The verdict in three sentences
A serious WordPress maintenance contract for a business website in London or Paris costs between 80 and 450 EUR per month in 2026 (about 70 to 390 GBP), depending on the service level and the amount of development time included. What makes the difference is not how often updates run but a guaranteed recovery time (4 business hours), tested off-site backups and a bundle of 2 to 6 hours of changes per month. A site hacked twice in a year costs far more than a mid-tier contract at 200 EUR per month.
Why business WordPress sites get hacked
WordPress powers about 43% of websites worldwide, making it bots' number one target. In more than 9 cases out of 10, the flaw is not in WordPress core but in an outdated plugin (forms, slider, page builder) or a premium theme never updated. The classic scenario: a vulnerable plugin disclosed on Tuesday, mass-exploited by Thursday, and a corporate site redirecting to an online pharmacy the following Monday.
For a consulting firm, the consequences are concrete: site blacklisted by Google for 3 to 10 days, emails flagged as spam, contact form down, and sometimes a data protection authority notification due within 72 h if prospect data leaked.
The three maintenance contract tiers (2026)
| Service | Essential | Peace of mind | Premium |
|---|---|---|---|
| Indicative 2026 price | 80 to 150 EUR/month | 180 to 280 EUR/month | 300 to 450 EUR/month |
| Core, theme, plugin updates | Monthly | Weekly, after staging test | Weekly + security patches within 24 h |
| Backups | Daily, at the host | Daily, off-site 30 days | Daily off-site 90 days + quarterly restore test |
| Monitoring | Uptime | Uptime + malware + web application firewall | Same + monthly security report |
| Guaranteed recovery time | None (best effort) | 8 business hours | 4 business hours |
| Included development hours | 0 | 2 h/month | 4 to 6 h/month |
| Post-hack cleanup | Billed 400 to 1,200 EUR | Included once a year | Included, unlimited |
For a 20 to 50 page site with forms and a blog, the Peace of mind tier covers the essentials. Premium is justified as soon as the site generates leads every week or hosts a client area.
What hours outside the contract cost
The plan covers preventive maintenance. Everything else is billed by time spent, and that is where price gaps widen.
| Type of work | 2026 rate (London/Paris) | Usual volume |
|---|---|---|
| WordPress developer day rate (agency) | 450 to 650 EUR/day | On quote |
| Extra development hour | 70 to 95 EUR/h | 1 to 10 h/month |
| Full post-hack cleanup | 400 to 1,200 EUR | 1 to 2 days |
| Major PHP upgrade (8.1 to 8.3) | 300 to 900 EUR | 0.5 to 1.5 days |
| Page template redesign | 600 to 1,500 EUR | 1 to 3 days |
| One-off security audit | 800 to 1,800 EUR | 1.5 to 3 days |
A simple rule: if you use more than 4 extra hours every month, move up a tier. The included bundle is 20 to 30% cheaper than hours billed one by one.
Clauses to check before signing
Read the contract with these five questions in mind. Who holds the admin access and the hosting if the contract ends? Is the recovery time expressed in business or calendar hours? Are backups stored outside the main host? Can unused hours roll over to the next month? Is the termination notice longer than 3 months? A healthy contract answers all five clearly.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Sophie, office manager of a 25-consultant advisory firm in London, suffered two hacks in 12 months. Result: 2 cleanups at 900 EUR, 6 days blacklisted each time and, according to the business development partner, about 8 lost meeting requests per incident. With an average engagement of 12,000 EUR and a 15% conversion rate, each incident cost roughly 14,400 EUR of potential revenue.
She signs a Peace of mind contract at 220 EUR per month, i.e. 2,640 EUR per year, with 2 included hours that replace the 1,500 EUR of small requests billed the year before. Net cost of the contract: about 1,140 EUR per year, against more than 30,000 EUR of estimated losses in the year of the incidents.
FAQ
Does a maintenance contract prevent all hacks?
No, it sharply reduces the risk and above all the exposure window. With patches applied within 24 to 72 h and a web application firewall, more than 90% of automated attacks are blocked.
Can we do maintenance ourselves?
Yes, if someone spends 2 to 4 h a month on it and knows how to restore a backup. The risk is a breaking update on a Friday evening with no staging environment to test.
What happens if we switch agencies?
A good contract provides handover of access, the latest backup and documentation within 5 to 10 business days. Make sure the hosting account is in your name.
Does the price depend on the number of plugins?
Often, yes: beyond 25 to 30 plugins, agencies add 20 to 40% because each update needs more testing. A clean-up beforehand lowers the bill.
Should we rebuild the site rather than maintain it?
If the site is over 6 years old, runs on an abandoned page builder or needs more than 10 h of fixes per quarter, a 6,000 to 15,000 EUR rebuild becomes more cost-effective over 3 years.
Let's scope your project. We audit your WordPress site and propose a maintenance contract that fits, from 80 to 450 EUR per month, with an initial security review in 5 days. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
