Guide · for agencies

How to run a WordPress maintenance service that pays

Published 10 August 2026 · Kockpit

A WordPress maintenance service is the best recurring revenue an agency can build. The work is predictable, the clients already trust you, and the alternative you are selling against is neglect. It is also the easiest service to run at a loss, because everything about it goes wrong quietly: scope creeps a favour at a time, hours go unlogged, and the price set in year one is still there in year four. This guide is the version of the service that holds its margin.

What clients think they are buying

Nobody outside this industry wakes up wanting plugin updates. When a client signs a maintenance agreement, they are buying one feeling: someone is responsible for the website, and it is no longer me. That is why the client who never calls still renews, and why the cheapest competitor does not automatically win. They are not comparing task lists. They are deciding who they trust to hold the thing.

Sell to that. The pitch is not "monthly updates and backups", it is "you will never find out about a problem from a customer". But the feeling has to come with boundaries, because "someone is responsible" quietly becomes "someone will also change this banner, today, for free". The agreement needs to say what responsibility covers, in the client's language, and what happens to requests outside it: they are welcome, they are quoted, and they are scheduled.

What to actually include

The service has two halves: the work you do and the watching you sell. Both are real deliverables. The monthly work:

• Updates on a schedule. Core, plugins and themes, applied on a stated day, after a backup, with the site checked afterwards. The value is not clicking the button. It is that someone is there when the button breaks the layout.
• Backups that leave the building. Offsite, automatic, and test-restored on a schedule. A backup nobody has ever restored is a hope, not a backup.
• Monitoring, around the clock. Uptime, certificate expiry, domain expiry, and whether email records still point where they should. This is the half the client actually experiences, because it is where "we knew before you did" comes from.
• A security pass. Malware scanning, a check for exposed files and debug output, and a look at who still has admin accounts. Departed employees keep their logins with remarkable persistence.
• A small content allowance. Half an hour or an hour of small changes, stated as a number. This is the pressure valve that keeps small favours from becoming free work: there is a bucket, it has a bottom, and everyone can see it.

Just as important is what the plan excludes: redesigns, new features, new pages beyond the allowance, SEO campaigns, content writing. Excluding them is not stinginess. It is what makes "yes" mean something when you quote the work separately.

What to charge

Price the risk, not the hours. The monthly tasks on a brochure site and on a busy store are nearly identical. What differs is what an outage costs, and that is what the client is insuring against. Three tiers cover most portfolios:

• Brochure sites, where the site presents the business but does not directly produce revenue. Typically somewhere in the 75 to 150 US dollars a month range, or the local equivalent your market bears.
• Lead-generating sites, where a down site or a broken form is lost business. Typically 150 to 400 a month, and the client who asks why should be shown what a week of lost enquiries costs them.
• Stores and booking sites, where downtime is measured in money per hour. 400 and upward, with a response commitment attached, because that is what they are actually buying.

The exact numbers move by market. The structure does not: the tier reflects what the site is worth to its owner, the plan includes a stated number of hours, and anything beyond them is billable. An agency with thirty sites at an average of 200 a month runs a 72,000 a year revenue line before it sells anything else. That is what is being protected when the boundaries hold.

The monthly checklist

The checklist is the service. Run the same one, every month, on every site, and let the client see that it ran:

1. Backup taken and stored offsite, before anything is touched.
2. Core, plugin and theme updates applied, and the site clicked through afterwards.
3. One backup actually restored, somewhere disposable, to prove it restores.
4. Uptime for the month reviewed, and any incident noted with cause.
5. Certificate and domain expiry dates checked, with anything inside sixty days flagged.
6. DNS and email records compared against last month, so the surprise change surfaces.
7. Forms submitted and received, because a silent form is a silent leak.
8. Admin accounts reviewed, and anyone who left removed.
9. Hours logged against the allowance, so the number in the report is real.
10. The report sent, even when nothing happened.

Item ten is the one agencies skip and should not. A month where nothing went wrong is the product working, and it is invisible unless you say so. The quiet monthly report is what the renewal conversation stands on.

When to raise the price

Revisit every plan once a year, and immediately when the facts change: the brochure site gained a store, traffic tripled, the client's business now genuinely depends on the site that was a side project when you priced it. The tier was set against risk, and the risk moved.

Raising a maintenance price is easier than agencies fear, for the same reason the service sells at all: the client is not shopping on price, they are holding on to the person who holds the site. Come with the record. Twelve months of reports, incidents caught early, hours honestly logged. The conversation is five minutes long when the evidence is already in their inbox, and it is why the reporting habit above is worth more than any single month's work.

The tooling, briefly

Everything in this guide can be run from a spreadsheet and a calendar, and plenty of agencies do exactly that until the site count makes it impossible. The checking half is what Kockpit automates: it watches uptime, certificates, domains and DNS across every client site and keeps logged hours beside each retainer, which is most of the checklist running itself. But the guide stands either way. The service is the product; tooling just decides how many sites one person can responsibly hold.