WordPress Hosting vs. Maintenance: What You’re Actually Paying For

Two Different Products, One Confusing Invoice

Most business owners we talk to have a single line item in their budget called “the website” that covers both hosting and maintenance, and no clear sense of which one is doing what. That’s understandable. Almost every provider bundles them, and almost nobody explains the split.

It matters because they solve different problems, they fail in different ways, and when you’re comparing quotes, the bundle is where the differences hide.

Hosting Is Where the Site Lives

Hosting is server space plus the infrastructure around it. At minimum, a host gives you a machine that serves your files when someone types your domain. Beyond that minimum, the differences are enormous.

Shared hosting — $5 to $20 a month. Your site sits on a server with hundreds of other sites, sharing CPU and memory. It works until one of your neighbors gets a traffic spike, at which point your site gets slow for reasons entirely outside your control. Support is a ticket queue.

VPS or cloud hosting — $40 to $200 a month. Dedicated resources, better performance, but you’re responsible for server configuration, security patching, and PHP version management. Fine if you have someone technical. Expensive in hidden labor if you don’t.

Managed WordPress hosting — $30 to $300+ a month. The host handles server-level everything: caching, CDN, security at the edge, automated backups, staging environments, PHP updates. You give up some configuration freedom and get back a lot of hours.

We host every client site on WP Engine, on dedicated plans. That decision is about failure modes more than speed. When a shared host has a bad night, you find out from a customer. When a managed host has a bad night, there’s a status page, a support engineer who knows WordPress specifically, and a restore point from four hours ago.

Maintenance Is Whether Anyone Is Watching

Hosting keeps the lights on. Maintenance is whether anyone notices when a bulb goes out.

WordPress ships core updates several times a year and plugin updates constantly. Each one is a small risk. Applied blindly, updates break things — a plugin update changes a function signature, a theme depends on it, and a page goes white. Not applied at all, you accumulate known vulnerabilities that automated scanners find within days of disclosure.

Real maintenance means someone is:

• Testing updates before applying them, ideally on a staging copy rather than on your live site during business hours
• Watching for vulnerability disclosures in the specific plugins you run, and patching the urgent ones fast
• Monitoring uptime from outside your network, so an outage generates an alert rather than a phone call
• Checking that backups actually restore, because an untested backup is a hypothesis
• Watching performance drift, since sites get slower gradually as content and plugins accumulate
• Handling the small changes — a new staff bio, an updated phone number, a seasonal banner

That last one is worth its own paragraph. The most common reason a maintenance plan pays for itself has nothing to do with security. It’s that a business with no maintenance relationship simply stops updating its website. The hours page stays wrong for a year because nobody wants to figure out how to log in. The site quietly stops being accurate, which is a slower and more expensive failure than a hack.

What Happens When You Have One and Not the Other

Great hosting, no maintenance. The site stays up and stays fast. It also stays on WordPress 6.4 with eleven outdated plugins, one of which has a disclosed authentication bypass. The host’s edge security might block the exploit. It might not. Meanwhile the content goes stale because there’s no habit of changing it.

Great maintenance, cheap hosting. Everything is patched and current, and the site takes four seconds to load because it’s on a shared server with a noisy neighbor. Your developer spends their monthly hours fighting the infrastructure instead of improving the site. This is the more frustrating of the two, because the work is being done and the results still aren’t there.

Neither is a disaster on day one. Both compound.

Reading a Bundled Quote

When someone quotes you a monthly number, the questions worth asking are specific:

1. What host, and what plan tier? “Managed WordPress hosting” spans a 10x price range. The specific plan tells you what you’re getting.
2. Is there a staging environment? If no, updates are being tested on your live site or not at all.
3. How often are backups taken, how long are they kept, and where? Daily with 30-day offsite retention is a reasonable baseline. Weekly, stored on the same server, is not really a backup.
4. How many support hours are included, and do they roll over? This is the line that determines whether you’ll actually use the relationship or ration it.
5. Who do I call at 9pm on a Saturday, and what happens? The answer tells you more about the plan than the feature list does.
6. If I leave, what do I take with me? You should get a full export of files and database, no argument.

That last question is the one that separates a service from a trap. Ask it before you sign, not after.

What We Include, Specifically

Our maintenance plans and managed hosting come as one monthly line item, typically $150 to $250 depending on the site. That covers:

• WP Engine dedicated hosting with global CDN and edge security
• Daily automated backups, offsite, 40 restore points, plus manual backups before any risky change
• Core and plugin updates tested on staging first
• Malware scanning and removal
• Uptime monitoring with alerting
• A monthly support allowance that compounds if unused, up to a cap

The compounding support allowance is deliberate. It means a client who doesn’t need anything in March isn’t penalized for it in April, and it removes the incentive to invent busywork to “use up” hours.

The Test

Here’s a quick way to find out what you currently have. Send your provider this email:

“Can you tell me when my site was last backed up, when plugins were last updated, and what WordPress version we’re running?”

If you get a specific answer within a day, you have maintenance. If you get a vague reassurance, or a question about which site you mean, you have hosting and an invoice.

If you’re not sure which one you’re paying for, send us the URL and we’ll tell you what we can see from the outside — WordPress version, plugin exposure, performance, and whether anything looks unpatched. No charge, and no obligation to move.