never went down, and the host never claimed to check for that in the first place. Hosting keeps the lights on. It was never meant to check what’s happening in the room.

An SSL certificate is worth a specific word here because it causes a specific kind of panic. Browsers now flag any site without one as “not secure,” which costs trust and clicks the moment it happens. A managed host will typically auto-renew it. If you’re on basic hosting without that included, put a reminder in your calendar, because certificates lapse quietly and the warning only shows up once a visitor is already on the page.

What maintenance covers

Maintenance is the recurring work that keeps the software itself healthy, distinct from the server it sits on.

Updates, applied carefully. WordPress core, plugins and themes release updates constantly, several times a month is normal for an active site. A proper maintenance service applies these on a schedule, tests anything significant on a staging copy first, and does a visual check afterwards to catch layout breakage before a visitor does. Auto-updates switched on with nobody watching the result isn’t maintenance, it’s a coin flip.

Off-site backups you can actually restore. Daily backups, stored away from the hosting account, kept for at least 30 days. The part almost everyone skips: someone has to test a restore occasionally. A backup that has never been restored is a guess dressed up as a safety net.

Uptime and security monitoring. Checks every few minutes, alerts going to an actual person, malware scanning, and a written commitment to clean the site up if it’s compromised rather than treating a hack as a separate billable emergency.

PHP and version housekeeping. Old PHP versions stop receiving security patches, and WordPress publishes its current requirements openly. Someone should be tracking your version and planning the upgrade in good time, rather than waiting for the host to force it through on a Tuesday afternoon and break a plugin nobody’s touched in three years.

A monthly report in plain English. What was updated, what was found, anything that needs a decision from you. If a report only ever says “all good,” ask what it’s actually checking.

Anything below that line starts drifting into hosting with a nicer name on it. Anything above “new page, please” starts drifting into support or development.

What support covers, and how to read “unlimited”

Support is the human on the other end who does jobs for you: a text change, a new staff photo, publishing a blog post you’ve written, a form that’s stopped sending.

Nearly every plan on the market advertises unlimited support requests. In practice that means unlimited small requests, usually anything under 20 to 30 minutes. Swap an image, fix a typo, update an opening hours notice. That’s a genuinely fair deal, and it’s roughly what we offer too.

The problem starts when the fair-use limit is buried in a terms page nobody reads, and a client discovers it exists the day they ask for something bigger and get told it’s chargeable. Get the fair-use wording in writing before you sign anything, and ask the hourly rate for work above the limit while you’re at it. A provider who’s upfront about both is telling you they intend to keep the relationship straightforward.

Support also has a ceiling on urgency, not just size. Ask what happens if something breaks at 9am on a Saturday. “Unlimited support” during office hours Monday to Friday is a different product to genuine emergency cover, and the two get marketed identically more often than they should.

What none of them cover

This is where most of the arguments between clients and providers actually start, and it’s rarely bad faith on either side. It’s a plan description that never spelled this part out.

Across hosting, maintenance and support, none of the three typically includes:

• New pages, new sections, or design changes
• Content writing and image sourcing
• SEO work beyond keeping the site technically healthy enough to be found
• Plugin and theme licence fees (usually re-billed at cost, since the licence sits under your name)
• Building or configuring new features: booking systems, membership areas, product imports
• Fixing something a third party broke, for example a payment gateway or shipping carrier changing its API without notice

None of that is unreasonable once you see it laid out. Maintenance keeps what you already have working. Support does small jobs quickly. Development changes what you have into something new. They’re priced differently for a reason: one is predictable and one genuinely isn’t, and no provider can quote a fixed monthly fee for unpredictable work without either overcharging most months or losing money on the busy ones.

The plans worth buying say all of this out loud, usually on the same page as what’s included. If a provider’s page only ever lists inclusions and goes quiet on exclusions, that’s the question to ask before you sign, not after.

What it costs in the UK

Rough bands, based on what we see across Edinburgh and Scottish small businesses. Hosting and maintenance are often bundled in a single “care plan” fee, so treat these as combined ranges rather than strictly separate line items.

Small brochure site (5 to 15 pages): £30 to £60 a month. Monthly update cycle, daily backups, uptime monitoring, a small allowance of support time. Anything under £20 tends to mean automated updates running with nobody checking the result afterwards, which is hosting wearing a maintenance label.

Shop or booking site: £100 to £300 a month. Weekly (sometimes more frequent) update cycles, staging tests before anything touches checkout or booking flows, faster response commitments, and enough support hours that a broken product page doesn’t sit unfixed for a week.

Membership sites, or anything holding personal or payment data: Similar to the shop tier or above, priced against the fact that a breach here costs more than a broken layout would.

What that monthly fee is actually insuring against: an outage during your busiest trading week, and a hack you hear about first from a customer rather than from your own monitoring. Priced against a single bad day, most of these bands look cheap.

