When someone weighs up whether to pay for website maintenance, the question usually comes down to: “does it really make sense to pay every month for something that might never happen?”
Fair question. Let’s flip it around and work out what the opposite scenario actually costs: it happening.
What actually happens when a WordPress site gets hacked
Forget the image of a skull flashing on screen. Attacks on small business websites are almost never like that, because they’re not personal — they’re automated. A bot scans millions of sites looking for a vulnerable version of a specific plugin, and when it finds one, it gets in.
What happens next is usually one of these, and all of them are quiet:
- Spam injection: hundreds of hidden pages selling pills or betting sites, hosted on your domain
- Redirecting your visitors to another site, sometimes only on mobile, or only when they arrive from Google
- Using your server to send junk mail or attack other websites
- Stealing data from your forms, or from customers if you run a shop
The key word there is quiet. You can be hacked for weeks without noticing, while the damage keeps piling up.
The bill, broken down
These are the real costs a small business takes on when it happens. The figures below are indicative and vary a lot case by case, but they give you a sense of the scale.
1. Technical cleanup: €300–1,200
Cleaning up an infected site isn’t a matter of deleting one file. Someone has to track down every backdoor the attacker left behind (there are usually several, hidden in different places), check the database, review the admin accounts, and make sure the same door doesn’t stay open next time.
It’s forensic work and it’s billed by the hour. And if there’s no clean backup to fall back on, the site has to be rebuilt by hand.
2. Days without a working site: variable, and usually the most expensive part
This is where the bill really adds up, and where almost nobody thinks to look. Work out how many enquiries, quote requests or orders come through your site in a normal week. Multiply that by the number of days it was down or infected.
For a clinic, an estate agency or an online shop, this alone usually outweighs the cost of the cleanup.
3. Getting your rankings back: weeks or months
This is the cost that stings most, because you don’t pay it in money — you pay it in time.
When Google detects malicious content, it flags your site in search results with a “This site may be hacked” warning. Clicks collapse. And once you’ve cleaned up, you don’t just bounce back: you have to request a review and wait. Rankings that took years to build can take months to recover.
If you were running Google Ads campaigns, those get suspended too.
4. Reputation: hard to price, but very real
If a customer lands on your site and their browser warns them it’s dangerous, that impression doesn’t wash off. And if you’re a clinic, or you hold customer data, that conversation gets even more uncomfortable.
5. Legal obligations if personal data is involved
This is the point everyone forgets. If personal data has been compromised, GDPR requires you to notify your national data protection authority within 72 hours, and in some cases the people affected too. With whatever fines that can bring if it’s handled badly.
Add it up and compare
A single serious incident, counting only the technical cleanup and a few days of downtime, easily runs to €500–1,500. That’s before SEO or reputation even enter the picture.
Preventive maintenance costs around €240 a year, at €19.90/month.
You don’t need to be precise with the numbers to see it: one incident pays for several years of prevention.
The honest part
Maintenance isn’t insurance, and we’re not going to sell it as one. Nobody can guarantee a website will never be attacked. Any site connected to the internet can be, and anyone who promises you otherwise is exaggerating to make a sale.
What maintenance does change is the odds and the outcome:
- Plugins stay up to date, so the known vulnerabilities — which is how the vast majority of automated attacks get in — stay closed
- If something does get through, there are recent backups: you restore in minutes instead of rebuilding over days
- There’s monitoring in place, so you find out early, not two weeks later
The difference between a scare and a full-blown crisis almost always comes down to that: whether there’s a clean, recent backup to roll back to.
If you’d like to see exactly what’s covered — what’s in and what isn’t, no small print — get in touch with our team and we’ll walk you through it.