WordPress maintenance: what your site really costs in 2026 — and when moving becomes cheaper

WordPress itself is free. A company site that has been growing for five or six years is not. Its running costs fall into four blocks, and most calculations online show only one of them:

1. Maintenance: updates, backups, monitoring, usually a monthly fee to an agency or freelancer. 2. Licences: annual subscriptions for paid plugins and themes, i.e. page builder, multilingual, SEO, forms, caching, security. 3. Hosting: from shared hosting for a few euros to a managed WordPress plan. 4. Time and incidents: your own hours for approvals, checking after updates and, in the worst case, cleaning up after an attack.

So if you only compare maintenance contracts, you compare apples with part of the fruit basket. The agencies ranking for “WordPress maintenance costs” sell maintenance themselves — licences appear there as “keeps running”, without an amount. That is no accusation, just the reason you have to add up the total yourself.

The following setup is an example, not a real client: a company site in German and English, built with Elementor, with a contact form, SEO plugin, caching and a security plugin. We see exactly this combination often on grown SME sites. All prices are official list prices for one website, as of 8 October 2026, net.

Around €1,400 a year doesn't sound dramatic. Over five years, though, it is around €7,000, without the site getting any better: the money holds the status quo, it builds nothing. And this calculation is missing the block that costs the most nerves.

According to W3Techs, WordPress runs 40.1% of all websites — which makes it the most rewarding target on the web. Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 42% more than the year before. 91% of them were in plugins, 9% in themes, only six in WordPress core itself.

Two numbers from the same report explain why maintenance “once a month” is not enough: 46% of vulnerabilities had no fix from the vendor by the time they were disclosed, and the weighted median time to first exploit was five hours. Every additional plugin is another door whose lock is maintained by someone else's team — or isn't.

July 2026 showed that core isn't immune either: with WordPress 7.0.2, 6.9.5 and 6.8.6, WordPress.org closed one critical and one high-severity flaw on 17 July, which became known together as “wp2shell”, and forced the updates out because of their severity. IONOS advised affected customers to restore data to its state before 18 July. Anyone without maintenance that reacted immediately that week had a problem — whatever the contract cost.

Two legal topics run alongside, without affecting every site: Germany's Accessibility Strengthening Act (BFSG) has applied since 28 June 2025 to e-commerce services for consumers, such as shops and booking flows; micro-enterprises with fewer than ten employees and at most €2 million turnover are exempt for services. And since 11 September 2026 the Cyber Resilience Act obliges software manufacturers, including commercial plugin vendors, to report actively exploited vulnerabilities; it applies in full from 11 December 2027. For you as an operator this is mainly one question: will your plugin vendors stay, or will some leave the market? An article is not legal advice; for your case, involve an expert.

The formula is simple, and still many providers get it wrong:

Months to break-even = migration price ÷ (cost today per year − cost afterwards per year) × 12

Cost afterwards means what you keep paying after the move: hosting, code maintenance and services that replace a plugin. It is never zero. A simple Next.js site runs, for example, on a small Hetzner cloud server for €5.49 net per month; maintenance and services come on top.

Example A is the honest normal case: financially, the move doesn't pay off. It can still be worth it, for security, less coordination after updates or because the design no longer depends on a builder licence — but then name that as the reason, not savings. Our rule of thumb: if the savings don't recoup the migration price in about three years, money is not an argument.

The worksheet above works with a pen and your accounting. It is faster with WP Exit, our free WordPress plugin. It reads your installation read-only: plugins and themes with version, content types, fields, forms, redirects, page builders and hosting environment. From that it calculates what your licences and connected services cost today, what remains after a move to Next.js, the fixed price for the migration and when it pays off.

Two things matter to us: the plugin only compares payments that can be verified, and it deliberately leaves hosting out of the comparison because you need it before and after. And if the move costs more than it saves, the report shows that as additional cost, not as savings. Before anything leaves your server, you approve the analysis; only the technical structure is transferred, no texts, no form entries, no credentials.

If you'd rather not install a plugin, you can enter your address in the free decivo Scan: it detects WordPress from the outside and shows where the site stands. And if you'd rather talk first: 15 minutes are enough to assess the move — we'll also tell you when it isn't worth it.