WordPress maintenance in the UK: care plan or retainer, and what each really costs

Where the risk on a WordPress site comes from

Not from WordPress itself, mostly. Patchstack, a WordPress security company, counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, up 42% on the year before. 91% were in plugins and 9% in themes. Core had six, all low risk.

Two of their other findings decide what maintenance has to be:

• 46% of those vulnerabilities had no fix from the plugin's developer when they were made public.
• For the most heavily targeted ones, the median time from disclosure to mass exploitation was five hours.

So maintenance on WordPress isn't a monthly chore. It's watching the specific plugins on your site, updating fast when a fix arrives, removing plugins when it doesn't, and having a backup that restores when something goes wrong anyway. Underneath it all, PHP has to stay supported: 8.1 gets no more fixes, and 8.2's security support ends on 31 December 2026.

Care plan or retainer

The price gap isn't providers being cheap or dear. A care plan is software and a little time spread across many similar sites. A retainer is a developer's time on yours.

Every published price

The two things almost no plan includes

Most plans include the basics: nine of the ten update the site and scan for malware, and seven take daily backups and watch uptime. Two things are rare, and they're the two that matter most on a site that takes money.

Testing updates before they go live. Only one of the ten providers, WP Care Pros, says on its page that updates are tested on a staging copy first. Everywhere else, an update is applied to the live site and checked afterwards, if at all. On a WooCommerce store, that's how a plugin update breaks the checkout on a Friday evening.

A fast, committed response. Only Resolve Beyond publishes a response time under four hours, and it sells hours rather than a care plan. A five-hour window to mass exploitation and a "next working day" reply don't fit together.

What a retainer solves for the business

A care plan keeps WordPress up to date. It doesn't make anyone responsible for the site. For a business that relies on its website, and especially a WooCommerce store, that gap shows up in three ways.

Updates break things and nobody notices. A plugin update goes straight to the live site, the checkout or a form stops working, and the first anyone hears of it is a customer, or a quiet week of sales.

Fixes wait for a quote. Something small goes wrong, and it joins a queue for an agency that doesn't know the site, at an hourly rate, starting from scratch each time.

Risk builds up out of sight. Plugins that nobody uses, plugins their developers have abandoned, a PHP version approaching the end of its support. None of it is urgent until one of them is the way in.

A retainer replaces that with one person who knows the site, a fixed monthly cost and changes that are tested before they go live.

Why a CoullWorks retainer

• Every update is tested on a staging copy first. Only one of the ten providers above says that on its page. Here it's standard, because an update applied straight to a live shop is how checkouts break.
• A reply within four hours in UK business hours, written into the agreement. Only one other provider publishes a response under four hours.
• A developer, not a dashboard. You deal with DC directly: eighteen years in development, fifteen of them in ecommerce, with WooCommerce builds and fixes as everyday work. Custom code, payment gateways and integrations are covered by the same person who keeps the plugins current.
• Plugins watched, not just scanned. Vulnerability disclosures for the plugins actually on your site are acted on the same day when a fix exists. When it doesn't, the plugin is removed or replaced.
• You can see what was done. A short note each month: what was updated, what was fixed, what's coming.
• Everything stays yours, with no lock-in. Your hosting, domain and accounts stay in your name. It runs month to month, and if you stop, everything is handed over in full.

How it works

1. A free call about the site, its plugins and what it needs to do.
2. A first look at the site, its plugins and the setup, so the monthly figure fits it. A site that's badly out of date gets a separate catch-up quote first.
3. Paid monthly, in advance. The retainer is always paid up front for the month ahead. That buys a set amount of development time each month, reserved for your site, plus the maintenance below. Prices start at £200 a month, which includes two hours of development time. That keeps eyes on the site, and for a site that earns money I recommend at least two days a month as a minimum. The same price and terms cover WooCommerce and Drupal sites.
4. Each month, core, theme and plugin updates are tested on staging and then released, the site's files and database are backed up daily and before every update, uptime is monitored and the site is scanned for malicious code, checkout and payments are tested after every update on WooCommerce, and fixes and small changes are done inside the agreed time. A restore is tested every quarter.
5. A monthly note of what was done and what's coming.

Code, backups and hosting: who does what

The code is always the retainer's. WordPress, its themes and plugins, any custom code and the fixes they need.

Backups are shared. I back up the site's files and database every day and before every update, and test a restore every quarter. Your host keeps its own backups as well. Two independent copies, held by two parties, means neither one is the only safety net.

The server depends on how you host.

• Managed WordPress hosting, where the host runs the server for you: the host looks after the server, the PHP version and the database, and the retainer works alongside them.
• Self-managed hosting, your own server or cloud account: nobody else is looking after the server, so the retainer takes it on as well, from PHP versions and security updates to the database. That's priced as a custom retainer, after the first look.

Last week was a good example of why that matters. On 21 October 2026 PHP released fixes for two vulnerabilities, each rated 9.2 out of 10. Every WordPress site runs on PHP, so every site needed its server updated. On managed hosting, the host did it. On a self-managed server, it fell to whoever was responsible for the server, and on a site without a retainer that often means nobody. Sites still on PHP 8.1 or older got no fix at all, because those versions are end of life, and moving them to a supported version means checking that every plugin and theme still works on it first. PHP 8.2's security support ends on 31 December 2026, so the next of these moves is already due.

When the code and the server are looked after together, a PHP change is planned and tested rather than discovered.

A checklist for any quote

• Are updates tested before they go live, or applied and hoped for?
• What's the response time, and is it in writing?
• Do they watch the plugins on your site, or run a generic scan?
• When was a backup last restored?
• Is hosting included, and if so, who owns the account?
• What happens when you leave?

If you'd like a first look at your site, book a call. Slow stores, plugin conflicts and custom builds are on the WooCommerce development page.

How this was measured

Every price comes from the provider's own page, checked on 25 October 2026. Each page was scored against the same eight items, and an item only counts if the page says it's included, so a provider may well do more than its page claims. VAT treatment varies and is shown where the page states it. I found no independent survey of UK WordPress maintenance prices; this table is the nearest thing. WooManagers was left out because it prices in dollars and doesn't say where it's based.