WordPress Maintenance for Agencies: White-Label, 50+ Sites

Most design agencies build WordPress sites well and then face the same question from every client: who keeps it updated? Plugins need updates every week, PHP versions reach end of life, backups have to work when you need them, and once in a while a vulnerability lands that needs action the same day.

The short answer: you can sell maintenance to your clients without hiring a developer. A white-label partner does the updates, backups and small changes under your name, inside your tools, and you keep the client relationship and the margin. For a portfolio of 50+ WordPress sites, that is about 10 hours of developer time a month in our experience, plus the ability to react within minutes when something serious is published.

Running client sites without a developer on staff? We maintain WordPress sites for agencies under your name, under NDA. See how it works for agencies →

A real case: 50+ WordPress sites for a Rotterdam design agency

Since July 2026 we maintain the WordPress sites of a design agency in Rotterdam (we don't name them; their clients know them, not us). The agency designs and builds the sites. We do the rest:

• Updates: WordPress core, plugins and themes, checked after updating.
• Backups: running, and restorable when needed.
• Small changes: content and layout tweaks the agency's clients ask for.

The numbers: more than 50 sites, about 10 hours of work a month. Spread over the portfolio that is roughly 12 minutes per site per month. Most months, maintenance across many sites is routine.

The month that wasn't routine was October 2026. When the PHP2Shell vulnerability in PHP was published, we acted on the agency's sites within minutes. The agency didn't have to find out what PHP2Shell was, which of its sites ran an affected version or who could patch them that evening. We wrote up what to do in PHP2Shell: what to do now with your WordPress or Laravel site.

The outcome for the agency: it sells maintenance to its own clients as its own service, without a developer on its payroll.

What WordPress maintenance actually includes

"Maintenance" means different things to different clients. Agree on a list, write it in your client contracts, and give the same list to your partner. Ours looks like this:

Task	How often	Why it matters
Plugin and theme updates	Weekly or every two weeks	Most WordPress hacks come in through outdated plugins.
WordPress core updates	When released; security releases the same day	Minor releases often fix security problems.
Check after updating	Every update round	An update can break a form, a checkout or the layout.
Backups	Daily, with a test restore now and then	A backup you have never restored is a guess.
PHP version	When a version nears end of life	Old PHP gets no security fixes.
Urgent security action	When a vulnerability is published	The first hours count, before attacks start at scale.
Small changes	On request	Text, images, a new section: the work clients notice.

For what a single site costs and what can go wrong on a normal patch day, see website maintenance cost per month.

Why agencies outsource it

• The work is small but never stops. Ten hours a month is too little for a hire and too much to do on the side.
• The urgent moments are unpredictable. A vulnerability doesn't wait until your developer is back from holiday.
• Designers don't want to update plugins. Your team is better used on new projects your clients pay more for.
• Clients expect it. If you don't offer maintenance, someone else will, and they will pitch the redesign too.

How white-label maintenance works with us

1. NDA first. We sign your NDA as standard.
2. Your tools, your name. We work in your hosting accounts, your repositories and your project board. Your clients see your agency, not us. When a client call is needed, our developer joins under your name.
3. One list of sites. We start with an overview: every site, its hosting, PHP version, plugins and backup status. That list usually shows the first problems.
4. A fixed rhythm. Update rounds on set days, checked afterwards, reported in your board.
5. Urgent when needed. When something serious is published, we act first and report after. That is what "within minutes" meant in October.
6. You see every hour. Every ticket, message and logged hour is visible live in your own project board, and you can add tickets yourself.

More on the model itself: white label web development: how it works, what it costs.

What it costs

Maintenance for a portfolio is billed in hours. Two ways to buy them (prices excl. VAT):

Option	Price	Fits
Strip card	$1,050 for 14 prepaid hours (about $75/hour), valid 4 months	Agencies with varying work; start within 24 hours
Subscription Starter	$550/month for 8 hours	A steady, smaller portfolio
Subscription Growth	$2,200/month for 32 hours, same-day response	Large portfolios plus regular small projects

Until 31 December 2026 for agencies: buy 2 strip cards and get the third free. That is 42 hours for $2,100, about $50 an hour. At the pace of the Rotterdam case (about 10 hours a month for 50+ sites), that covers roughly four months of maintenance. All other strip card terms stay the same. See the agency offer.

How you price it to your clients is up to you. Many agencies charge a fixed monthly fee per site and keep the difference.

How to decide: in-house, freelancer or partner

	Developer in-house	Freelancer	White-label partner
Cost for ~10 h/month	A salary for mostly idle time	Low	Low, billed per hour
Urgent security action	If they are available	If they are available	A team, not one person
Holidays and illness	Gap	Gap	Covered
Works under your name	Yes	Depends	Yes, under NDA
Grows with your portfolio	New hire needed	Limited	Yes

If you maintain only a handful of sites and have a developer who likes doing it, keep it in-house. Once the portfolio grows past what one person can cover on a bad day, a partner is cheaper than the risk.

Before you hand it over: a checklist

• A list of every client site with its hosting and who pays for it.
• Admin or hosting access you can share safely (a separate account per person, not one shared password).
• Which clients pay for maintenance and what you promised them.
• Where backups are stored, and when one was last restored.
• Who your partner should contact at night if a site goes down.

For a free first look at any site, EngineeringScore, our own product, scans it for security, speed and SEO problems.

Maintenance your clients pay for, done by us

You keep the client and the margin; we keep the sites updated, backed up and patched. See how we work with agencies or contact us to hand over your first list of sites.