The verdict in three sentences
A WordPress site left without updates for 2 years typically carries 40 to 70 outdated plugins and versions, several with known vulnerabilities. For an SME, a Security plan at 90 to 180 CAD per month is enough for a brochure site, but a site that generates leads or sales justifies an SLA tier at 375 to 600 CAD. The deciding factor is the guaranteed recovery time, which must be written into the contract.
The three plan tiers and their 2026 prices
The office manager of an equipment rental SME in Toronto discovers the website has not been updated since 2022. Before choosing a plan, she needs to understand what each tier covers.
| Service | Security | Growth | SLA |
|---|---|---|---|
| Monthly price | 90 to 180 CAD | 225 to 375 CAD | 375 to 600 CAD |
| Core and plugin updates | Monthly | Weekly | Weekly + urgent patches within 24 h |
| Backups | Weekly | Daily off-site | Daily off-site, 90-day retention |
| Uptime monitoring | Every 15 min | Every 5 min | Every minute |
| Included work time | 0 h | 1 to 2 h per month | 3 to 4 h per month |
| Guaranteed recovery time | 48 h | 24 h | 4 business hours |
| Monthly report | No | Yes | Yes + quarterly review |
The Security tier protects against common vulnerabilities but covers no content changes. The Growth tier suits SMEs that publish monthly and adjust their pages. The SLA tier is for sites where one hour of downtime costs orders.
What skipping maintenance costs
The calculation compares the annual plan with the probable cost of an incident. The figures below are 2026 orders of magnitude observed for SMEs with 10 to 50 employees.
| Incident | Estimated direct cost | Time back online without a plan |
|---|---|---|
| Hack with spam injection | 4,500 to 7,500 CAD | 3 to 7 days |
| Ransomware on hosting | 7,500 to 12,000 CAD | 5 to 10 days |
| PHP update breaks the site | 1,200 to 2,200 CAD | 1 to 3 days |
| Google blacklist (dangerous site warning) | 2,200 to 4,500 CAD + lost traffic | 1 to 2 weeks |
| Data loss without backup | Rebuild 9,000 to 18,000 CAD | 4 to 8 weeks |
| Customer data leak (PIPEDA) | Breach report + legal advice 3,000 CAD | Variable |
A site left unmaintained for 2 years carries an estimated annual incident risk of 15 to 25%. With an average cost of 7,500 CAD, the expected loss reaches 1,125 to 1,875 CAD per year, more than a Security plan at 1,620 CAD.
Clauses to check before signing
Require backup storage on a server separate from the main hosting, ideally in the same jurisdiction. Check that the recovery time is a results commitment with penalties (for example 10% of the monthly fee per 4-hour overrun), not a mere "acknowledgement". Get the out-of-plan hourly rate in writing, typically 90 to 135 CAD per hour in Toronto. Finally, reversibility must guarantee handover of access and a full backup within 5 days if you cancel.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Emily, office manager of an 18-employee event equipment rental company in Toronto, receives 35 booking requests a month through the site, with an average order of 1,800 CAD and 40% conversion. A 5-day outage would cost about 6 requests, so 6 x 40% x 1,800 CAD = 4,320 CAD in revenue, plus 6,000 CAD in cleanup. The Growth plan at 300 CAD per month costs 3,600 CAD per year. A single avoided incident pays for nearly three years of the plan.
FAQ
What is the minimum budget to maintain a WordPress site?
Plan for 90 CAD per month for a simple brochure site with monthly updates. Below that, off-site backups and monitoring are rarely included.
Are automatic updates enough?
No. Roughly 5 to 10% of plugin updates cause a visible conflict. A provider tests on a staging copy before applying changes live.
What does a 4-hour SLA mean?
The provider commits to restoring the site within 4 business hours of the report. Beyond that, penalties of 5 to 10% of the monthly fee apply per overrun block.
Should I update a site left 2 years without maintenance?
Yes, in steps: audit, backup, PHP upgrade, then plugins. Budget a one-off catch-up of 600 to 1,350 CAD before the monthly plan starts.
Can I cancel a maintenance retainer at any time?
Most contracts are annual with 1 to 3 months' notice. Negotiate a 3-month trial period and a reversibility clause.
Let's scope your project. We audit your WordPress site and propose a plan from 120 to 525 CAD per month with a priced catch-up and a written SLA, live within 7 days. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
