A WordPress site isn't a "build it and forget it" thing. Nobody's hiding that, but it's easy to underestimate when you're comparing quotes for a new website. The software is free. Keeping it healthy is a job, and somebody has to do it: you, your developer, your host, or a mix of all three.
This week gave everyone a timely example. On 21 October 2026, the PHP project released emergency fixes for two critical flaws, nicknamed PHP2Shell, in the language WordPress runs on. No WordPress or plugin update could fix them. Site owners had to rely on their host updating PHP on the server. We've covered what happened with PHP2Shell separately. Here, we'll look at the wider picture: what WordPress maintenance actually involves, roughly what it costs, and what changes (and what doesn't) on Webflow.
The short answer
Keeping a WordPress site healthy means regular updates to WordPress core, your theme and your plugins, staying on a supported PHP version, keeping the server patched, taking and testing backups, watching for security issues and sorting out the odd plugin conflict. None of it is hard on its own. Together, it's ongoing work that costs time or a retainer.
Webflow's managed hosting takes the server side of that off your plate: no PHP, no server patches and no plugins to update. It still needs care, though. That means your content, your account security, any third-party scripts you add, and paying for the plan.
What keeping a WordPress site healthy involves
1. Core, theme and plugin updates
WordPress is made of three layers that update independently: WordPress core, your theme and your plugins. WordPress.org's own advice is blunt: "To keep your WordPress site secure, you should always update your plugins and themes to the latest version."
Since WordPress 5.5, you can switch on automatic updates plugin by plugin and theme by theme, and WordPress runs those auto-updates twice a day by default. That helps a lot. But WordPress.org also notes that auto-updates rely on WordPress's scheduled tasks and may not run correctly on every server, and it recommends making sure you can roll back before turning them on.
Why does this matter so much? Patchstack's State of WordPress Security in 2026 report found 11,334 new vulnerabilities in the WordPress ecosystem in 2025. 91% were in plugins and 9% in themes, with only six in WordPress core, all low priority. WordPress core is well maintained. The day-to-day exposure sits mainly in the plugins and themes you add.
2. PHP versions and end-of-life
Underneath WordPress sits PHP, and PHP versions have a shelf life. The PHP project supports each version for two years of active support, then two more years of security fixes only. After that, it reaches end of life and gets no more fixes.
As of October 2026, the PHP project lists these security support end dates:
- PHP 8.2: 31 December 2026
- PHP 8.3: 31 December 2027
- PHP 8.4: 31 December 2028
- PHP 8.5: 31 December 2029
WordPress.org currently recommends PHP 8.3 or higher. Moving up a version isn't always a click of a button, either. WordPress.org says it can't guarantee your themes and plugins will work on a newer PHP version, and it recommends backing up, updating everything and checking compatibility first.
PHP2Shell showed why this matters. The PHP project released fixes for its supported versions, but PHP 8.1 and older got no official fixed release. Sites still on those versions depended on their host or vendor having a patched build.
3. Hosting and server patching
Somebody has to keep the server itself up to date: PHP, the web server software, the database and the operating system. On shared or managed WordPress hosting, that's mostly your host. On a VPS or your own server, it's you or your developer.
This is the layer most site owners never think about until something like PHP2Shell happens. That week, WordPress.org's advice to site owners was to check with their host and update PHP as soon as possible, because no WordPress update was coming.
4. Backups
WordPress keeps your content in two places: the files on your server and a separate database. WordPress.org's backup guide says you need both to fully restore a typical site. It suggests:
- backing up weekly for smaller sites and daily for busy ones
- always backing up before an upgrade
- keeping at least three to five recent backups in different places
- occasionally checking that automatic backups actually work
Many hosts include backups. It's still worth knowing what's covered, how long backups are kept and how you'd restore one.
5. Security monitoring
Updates close known holes, but someone also needs to notice when something goes wrong. That means keeping an eye out for unexpected admin users, changed files or odd redirects, often with a security plugin or a host's monitoring tools. Patchstack's report found that 46% of WordPress ecosystem vulnerabilities in 2025 weren't fixed in time for public disclosure. So sometimes there's simply no update to install yet, and monitoring and a firewall are what you rely on in the meantime.
6. Plugin conflicts and testing
Every update is a small change to a system built by many independent developers. Most go through without a hitch. Occasionally, one plugin update clashes with another plugin or your theme, and a layout breaks or a form stops sending. That's why careful WordPress maintenance includes testing after updates, ideally on a staging copy first, and having a backup ready to roll back.
What does WordPress maintenance cost?
