The verdict in three sentences
For a 25-employee SME in Berlin, a serious WordPress maintenance retainer costs EUR 60 to 120 a month (excl. VAT) for security alone, and EUR 180 to 350 with 2 hours of improvements included. What separates a good contract from a bad one is not the price but the guaranteed recovery time, from 4 h to 24 h depending on the plan, and tested off-site backups. A single hack costs EUR 600 to 1,800 to clean up, plus days offline, often more than a full year of maintenance.
What each retainer level really covers
The managing director who has just been hacked through an outdated plugin often finds that the previous contract amounted to "updating when someone remembers". A maintenance contract must list tasks, their frequency and quantified commitments. With 25 plugins installed, which is common for a brochure site with forms, a page builder and SEO tools, vulnerability monitoring becomes a weekly job.
| Service | Security plan | Improvements plan | Premium plan |
|---|---|---|---|
| Monthly price | EUR 60 to 120 | EUR 180 to 350 | EUR 400 to 700 |
| Core and 25 plugin updates | Monthly | Weekly | Weekly, on staging |
| Off-site backups | Daily, 30 days | Daily, 90 days | Hourly database, 90 days |
| Uptime monitoring | Every 5 min | Every 1 min | Every 1 min |
| Guaranteed recovery time | 24 business hours | 8 business hours | 4 h, 7 days a week |
| Included improvements | None | 2 h a month | 5 h a month |
| Hack clean-up | Billed separately | Included once a year | Included |
The security plan is enough for a stable brochure site. As soon as the site generates quote requests or sales, a recovery time of 8 h or less becomes a profitability criterion.
The real cost of a hack versus the price of a contract
The vast majority of WordPress hacks come from outdated plugins and themes, very few from core itself. The typical scenario: a vulnerable form plugin, a code injection, redirects to fraudulent sites, then a Google Safe Browsing block.
| Post-hack cost item | 2026 range |
|---|---|
| Code and file clean-up | EUR 600 to 1,800 |
| Restore and hardening | EUR 300 to 800 |
| Google blocklist review request | 1 to 3 days |
| Lost leads (B2B SME site) | 10 to 40 requests a week |
| Managing director's time | 6 to 15 hours |
| GDPR breach notification to the Berlin DPA | Within 72 h, mandatory |
On top of the direct costs comes lost ranking: a site flagged as dangerous often loses part of its organic traffic for several weeks. These amounts are 2026 orders of magnitude observed on SME sites.
Clauses to check before signing
A maintenance contract is judged on its written commitments. Check that the provider specifies the list of covered plugins, where backups are stored (off the hosting server), how often restores are tested, the response time and the recovery time, the commitment period (12 months with 1 to 3 months' notice is standard) and the handover of access at the end of the contract. Ask for a monthly report: updates done, incidents, uptime, improvement hours used. A provider who refuses to share this report probably does not control their process. In Germany, also check that a data processing agreement (AVV) is signed.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Jonas, managing director of a 25-employee office fit-out SME in Berlin, was hacked in March. Clean-up invoice: EUR 1,400, plus 4 days of the site redirecting to fraudulent pages. His site generates an average of 12 quote requests a week, with a 10 % close rate and an average deal of EUR 8,000. Four days down means about 7 lost requests, statistically 0.7 projects or EUR 5,600 in revenue. He signs an improvements plan at EUR 240 a month, EUR 2,880 a year, with 8 h guaranteed recovery and 2 monthly hours he uses to add project case pages. The contract pays for itself as soon as it prevents a single incident of this kind.
FAQ
What is the average price of WordPress maintenance for an SME in 2026?
Budget EUR 60 to 120 a month for security and backups, and EUR 180 to 350 with 2 hours of improvements. Above EUR 400, the plan usually includes 7-day on-call support.
How much does it cost to clean a hacked WordPress site?
Between EUR 600 and 1,800 depending on the infection, plus EUR 300 to 800 for hardening. Getting back online takes 1 to 4 days.
Can we do the maintenance ourselves?
Yes for a site with fewer than 10 plugins, provided updates are tested on a copy. With 25 plugins, expect 3 to 5 hours of internal work a month, which quickly exceeds the cost of a retainer.
Where should backups be stored?
Off the hosting server, with a second provider, with at least 30 days of retention. A restore should be tested at least once a quarter.
What commitment period should we accept?
12 months with 1 to 3 months' notice is standard. Refuse 36-month contracts with no exit clause tied to service quality.
Let's scope your project. Tell us your plugin count, host and expected volume of improvements, and we will propose a maintenance retainer with quantified commitments. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
