A maintenance contract from €14 per month sounds cheap, and so do four update rounds a year from a developer. It usually gets expensive somewhere else: with the incident that neither of them prevented.
Julian Bräucker Updated: 9 min read Depending on the offer, website maintenance costs between €14 and €300 per month; four update rounds a year from a developer cost €900 to over €3,600 a year, depending on the website. Neither figure says much as long as it is unclear what you get for it.
The real costs come with the incident: the hacked website, the update that brings everything down on a Friday evening, the store that takes no orders for two days. Good maintenance is therefore not the cheapest kind, but the kind that prevents such incidents or undoes them in minutes.
Three rough groups of public offers for WordPress maintenance in Germany, seen in 2025/26, not a representative survey.
A proper update round is more than a click on “Update Plugins”.
| Website | Hours per round |
|---|---|
| Small WordPress website | 2 to 3 h |
| WordPress with WooCommerce or a page builder | 3 to 5 h |
| Shopware 6, smaller updates | 6 to 8 h |
WordPress: my estimate from practice. Shopware: six to eight hours for an average update according to the agency web-grips (2024), not counting setting up a test copy. Larger Shopware updates take more like one to three business days.
According to freelancermap (2026 analysis of its profiles), freelance software developers in Germany charge a median of €90 an hour; the average across all freelancers in 2025 was €104. Shopware agencies charge €110 to €180.
| Website | Calculation | Per year | Per month |
|---|---|---|---|
| Small WordPress website | 4 × 2.5 h × €90 | €900 | €75 |
| WordPress with WooCommerce | 4 × 4 h × €100 | €1,600 | €133 |
| Shopware 6 | 4 × 7 h × €130 | €3,640 | €303 |
Per update round less than two hours of a developer’s time, and every round is tested first.Usually costs about as much as four rounds by hand, but updates three times as often and checks every update on the copy first.Less than four update rounds a year at an agency, and monthly instead of quarterly.
For a week the website redirected visitors to casino sites. Five websites on the same server were infected, and so were the host’s backups.For a week the website redirected visitors to casino sites. Five websites on the same server were infected, and so were the host’s backups.For weeks, card details were skimmed at checkout through an outdated extension. It was the bank that reported it.
See the case See the case See the caseExample: 2 to 3 hours per round including backup, updates, clicking through and small fixes, at a median freelance developer rate of €90. Example: 3 to 5 hours per round for WordPress with WooCommerce or a page builder, at €100 an hour. Example: 6 to 8 hours per round for minor updates (an agency’s estimate), at an agency rate of €130. Incident costs: the example calculation from the case, without lost sales. Sources: freelancermap 2025, Patchstack 2026.
With Shopware, major version jumps come on top, and they are projects of their own. And four rounds a year are too few for security.
If you update once a quarter, a newly disclosed vulnerability stays open for 45 days on average, almost 90 in the worst case. A cheap maintenance contract with infrequent updates saves in the wrong place.
Security updates should be applied within a few days. Untested, they are a risk in themselves, so that takes a quick test.
Source: Patchstack, State of WordPress Security in 2026 (data for 2025)
Two typical scenarios, put together from real incidents. The figures are example calculations based on the assumptions shown.
A plugin update is left until the next maintenance date. The next day, an automated attack plants a backdoor, and for a week visitors on mobile are redirected to gambling sites. A customer notices it; by then, more websites on the same server are infected and the hosting provider’s backups do not go back far enough.
| Item | Assumption | Amount |
|---|---|---|
| Initial forensic analysis | external | €3,000 to €8,000 |
| Cleanup | 5 websites × €300 to €800 | €1,500 to €4,000 |
| Rebuild and hardening | 16 to 30 h × €90 to €120 | €1,440 to €3,600 |
| Data protection review | 5 to 15 h × €150 to €250 | €750 to €3,750 |
| Your own time | 20 to 40 h × €50 | €1,000 to €2,000 |
| Total | not counting lost inquiries | €7,690 to €21,350 |
Fourteen updates at once, and afterwards the website shows nothing but a critical error. Nobody can be reached over the weekend, inquiries through the contact form go nowhere, and on Monday an emergency call-out follows.
For comparison: a single incident like the first costs as much as many years of quarterly updates by hand.
Whatever is missing, you pay extra for when things go wrong.
Are updates checked on a copy before going live, or applied straight to the live website?
What exactly is checked after an update? Forms, checkout, the mobile view?
How quickly can a faulty update be undone, for the whole website, not just one plugin?
How quickly does someone respond when the website goes down or has been hacked, on weekends too?
How quickly are critical vulnerabilities closed, regardless of the regular schedule?
Is there a backup in a second location, in case the hosting account itself is affected?
Who has access to the website and the server, and can you trace who changed what?
Do you regularly learn what was updated and what the checks found?
The Doppelgänger costs a monthly flat fee, tailored to the scope, plus a one-time setup. You get a specific offer after a short conversation.
Your website on a dedicated server in Germany. Every update is checked there before it goes live.
Every release is a version of its own. Going back to the previous state takes seconds.
Availability, load times, known vulnerabilities, server, files, plugins and content of the live website.
An independent, encrypted backup in addition to your hosting provider’s backup.
For a WordPress website with updates every month or every two weeks, one checked round costs less than two developer hours.
For a Shopware store, the Doppelgänger with monthly updates costs less than four update rounds a year done by hand by an agency.
Public offers range from about €14 to €35 per month for plain plugin update services, €30 to €80 from freelancers and €100 to €300 from agencies (based on public offers seen in 2025/26). More important than the price is what is included: whether updates are tested first, whether a faulty update can be undone quickly, and how fast someone responds when there is a problem.
With backup, update, clicking through the most important pages and small fixes, I estimate two to three hours for a small WordPress website, and three to five with WooCommerce or a page builder. For an average Shopware 6 update, one agency puts it at six to eight hours, not counting setting up a test copy.
For security, usually not. With quarterly updates, a known vulnerability stays open for 45 days on average. According to Patchstack, the most attacked WordPress vulnerabilities are first exploited after a median of five hours. Security updates should therefore be applied within a few days, regardless of the maintenance schedule.
A simple fixed-price cleanup from German providers starts at around €250 to €300. What to do first in an emergency is covered in the guide WordPress hacked. If a break-in goes unnoticed for longer, analysis, rebuild, a data protection review and your own time come on top. In my example calculation for a website that redirected to casino sites for a week, that adds up to €7,690 to €21,350, not counting lost inquiries.
A test environment where updates are checked before going live, a fast rollback, guaranteed response times, a deadline for security updates, backups outside the hosting provider, clear rules on access and regular reports. Whatever is missing, you pay extra for when things go wrong.
A monthly flat fee, tailored to the scope: the number of websites, extensions and interfaces, the update schedule and response times, plus a one-time setup. You get a specific offer after a short conversation.
Drop me a line about which website or store you run and how updates are handled today. I will get back to you with an honest assessment and, if it is a fit, a specific offer.
Developed by Julian Bräucker, Düsseldorf. Servers in Germany.