I looked at a site recently for a business paying $300 a month. That’s $3,600 a year, for what was described to them as hosting, maintenance, and occasional content updates.
The site was built on a free WordPress template. Not a premium theme, not a custom build. A free one.
And sitting in their sitemap, live and indexed, was one of the template’s demo pages. With the template’s name on it.
That page had been there since launch. Nobody had removed it, because nobody had ever opened the sitemap. Not once, in years of monthly invoices.
This Isn’t About the Price
I want to be careful here, because the easy version of this post is “you’re being overcharged,” and that’s not the point I’m making.
$300 a month can be an excellent deal. If someone is monitoring uptime, testing updates on a staging copy before pushing them live, verifying that backups actually restore, watching your security logs, making your content changes within a day, and occasionally telling you something useful about how the site is performing, then $3,600 a year is cheap for that. Real maintenance is real work, and the people who do it properly are worth what they charge.
$300 a month can also be a hosting account with an automatic renewal and nobody’s attention. Those two things cost exactly the same amount.
The number on the invoice tells you nothing. The question is what’s underneath it.
So the useful question isn’t whether you’re paying too much. It’s whether you can find out what you’re getting. And you can, mostly by yourself, in about twenty minutes.
The Twenty-Minute Audit
None of this requires technical knowledge. You’re not diagnosing anything, you’re just looking.
Run these on your own site
- 1
Open yoursite.com/sitemap.xml
It'll look like a wall of links, which is fine. Skim for anything you don't recognize. Demo pages, sample posts, 'Hello World', 'My Blog', pages with a theme or template name in the URL. Anything there that isn't yours means nobody has audited this site since it launched.
- 2
Search Google for site:yourdomain.com
Type it exactly like that, with your domain. This shows you what Google has actually indexed. You're looking for the same thing: pages you didn't ask for, duplicates, and titles that say something generic like 'Home' or 'Page' instead of describing your business.
- 3
Run your homepage through PageSpeed Insights
It's free from Google. You'll get a score out of 100 for mobile and desktop. Under 50 on mobile is common for WordPress sites and worth asking about. Don't accept 'that's normal for WordPress' as an answer without also getting 'and here's what we could do about it.'
- 4
Ask for the last three months of work
Not a report template. A specific answer: what did you actually do in June? Good answers sound like 'updated core and four plugins, one broke the contact form, rolled it back and fixed it.' Vague answers about monitoring and optimization usually mean an automatic renewal.
- 5
Confirm you own your own accounts
Your domain registration, your hosting account, your DNS. Log into them yourself. If you can't, or if they're registered in your vendor's name, that's the most important thing on this list, and it has nothing to do with money.
- 6
Ask them to restore last week's backup to a test copy
Everyone says they have backups. Far fewer have ever tried one. A backup that has never been restored is a hope, not a backup, and you'd rather find out now than during an emergency.
⚠ If step five goes badly, deal with that first
Not owning your own domain is the one genuine emergency on this list. It means someone else can turn off your business’s email and website, and you have very little recourse. Whatever else you decide, get your domain into an account you control, in your company’s name, with your credit card on it.
What the Demo Page Actually Told Me
Back to that sitemap for a second, because I think the detail matters more than the money.
A leftover template page isn’t a serious technical problem. It’s a page. You delete it in about ten seconds.
What it tells you is that nobody looked. Not at the sitemap, not at what Google was indexing, not at anything below the surface of the homepage. And once you know nobody looked at that, you have to ask what else nobody looked at. Whether the backups run. Whether the plugins are current. Whether the site has been compromised. All of those failures are invisible from the front page, which is the only part most owners ever see.
That’s the thing about maintenance you don’t get: it looks identical to maintenance you do get, right up until the moment it doesn’t.
Why This Happens So Often
I’ve watched this pattern for twenty-six years and it almost never involves a villain.
Someone needs a website. They don’t build websites, so they hire someone who does, which is exactly the right instinct. The person they hire buys or downloads a template, fills it with their content, and launches it. That is genuinely most of the work, and for a lot of businesses it produces a perfectly acceptable website.
Then it goes on a maintenance plan, because everyone knows websites need maintenance. But nobody ever defined what maintenance means here, the site isn’t visibly broken, and month after month the invoice clears. There’s no moment where anyone decides to stop paying attention. Attention just never gets scheduled.
The asymmetry is the whole problem. The client can’t evaluate the work, so they evaluate the relationship, and the relationship is fine. The same asymmetry is what makes pre-built themes such an easy sell in the first place.
What I’d Actually Suggest
If your audit came back clean, you’re in good shape and you now have a vendor you can trust with more work. That’s a genuinely good outcome and worth knowing.
If it came back badly, you have two honest options, and rebuilding is only one of them.
The first is to keep the site and fix the relationship. Take the audit results to your vendor and ask for specifics. Plenty of them will step up, because the drift was passive rather than deliberate. That costs you nothing and it’s the right first move.
The second is to ask a different question: what are you actually paying for the ability to keep this site running at all? A WordPress site needs hosting that runs a database, someone tracking updates, something in front of it filtering attacks, and periodic cleanup. That’s the recurring cost, and it recurs whether or not anyone is doing a good job. It’s the price of the machinery, not the price of the work.
Sites built as static files don’t have that machinery. Hosting is free at small scale, there’s no database, no plugins to track, no login to defend. What you’d pay for is the actual work, when there’s actual work, which for most business sites is a handful of hours a year. It’s a different shape of expense: mostly zero, occasionally a real bill for a real change, instead of a fixed monthly charge that’s identical whether anyone looked at your sitemap or not.
Key Takeaway
Go open your sitemap and look at it. Then log into your domain registrar and confirm your name is on it. Those two things take five minutes and will tell you more about the health of your website arrangement than any proposal anyone will ever send you.
For the fuller accounting of what the machinery costs once you include security and performance overhead, that’s in the true cost of running WordPress. And if the audit turned up something worse than a demo page, start with what to do when your WordPress site gets hacked.
Want a second set of eyes on your audit?
Send me what you found and I'll tell you honestly whether it's a problem, including when the answer is that your setup is fine.
Founder, 1123Interactive
26 years building for the web, from hand-coded HTML to modern static sites that load instantly and cost nothing to host. I've been on both sides of the maintenance invoice, and I'd rather you know what you're paying for.
Learn moreContinue Reading
AI Crawlers Are Hammering Your WordPress Site
AI bots can generate thousands of expensive page requests on a WordPress site. Why it happens, why robots.txt won't stop it, and what to do before September 15.
Your New Website Is Already Being Attacked
A site with 15 visitors a day blocked 1,170 attacks in 24 hours. Nobody targeted it, nobody has heard of it. Here's why being small doesn't protect you.
Your WordPress Site Was Hacked. Here's What to Do.
A step-by-step recovery plan for a hacked WordPress site, from someone who cleans them up. What to do in the first hour, this week, and long term.