Magento maintenance in the UK: what a retainer covers, and what it really costs

The numbers

• 12 providers publish UK Magento support prices; 11 give a monthly figure, one charges hourly with no minimum.
• Entry prices run from £99 to £750 a month. The median is £450.
• Plans that include five or more of the eight things on our checklist cost £500 to £1,150, median about £700.
• Hourly rates run from £86 to £110, median £95.
• Four more providers, Outer Edge, Envisage Digital, Absolute Design's tiered packages and Magento Services' Enterprise plan, don't publish a price.

Every published price

Packages, retainers and custom quotes

The cheap end mostly watches. The plans under £300 tell you a patch exists, or give you a ticket queue. Of the four, only EveryHost's and Magento Services' pages say they apply patches as part of the price. Magento Patches charges per installation. That's fine for a store with a developer who'll act on the alert. For anyone else, the alert is the start of a separate bill.

The middle buys hours. Limely, Resolve Beyond and Affinity sell time at £86 to £110 an hour with a monthly minimum. You get a team that knows the code, and the work is whatever you point it at. What's done each month depends on you asking.

The upper packages buy outcomes. Deploy, Absolute, SKU Digital and CTI write the maintenance into the plan: patches applied, extensions kept current, an upgrade each year on some. They cost £500 to £1,150, and the higher price usually reflects faster response or round-the-clock cover.

Custom quotes come from providers who size the work first. That's not a bad sign on its own, since Magento stores vary more than WordPress sites do. But it leaves you comparing quotes without a market to check them against, which is what this table is for.

What Magento maintenance has to cover in 2026

The work isn't the same every month, because Adobe and PHP set the calendar:

• Adobe security patches. Adobe releases security patches at least once a year for every supported version, a full patch each May, and isolated security patches as needed in between.
• The ground underneath. From Magento 2.4.9, and in patch releases after 2.4.5-p16, 2.4.6-p14, 2.4.7-p9 and 2.4.8-p4, Adobe requires Valkey for the cache in place of Redis. Search has to be OpenSearch. PHP moves with each version.
• PHP itself. PHP shipped fixes for two critical vulnerabilities on 21 October 2026. PHP 8.1 gets none, because it's end of life, and Magento 2.4.4 and 2.4.5 only run on 8.1. PHP 8.2's security support ends on 31 December 2026.
• Support dates. Magento Open Source 2.4.6 has had no security patches since 11 August 2026. 2.4.7's standard support ends in May 2027.

A retainer that only applies patches will keep a store safe this month and still leave it facing an upgrade project next year. The plans that include an upgrade, or at least a written plan for one, are the ones that avoid the emergency.

What a retainer solves for the business

Most Magento stores don't need more development. They need someone to own the store's health, so that nothing important waits for something to break. Without that, three things tend to happen.

Patches wait. Nobody is watching Adobe's releases, so a security fix sits uninstalled until a scan, a customer or a card-skimming attack finds the gap.

Small problems queue up. A broken filter, an extension that stopped syncing, an error in the logs nobody reads. Each one is minor. Together they cost sales every day they stay open.

Upgrades become emergencies. A store that skips a year of updates doesn't face a small job later. It faces a version with no patches left, and a rushed project to get off it. The published emergency rates show the cost of that: £200 an hour at one provider in the table above, against £100 to £110 for planned work.

A retainer swaps all three for a fixed monthly cost, a known person and a plan.

Why a CoullWorks retainer

• One senior developer who knows your store. You deal with DC directly: eighteen years in development, fifteen of them in ecommerce, certified on Magento since Magento 1. No account manager, no ticket passed to whoever is free.
• Every change goes through staging first. Patches and extension updates are tested on a copy of your store before they're released, in an agreed window, with a way back if something misbehaves.
• A reply within four hours in UK business hours, written into the agreement.
• You can see what was done. A short note each month: what was patched, what was fixed, what's coming, and what I'd change.
• Everything stays yours. Hosting, the code repository, the domain and payment accounts stay in your name. I work in them with access you grant.
• No lock-in. It runs month to month. If you stop, the code, access and documentation are handed over in full.

How it works

1. A free call about the store, the extensions and what worries you.
2. A first look at the code and the setup, so the monthly figure is set on what's actually there. If the store is several versions behind, you get a separate catch-up quote first, because bringing a store up to date is a project, not maintenance.
3. Paid monthly, in advance. The retainer is always paid up front for the month ahead. That buys a set amount of development time each month, reserved for your store, plus the maintenance below. Prices start at £600 a month, which includes one day of development time. That is enough to keep eyes on the store. I highly recommend a larger retainer, typically a minimum of five days a month.
4. Each month, Adobe security patches and isolated patches are applied after a staging check, extensions and dependencies are updated and tested, a backup of the code and database is taken before every release, uptime, errors, cron and checkout are monitored with alerts coming to me, and bugs and small changes are fixed inside the agreed time. A restore is tested every quarter.
5. A monthly note, and a written plan for the next Magento version with its date. The upgrade itself is quoted before it starts.

Code, backups and hosting: who does what

The code is always the retainer's. Magento itself, its extensions, your custom modules and the fixes they need.

Backups are shared. I take a backup of the code and database before every release, and test a restore every quarter. Your host keeps its own server backups as well. Two independent copies, held by two parties, is the point: neither one is the only thing standing between the store and a bad day.

The server depends on how you host.

• Managed hosting, where a Magento host runs the server for you: the host looks after the server, the PHP version, the database, OpenSearch and the cache, and the retainer works alongside them.
• Self-managed hosting, your own server or cloud account: nobody else is looking after the server, so the retainer takes it on as well, from PHP versions and security updates to the database, OpenSearch and the cache. That's priced as a custom retainer, after the first look.

Last week showed why the server can't be nobody's job. On 21 October 2026 PHP released fixes for two vulnerabilities, each rated 9.2 out of 10. Applying them was a server job, not a Magento one. On managed hosting, the host did it. On a self-managed server, it fell to whoever was responsible for the server, and on a store without a retainer that often means nobody. For stores on Magento 2.4.4 or 2.4.5, which only run on PHP 8.1, there was no fix to apply at all: PHP 8.1 is end of life, so the only way out is a Magento and PHP upgrade together. Valkey replacing Redis in recent Magento releases is the same kind of change: it sits on the server, but the store can't upgrade without it.

When the code and the server are looked after together, these changes get planned together instead of discovered separately.

How to compare quotes

Whoever you choose, ask:

• Do you apply security patches, or tell me about them? The difference is most of the price gap.
• How fast after an Adobe release, and is that written down?
• When was a backup last restored, and can you show me?
• What happens to unused hours? Rollover, or lost?
• Is an upgrade included, planned, or extra?
• Whose name are the accounts in, and how do I leave?

If you'd like a first look at your store, book a call. The version dates are in which Magento versions are still supported, and upgrade work is on the Magento development page.

How this was measured

Every price comes from the provider's own page or its own UK government G-Cloud listing, checked on 25 October 2026. Hourly retainers are shown at their monthly minimum. Each page was scored against the same eight items, and an item only counts if the page says it's included, so a provider may well do more than its page claims. VAT treatment varies and is shown where the page states it. There's no independent survey of UK Magento support prices that I could find; this table is the nearest thing.