The bill that arrives every month, whether you ask for it or not
WordPress is free to install. WordPress is not free to own. The gap between those two statements is where most small businesses discover, usually between month 18 and month 36, that they're spending more on their website than they realized.
Here's the cost nobody puts on the proposal: the ongoing maintenance. The plugin updates, the security patches, the hosting tier upgrade that quietly became mandatory, the developer hours for the things that broke after a routine update at 11:47 PM on a Tuesday.
This is what it actually costs to keep a WordPress site alive and reasonably secure for a small business in 2026 — and what to do about it if the number surprises you.
The first year: the visible costs
Year one is the easy year. The numbers are visible because someone put them on a proposal.
For a small-business WordPress site, year one typically looks like this:
- Hosting: $20 to $80 per month ($240 to $960 per year) for managed WordPress hosting with daily backups and a security firewall
- Premium theme: $0 to $200 one-time, paid when you discover the free theme doesn't quite do what you need
- Essential plugins: $100 to $500 per year, the SEO plugin, the security plugin, the form plugin, the caching plugin, the backup plugin, the analytics plugin
- Initial build or redesign: $2,000 to $8,000 if you hired someone, or 40 to 80 hours of your own time if you didn't
Total first-year spend for a professionally-built site: $2,500 to $10,000.
That's the sticker price. It feels reasonable. Most small businesses approve it without much argument.
The second year: the costs that show up uninvited
Year two is when the second category of WordPress costs arrives. These are the costs that don't show up on the original proposal because they were theoretically "included" or "your responsibility" or "covered by the hosting tier."
Item one: the developer-of-record. At some point, something will break on your site that you cannot fix yourself. A plugin update that whitescreens the homepage. A security alert that locks you out of the admin panel. A contact form that suddenly stops delivering messages.
You will call a developer. The hourly rate is $75 to $150. The first call will probably be three to six hours. The second call, three to four months later, will be two to four hours. By the end of year two, you've spent $1,500 to $4,500 on unscheduled fixes that nobody planned for.
Item two: the plugin treadmill. WordPress runs on plugins. Plugins require updates. Updates occasionally break things. The compounding effect is roughly 30 to 60 hours of maintenance per year for a typical small-business site, twenty-five percent of which requires a developer rather than a CMS-tinkerer.
Item three: the hosting bump. The $20-per-month plan you started with will, around month 14, become insufficient. Your traffic grew, or your media library grew, or your plugin count grew, or your database grew. The hosting provider will suggest a tier upgrade. You will pay $40 to $200 per month instead.
Item four: the security event. About 4.7% of WordPress sites get compromised in any given year. The compromise is usually a backdoor inserted via an outdated plugin, used to send spam or host phishing pages. The cleanup is $500 to $2,500 if you catch it early, more if you don't.
The third year: the cost you stop noticing
By year three, the WordPress site has become a line item in your monthly books that you don't question. The hosting. The plugin subscriptions. The "developer of last resort" retainer. The annual security audit you started doing after the 2024 incident you don't talk about anymore.
Realistic year-three spend for a small-business WordPress site, not counting the rebuild you might be considering:
- Hosting: $480 to $1,200 per year (the bumped tier)
- Plugin subscriptions: $150 to $700 per year (the ones you realized you actually need to pay for)
- Security monitoring and remediation: $300 to $1,500 per year
- Unscheduled developer hours: $1,000 to $3,500 per year (the rate you negotiated after the second time you needed someone urgently)
- Content and design refresh: $1,000 to $4,000 if you do it, $0 if you don't (and the site starts to look dated)
Total year-three spend: $3,000 to $11,000.
The three-year total: the real comparison
Across three years, a small-business WordPress site, professionally maintained, costs:
- Year 1: $2,500 to $10,000 (the build)
- Year 2: $3,500 to $10,000 (the maintenance + the inevitable incident)
- Year 3: $3,000 to $11,000 (the steady-state churn)
Three-year total: $9,000 to $31,000, with the median around $16,000 for a typical five-to-fifteen-page small-business site.
The honest comparable for a hand-coded site over the same three years:
- Year 1: $4,000 to $15,000 (the build is more expensive because there's no template)
- Year 2: $200 to $2,000 (almost nothing to maintain, no plugin updates, no plugin conflicts)
- Year 3: $500 to $2,500 (the discretionary improvements you actually want)
Three-year total hand-coded: $4,700 to $19,500, with the median around $9,000.
The crossover point where hand-coded becomes cheaper is usually month 24 to 30. Before that, WordPress wins on upfront cost. After that, WordPress wins on comfort and ecosystem but loses on total spend.
Where the money actually goes
The line items that surprised me when I first saw a real three-year breakdown for a small business WordPress site:
- Approximately 40% of the total spend is the original build, which is a one-time cost
- Approximately 30% is the unscheduled developer hours (the things that broke after an update)
- Approximately 15% is the hosting and the plugin subscriptions you'll never fully audit
- Approximately 15% is the security, the backups, and the bits that keep the site from being compromised
The first number is the same for everyone. The second number is the one that's avoidable. The third number scales with the site. The fourth number scales with the threat landscape, which has been getting worse for the last decade.
What to do about it if you're already on WordPress
Three options, in order of disruption:
- Audit your plugin stack. Remove anything you cannot justify. Each plugin is a maintenance burden and a security surface. Site owners who audit down from 22 plugins to 8 typically see a 35% reduction in unscheduled developer hours within the next year, according to a 2025 WP Engine survey of 1,200 site owners.
- Move to managed hosting with proactive security. Hosts like Kinsta, WP Engine, or Pressable will patch your plugins for you and detect compromises faster. The hosting cost goes up 30% to 50%. The unscheduled developer cost usually goes down more than that.
- Rebuild to a hand-coded site. Only worth it if your site is essentially a brochure, you don't have a content workflow that depends on WordPress, and your current three-year spend is trending toward the upper end of the range.
What to do about it if you're starting from scratch
If you're a small business with a five-to-fifteen-page website that's primarily informational, the choice is closer than WordPress's 43% market share would suggest. WordPress is the right answer if you have a content team that needs to publish without a developer in the loop and you have a developer relationship that can keep the site healthy.
WordPress is the wrong answer if you're a small business with a tight budget, no dedicated developer, and a site that doesn't need to be updated by non-technical staff. The "free" WordPress install becomes a $10,000-per-year maintenance tier by year three in the median case, and you'll be paying it because the alternative — a site that doesn't work — is worse.
The 90-second honest budget
If you're planning a WordPress site for a small business, budget like this:
- Year 1: the build cost you were quoted, plus 30% for the things nobody quoted
- Year 2: the hosting cost, plus the plugin subscriptions, plus $2,000 to $4,000 for the developer when things break
- Year 3: the hosting cost, plus the plugin subscriptions, plus $1,500 to $3,500 for the next round of fixes
If that three-year total is acceptable for what you're getting, WordPress is fine. If it isn't, a hand-coded site is genuinely cheaper over the same window, and the trade-off is upfront cost for ongoing savings.
Last reviewed: August 2026. Reflects current WordPress core (6.5+), typical 2026 managed hosting pricing, and median 3-year costs for small-business sites with 5-15 pages. Specific numbers came from a 2025 WP Engine operator survey, Kinsta's published case studies, and the author's own client-site maintenance records.
