Running a WordPress website costs most small businesses somewhere between £400 and £1,200 a year. Domain and hosting together are the small part of that, usually £60 to £200. Nearly everything else you are paying for is the work of keeping the site safe, current and actually working.
That last sentence is the one that catches people out, so it is worth explaining properly. It is also the difference between a website that is still earning its keep in year three and one that quietly stopped working in month eight and nobody noticed.
This is the part everyone expects. Your domain name, renewed annually. Your hosting, which is where the site physically lives. An SSL certificate, which puts the padlock in the address bar and which any decent host now includes at no charge.
Together these usually come to £60 to £200 a year for a small business site. It is a small number, and it is the number people have in mind when they assume a website is nearly free to run.
WordPress powers a very large share of the web, which is exactly why it is a target. In 2026, more than 250 new plugin vulnerabilities are being disclosed every week. Around 23% of them are still unpatched thirty days after disclosure. Roughly 35% of plugins in the official directory have not had an update in over a year.
None of that is a reason to avoid WordPress. It is the reason the annual figure is not £100.
What you are actually buying for the rest of that money is somebody paying attention.
Updates, applied carefully. WordPress core, your theme and every plugin update on their own schedule. Applying them is easy. Applying them without breaking the layout of your booking page is the skill, and it is why updates should be tested rather than clicked through on a Friday afternoon.
Backups that have been tested. A backup nobody has ever restored is a rumour, not a backup. This is the cheapest insurance policy your business has and the one most often taken on trust.
Monitoring. Knowing your contact form stopped sending in week two, rather than finding out in month four when you wonder why nobody has been in touch. In my experience this is the most expensive failure in the whole list, because it is invisible and it costs you enquiries the entire time.
Security. Firewall, login protection, malware scanning, and someone who notices when something odd appears.
Small changes. Prices, opening hours, a new team member, a photo. Sites that stay accurate get used. Sites that go stale get quietly abandoned by their owners.
Sucuri’s data on sites compromised in 2025 found that 78% of them had at least one plugin running an outdated version. Plugins, rather than WordPress itself, are where almost all of the trouble comes from.
The realistic outcomes are not dramatic. Your site gets used to send spam and your domain reputation suffers, so your ordinary business email starts landing in junk folders. Or Google flags the site and quietly stops showing it. Or a plugin conflict breaks your contact form and you spend six weeks wondering why business is slow.
The cleanup, when it happens, tends to cost more than a year of looking after it properly would have.
Two businesses can both run a WordPress site and pay very different amounts. It usually comes down to these.
| What moves the number | Towards £400 | Towards £1,200 |
|---|---|---|
| What the site does | Pages, contact form | Bookings, payments, member logins |
| Premium licences | Few or none | Booking system, forms, SEO tools |
| How often it changes | A few edits a year | Monthly content and new pages |
| How much rides on it | Some enquiries | Most of your enquiries or your income |
| Traffic and size | Modest, one location | Busy, or several service areas |
If your website is where most of your new clients come from, spending at the higher end is straightforward maths. If it is a well made calling card that rarely changes, the lower end is genuinely enough, and anyone telling you otherwise is selling.
The build is a one off, the running cost is annual, and they are separate conversations that often get muddled in a quote. Our guide to what a website costs in Edinburgh covers the build side, and it is worth asking any designer for both numbers before you decide. It is one of the nine questions worth asking before you hire anyone.
The software is free. Running a website on it is not. The same is true of a free puppy. What you pay for is the hosting it sits on and the ongoing attention that keeps it safe and working.
Hosts keep the server running. That is a different job from keeping your website running. Most hosting plans will not test an update against your booking page, will not notice your contact form has stopped sending, and will not restore your site the same day if something goes wrong.
On the monthly line, usually yes. A Wix or Squarespace subscription is around £15 to £30 a month with hosting and updates folded in. The difference is what you own at the end. With WordPress the site is yours and can move; with a subscription platform you are renting, and leaving means rebuilding.
It works, until it doesn’t. The site keeps running for months, then one plugin vulnerability gets exploited or one update finally breaks something. Given that 78% of compromised sites in 2025 were running at least one outdated plugin, this is the most common way small business websites fail.
Slightly, in line with hosting and licence prices. What changes it materially is the site doing more: adding bookings, a shop, or several new service pages. Those are decisions you make, not surprises.
Tell me what your site does and roughly how often it changes, and I’ll tell you what a realistic annual figure looks like for it. If you’re already paying more than you need to, I’ll say so.
That’s the kind of work I do at BrandCrafter, here in Edinburgh, and I read every message myself.
Figures reviewed August 2026. Vulnerability and compromise data from Patchstack, Wordfence and Sucuri reporting collated by Webmastered.
