tools.ceo

WordPress maintenance cost vs running a custom site

What you actually pay each year to keep each one safe and working.

Custom code vs WordPressUpdated October 28, 20264 min readBy tools.ceo editorial

Chart, ruler and pen on a desk
Photo: Unsplash

The short answer

A business WordPress site typically carries managed hosting, premium plugin renewals, a security service and regular update work. A well-built custom site carries hosting, a CMS plan if used, and a few dependency updates a year. Over three years the custom site often costs less to run, even after a higher build cost.

  • List every renewal: hosting, theme, plugins, security, backups.
  • Count the hours spent on updates and fixing what updates break.
  • Custom sites still need dependency updates; budget for them.
  • The cheapest plan is the one that keeps the site patched.

Custom site vs WordPress at a glance

What mattersCustom siteWordPress
HostingStatic or small app hostingManaged WordPress plan
LicencesCMS plan if hostedPremium theme and plugins
SecurityPlatform defaults plus reviewsWAF or security plugin
Update workA few times a yearWeekly or monthly

Build a real budget

Pull last year’s invoices for hosting, licences and maintenance retainers. Add internal hours. Most owners are surprised by the total.

Why WordPress upkeep is frequent

Core, themes and plugins release fixes on their own schedules. Security fixes need applying within days, and each update can conflict with another plugin.

What custom upkeep looks like

A developer updates the framework and dependencies, runs the tests and deploys. Automated tools such as Dependabot flag vulnerable packages. Sources: GitHub Dependabot

Our verdict

Compare three-year totals including time. Pick the platform you will actually keep patched.

Questions people ask

Do custom sites need maintenance?

Yes, but less often: framework and dependency updates, plus content changes.

Is a maintenance retainer worth it?

If nobody in-house applies updates, yes. An unpatched site is the bigger cost.

Can I skip updates if the site works?

No. Unpatched plugins and dependencies are a common way in for attackers.

No affiliate links on this page at publication. Product names link to official sites so you can check current pricing. How we work.

Keep reading.

New guides, about once a fortnight.

Websites, security and AI for people who pay for the software. One email when something is worth your time, nothing else.

Free. Unsubscribe from any email.