It depends heavily on the site, so treat any figure as a rough guide. Here are two published third-party estimates (one is from a Webflow agency, so allow for that):
- A UK guide estimates small business WordPress costs at roughly £120–£400 a year for hosting, £150–£500 a year for plugin and theme licences, and £300–£900 a year for maintenance.
- A B2B-focused comparison puts WordPress hosting at €10–€100+ a month, paid plugins at €250–€500 a year and developer maintenance at two to four hours a month.
Your real cost is either your own time or a retainer. A simple brochure site with a handful of well-chosen plugins needs far less looking after than a WooCommerce shop with dozens of them.
What changes with Webflow
Webflow works differently. The site is designed in Webflow and hosted by Webflow, so there's no server software for you to manage. Webflow says its hosting needs "no updates to run, packages to install, or capacity planning". It also says it continuously monitors for new vulnerabilities and deploys updates automatically, and lists automated patches and updates "with no customer maintenance" among its security features.
In practice, compared with the WordPress list above:
- Core, theme and plugin updates: there are no plugins to install or update. Webflow updates the platform itself.
- PHP versions: there's no PHP for you to run. PHP2Shell wasn't something a Webflow site owner needed to act on.
- Server patching: Webflow manages the hosting, which it says runs on AWS with Cloudflare's CDN.
- Backups: Webflow lists automatic backups and versioning, with the option to preview and restore earlier versions.
- Security basics: Webflow says every site gets free SSL, and DDoS and bot protection through its CDN provider.
What Webflow still needs from you
It's not maintenance-free, and anyone who says it is is overselling it. A Webflow site still needs:
- Content care: keeping pages, blog posts and CMS items accurate and fresh, and keeping on top of SEO. Our guide on whether Webflow is good for SEO covers the settings that matter.
- Account security: strong passwords, two-factor authentication and sensible permissions for whoever can edit or publish.
- Third-party scripts and integrations: analytics, chat widgets, booking tools and form connectors you add are outside Webflow's control. Each one is worth reviewing now and then, and removing if you no longer use it.
- The plan cost: hosting comes as a paid Webflow Site plan, so it's an ongoing cost, just a more predictable one.
- Skills: Webflow is a professional visual development platform with a real learning curve, not a DIY builder like Wix or Squarespace. Your team can edit content day to day, but design and structural changes are usually best left to someone who knows the platform.
So the fair comparison isn't "WordPress needs maintenance and Webflow doesn't". It's that WordPress makes you (or someone you pay) responsible for the software and server stack, while Webflow takes that layer on and leaves you with the content and the account.
Is it worth switching?
Not automatically. A well-run WordPress site with a good host and someone looking after it is perfectly fine. If that's you, keep going.
A move starts to make sense when maintenance has become a job in itself, when a redesign is due anyway, or when your team struggles to update the site. We've compared the two platforms in detail in Webflow vs WordPress. If you do move, protecting your rankings is the part to get right, and our WordPress to Webflow migration guide walks through it.
Ongoing support from Digital Mast
We build exclusively in Webflow, and we offer ongoing support after launch for clients who'd rather not handle updates and changes themselves. That's equally true for a single landing page or a small site as for a bigger build. If you're weighing up who to work with, our guide on how to hire a Webflow expert explains what to look for, or you can get in touch for a chat.
Frequently asked questions
What does WordPress maintenance involve?
It means keeping WordPress core, themes and plugins updated, staying on a supported PHP version, keeping the server patched, taking and testing backups, monitoring for security issues, and fixing occasional plugin conflicts after updates.
How much does WordPress maintenance cost?
It varies with the site. One UK guide estimates £300–£900 a year for small business maintenance, plus hosting and plugin licences. A B2B comparison puts developer maintenance at two to four hours a month. Simple sites with few plugins need less.
How often should I update WordPress plugins?
WordPress.org advises always updating plugins and themes to the latest version. Since WordPress 5.5 you can turn on automatic updates for each plugin and theme, but keep backups so you can roll back if an update causes a problem.
What PHP version should my WordPress site use?
WordPress.org recommends PHP 8.3 or higher. The PHP project's security support for PHP 8.2 ends on 31 December 2026, so sites on 8.2 or older should plan an upgrade with their host.
Does a Webflow site need maintenance?
Yes, but less of it is technical. Webflow manages hosting, security updates and backups, and there are no plugins or PHP to update. You still need to look after content, account security, any third-party scripts and the plan cost.
Was Webflow affected by PHP2Shell?
Webflow site owners didn't need to update PHP, because there's no PHP server for them to run. Webflow says it monitors for vulnerabilities and deploys updates automatically. That doesn't make any platform immune to every risk.
Photo by Brett Sayles on Pexels.