Matching the level to your site

A six-page brochure site for a joiner in Leith and a WooCommerce shop carrying 400 products need genuinely different levels of attention, and paying for the wrong one in either direction wastes money or creates risk.

Brochure sites: monthly updates, daily backups, uptime monitoring. That’s honestly enough for most of them. Paying shop-tier prices for a site that only ever needs occasional text changes is money that would do more for the business spent elsewhere.

Shops and booking sites: weekly updates at minimum, staging tests before anything touches checkout, and a response commitment that holds at weekends. If checkout breaks on a Saturday morning, you need someone contactable, and reachability at that speed costs more than £30 a month, reasonably so.

Membership sites, anything holding personal data, or the page that brings in most of your enquiries: treat it like the shop tier even if it technically isn’t one. Price the plan against what a day of downtime, or a data incident, would actually cost you, not against the size of the site.

Ten questions to ask before you sign

1. Are updates tested on staging first, or applied straight to the live site?
2. Where are backups stored, how long are they kept, and when did you last test a restore?
3. What’s the response time, and does it hold at weekends?
4. What’s excluded, in writing, not just what’s included?
5. What’s the hourly rate for work outside the plan?
6. If I leave, do I get the site, the licences and the backups?
7. Who owns the hosting account, and is it in your name or theirs?
8. What happens to my site if I stop paying, immediately or after notice?
9. Where do backups actually live, geographically and in whose account?
10. What’s the escalation route out of hours if something breaks badly?

Question 6 catches the most people out. Some providers build on proprietary systems or hold plugin licences under their own account, which makes leaving slow and expensive by design rather than by accident. Question 7 is the quieter version of the same problem: if the hosting account is in the provider’s name, moving house later means renegotiating from a weaker position. Ask both on day one, while you’re still the one deciding whether to sign.

If you’ve inherited a site nobody’s been looking after

This comes up more than you’d expect: a new hire, a departing web person, or a business owner who realises nobody’s checked the site in two years. A practical first week looks like this:

1. Take a full backup immediately, before anything else touches the site.
2. Check the WordPress, PHP, plugin and theme versions against current requirements. Anything more than a year out of date needs a plan, not a panic update straight to production.
3. Confirm who owns the hosting account and the domain, and get login access to both in writing.
4. Run a malware scan. A site left unmaintained for a long stretch is a reasonable candidate for a quiet compromise nobody’s noticed yet.
5. Test whether a backup restore actually works, on a staging copy, before you need it for real.

If that list feels like more than a spare afternoon, it usually is, and it’s the exact situation a maintenance plan exists to prevent from happening again.

Where to go from here

A maintenance plan, proper hosting, and clear support hours together are insurance against the two failures that cost real money: an outage during your busiest week, and a hack you hear about first from a customer. The monthly fee buys you someone whose job it is to notice before you do.

Our website management plans cover updates, backups, monitoring and support time, with the exclusions written on the page rather than in small print. If you’re weighing up your current plan, or you’ve inherited a site nobody has looked at properly, get in touch and we’ll tell you honestly what level it actually needs, no hard sell.

Frequently asked questions

How much does a WordPress maintenance plan cost in the UK?
Small brochure sites typically sit between £30 and £60 a month. Shops and larger sites run £100 to £300, depending on update frequency, response times and included support hours. Anything under £20 tends to be automated updates with nobody checking the result.

Can I maintain my WordPress site myself?
Yes, if you’re comfortable taking a backup, updating on a staging copy, checking your key pages afterwards and watching for security notices. Budget an hour or two a month. Plenty of owners manage it for a year, then get busy, and the risk builds quietly in the background.

What’s the difference between hosting and a maintenance plan?
Hosting keeps the server running and patched. A maintenance plan checks the software on top of it, WordPress core, plugins, themes, and confirms the site still works the way it did yesterday. A host managing updates doesn’t mean nobody needs to check the result.

What happens if my site gets hacked?
Check the wording before you sign anything. A good plan includes malware removal and a restore from a clean backup at no extra cost. Some providers treat cleanup as a separate emergency job billed by the hour, which is worth knowing before it happens, not after.

Do I still need a maintenance plan if my host handles updates?
Managed hosts patch the server and often apply core updates automatically. They don’t check your pages still look right afterwards, don’t test plugin conflicts, and won’t rebuild a layout an update has broken. That gap is the job a maintenance plan actually does.

Can I change provider without losing my site?
You should be able to, provided the hosting account and any plugin licences sit in your name rather than the provider’s. Ask this before signing (see question 6 above), not when you’re trying to leave.

Is unlimited support really unlimited?
Almost never in the way it sounds. It usually means unlimited small requests, typically under 20 to 30 minutes each. Get the exact fair-use wording and the hourly rate above it in writing before you rely on it.

How often should updates actually run?
Monthly is reasonable for a brochure site with low traffic. Weekly, or immediately for anything flagged as a security release, is the right cadence for a shop, booking site, or anything handling customer data.