The real cost of WordPress: what agencies actually pay

When an agency scopes a WordPress project, the build gets a number. Maintenance often gets a vague promise — “we’ll handle updates” — instead of a real budget line.

Even a basic managed care plan is a monthly per-site bill. Multiply that by every client site, and upkeep quietly becomes one of the largest recurring costs in the book. That is the routine cost. It does not include the day something actually breaks.

Plugins are what make WordPress flexible. They are also, by a huge margin, where WordPress gets compromised.

Patchstack’s 2026 report (2025 data): 11,334 new ecosystem vulnerabilities, up 42% year over year. 91% were in plugins. 46% had no developer fix the day they went public. Heavily exploited bugs hit mass exploitation on a 5-hour median.

Paid plugins were not safer. 76% of vulnerabilities in premium components were exploitable, and premium components carried three times more known-exploited holes than free ones. Paying buys support. It does not buy immunity.

An agency with a dozen sites, each running a dozen plugins, is watching hundreds of independently maintained packages it did not write. That is a security operation, billed or not.

Plugins get the security headlines. Themes cause a different pain: the update that looks routine and quietly breaks the front end.

A theme update ships, a plugin update ships alongside it, and somewhere in the overlap a shortcode stops rendering, a layout collapses on mobile, or custom CSS no longer applies. None of this shows up in a changelog. It shows up as a client email.

That is why competent WordPress maintenance needs staging, a test pass after every update, and someone who can roll back — for every site, every time core, a theme, or a dependent plugin changes. Clean updates are a probability, not a guarantee. The more plugins a site accumulates, the worse those odds get.

A smaller cost adds up a different way: the WordPress admin itself.

Fixing one word means logging in — ideally through 2FA, because core does not ship it and an open /wp-admin is a common attack target. It means a dashboard of plugin notices that have nothing to do with the task. It means finding the right block and hoping nothing else on the page shifted.

For a single change, that is minutes of overhead on a thirty-second fix. Multiply it by every small edit, on every client site, for every year the site is live.

ThemeIsle reviewed 340+ published opinions on the block editor (from 2022 on): 159 positive, 139 negative, 50 mixed — a coin flip on whether the person publishing your client’s content likes the tool they have to use.

The recurring complaints are a learning curve, interface complexity, unexpected bugs, and the editor slowing down on long pages.

This is not a one-time cost. It is paid again on every article, for every client, for as long as they publish. A price swap or a headline fix still means opening the block editor and hoping the save does not shift something else.

None of these costs is catastrophic on its own. A theme update rarely takes a site down outright. Gutenberg friction rarely blocks a post. A plugin hole does not guarantee a breach.

An agency is not dealing with one of these, once. It is dealing with all of them, continuously, across every client site — patching, testing, logging in, working around the editor, and staying ahead of a vulnerability count that grew 42% in a single year. That is developer time spent keeping software from breaking rather than building anything new.

The burden is a structural consequence of the architecture: a database-backed CMS, an admin login, a plugin ecosystem of independently maintained packages, and an editor that has to run inside all of it.

Unpushed moves the site off that stack once. No plugin layer to patch. No theme-and-plugin interaction to test after every update. No login screen standing between a one-word fix and it going live. The work that remains is the page — previewed, approved, checked.