When someone considers whether to pay maintenance for their website, the question is usually: “Is it really worth paying every month for something that may never happen?”
It's a fair question. Let's turn it around and calculate what the opposite scenario costs: let it happen.
What exactly happens when a WordPress is hacked
Forget the image of a skull on the screen. Attacks on SME websites are almost never like this, because they are not personal: they are automatic. A bot scans millions of sites looking for a vulnerable version of a particular plugin, and when it finds it, it enters.
What he does next is usually one of these things, and they are all silent:
- Inject spam: hundreds of hidden pages selling pills or gambling, hosted on your domain
- Redirect your visitors to another website, sometimes only from mobile or only if they come from Google
- Use your server to send spam or attack other websites
- Steal data from forms or customers if you have a store
The key is quiet. You can be hacked for weeks without noticing, while the damage accumulates.
The invoice, item by item
These are the real costs that a small business in Spain assumes when it happens. The amounts are indicative and vary greatly depending on the case, but they serve to get an idea of the order of magnitude.
1. Technical cleaning: €300 – €1,200
Cleaning an infected website is not deleting a file. You have to find all the back doors that the attacker has left (there are usually several, hidden in different places), review the database, check the administrator users, and make sure that he does not enter through the same place again.
It is forensic work and is charged by the hour. If there is also no clean backup, you have to rebuild by hand.
2. Days without website: variable, and usually the most expensive
This is where the bill skyrockets and where almost no one watches. Calculate how many contacts, quotes or orders you receive through the website in a normal week. Multiply by the days it was down or infected.
For a clinic, a real estate agency or an online store, this almost always exceeds the cost of cleaning.
3. Recover positioning: weeks or months
This is the cost that hurts the most because it is not paid with money, it is paid with time.
When Google detects malicious content, it flags your website in the results with a “This site may be dangerous” warning. The click subsides. And when you clean, you don't automatically come back: you have to request a review and wait. Recovering positions that took years can take months.
If you had Google Ads campaigns, they are also suspended.
4. Reputation: incalculable but real
If a customer enters your website and their browser warns them that the site is dangerous, that impression is not erased. And if you are a clinic or manage customer data, the conversation is even more uncomfortable.
5. Legal obligations if there is personal data
This point is always forgotten. If personal data has been compromised, the RGPD requires notifying the Spanish Data Protection Agency within 72 hours, and in some cases also informing those affected. With the sanctions that this may imply if it was done wrong.
Add and compare
A single serious incident, counting only the technical cleaning and a few days of downtime, is easily around €500 to €1,500. Not counting SEO or reputation.
Preventive maintenance costs about €240 per year at €19.90/month.
There is no need to be very careful with the numbers: a single incident pays for several years of prevention.
What needs to be said honestly
Maintenance is not insurance and we are not going to sell it as such. No one can guarantee that a website will never be attacked. Any website connected to the Internet can be, and anyone who promises otherwise is exaggerating to sell.
What does change with maintenance is the probability and the outcome:
- The plugins are up to date, so the known vulnerabilities (which is where the vast majority of automated attacks come in) are closed
- If something gets in, there are recent backups - restore in minutes instead of rebuilding in days
- There is monitoring, so you find out soon and not two weeks later
The difference between a scare and a crisis is almost always that: whether there is a clean and recent copy to go back to.
If you want to see what exactly is included, we have it detailed on the WordPress maintenance, with what comes in and what doesn't. No fine print.
Would you prefer us to review it? Take a look at our WordPress maintenance service either tell us what your website needs and we will respond to you in less than 24 hours.