The Real Cost of 'Free' WordPress for Australian Small Business (2026)
WordPress the software costs nothing. Hosting, the plugins that make it work, and the hours nobody budgets for keeping it patched add up to a real annual number — here it is.
WordPress is free. Almost nothing that makes a WordPress site actually work is. The software itself — the core you'd download from wordpress.org — really does cost nothing, and that's not a marketing trick. It's genuinely open-source, genuinely free, and it genuinely powers a huge share of the web: 40.7% of all websites, according to W3Techs' August 2026 usage data.
What isn't free is the hosting it needs to run on, the plugins that turn a bare install into a functioning small business site, and the ongoing hours — yours or someone you're paying — spent keeping all of it patched, working, and not hacked. Add those up honestly and "free" turns into a real annual number most small business owners never see written down anywhere, because nobody quotes it to them upfront. Here it is.
What "free" actually buys you
When an agency or a freelancer pitches "WordPress" as the budget option, what they mean is: no software licence fee, and a huge library of free plugins and themes to build from. Both true. Compare that to a platform like Squarespace, where the software and the hosting are bundled into one subscription, and WordPress genuinely looks cheaper on day one.
The catch is that WordPress core on its own doesn't do anything a small business needs. No hosting, no security, no SEO tooling, no contact form, no backups, no page builder unless you're comfortable writing your own theme. Every one of those has to be added — and every one of those additions is either a recurring cost, an hour of somebody's time, or both. The "free" in "WordPress is free" only ever referred to the software licence. It was never a claim about the total cost of running the site.
The hosting bill nobody prices in upfront
WordPress has to live somewhere, and where it lives matters more than most owners realise. The cheapest option — shared hosting on a budget Australian host — starts around $10–15 a month and will technically run WordPress. It's also the option most likely to be slow, to get compromised, and to leave you without proper backups when something breaks.
Managed WordPress hosting exists specifically because unmanaged WordPress is fragile. WP Engine's entry-level Startup plan runs A$42 a month billed annually — about $504 a year — for one site, 25,000 monthly visits and 10GB of storage, in exchange for automatic core and PHP updates, daily backups and basic threat monitoring built in. Kinsta's cheapest tier sits close to the same territory once converted from USD. Either way, a small business site that actually wants to be fast and not fall over sits closer to $500 a year in hosting than the $0 the word "free" implies.
The plugin stack a real site actually needs
A bare WordPress install can't do SEO metadata, can't stop a brute-force login attempt, can't build a page visually, and can't back itself up on a schedule you control. The free versions of the plugins that do those things are genuinely useful — but the free tiers cap out fast for anything beyond a basic blog, and a business site with real requirements usually ends up on the paid tiers.
Yoast SEO Premium is US$118.80 a year for one site — call it roughly $170 AUD once converted. Elementor Pro's entry plan is US$49 a year, around $69 AUD, if you want a page builder beyond the free block editor. Add a proper security plugin and an off-site backup service — both of which any business handling customer enquiries genuinely should run — and you're looking at another $150–250 a year in licences. None of these are luxury add-ons. They're the minimum stack for a site that does what a business website is meant to do.
Why the plugin layer is also the security layer
This is the part that doesn't show up on an invoice at all until it goes wrong. Patchstack's State of WordPress Security in 2026 report found 11,334 new vulnerabilities disclosed across the WordPress ecosystem in 2025 — a 42% jump on the year before. Of those, 91% were found in plugins. WordPress core itself accounted for six.
That's the honest shape of the risk: it's not the software you're worried about, it's the fourteen third-party plugins sitting on top of it, each maintained by a different developer on a different update schedule, each a door into the same site if it's left unpatched. A site running one abandoned plugin — a form builder nobody's touched since 2023, say — is carrying a real, quantified risk that the core software itself doesn't have. Every plugin added to make the site do more is also a plugin someone has to keep an eye on.
The maintenance hours nobody budgets for
This is the cost that's easiest to ignore because it doesn't arrive as a bill. Someone has to actually do the updates. Core updates, plugin updates, theme updates — each one released on its own schedule, each one capable of quietly breaking something else on the site when it lands. Skip them and you're carrying the Patchstack numbers above. Apply them blind and you risk a plugin conflict taking out a page, a form, or the whole checkout the day before it matters.
Doing it properly — checking what's changed, applying updates, testing the site afterwards, keeping a recent backup on hand in case something breaks — is realistically two to four hours a month for a simple brochure site, more if there's WooCommerce or membership functionality in the mix. If that's you or someone on your team doing it, at a fully loaded rate of $40–60 an hour, that's $960–$2,880 a year in time before anyone's paid a specialist anything. If it's not getting done at all, the site is quietly accumulating the kind of unpatched risk the security numbers above describe — and a compromised or ranking-tanked site costs a great deal more than the maintenance would have.
Small business owners rarely connect an unrelated-looking problem back to this. A sudden drop in Google rankings after a routine plugin update is one of the most common WordPress failure modes there is — the theme breaks, a redirect chain appears, or a noindex tag gets set on the wrong template — and it's frequently never traced back to the update that caused it because nobody was watching closely enough to notice the timing.
Adding it up: the honest annual number
Put the pieces together for a small business site that's actually being run properly — decent managed hosting, a functional plugin stack, and someone genuinely doing the maintenance rather than hoping nothing breaks:
- Managed hosting: roughly $500–600 a year
- The plugin licences that make the site function like a real business tool: roughly $350–450 a year
- Maintenance time, done properly, whether it's yours or paid: $1,000–2,900 a year
Call it $1,900–$3,900 a year, every year, for as long as the site exists — before a single design change, content update, or new feature is added. None of it is optional if the goal is a site that's fast, secure, and not quietly rotting in the background. None of it appears in the "WordPress is free" pitch, because technically, the one thing that actually is free is the only thing that was ever advertised as free.
For comparison, a hand-coded site built once has a genuinely different ongoing cost profile — no plugins to patch, no theme conflicts, hosting that typically runs closer to $20–360 a year because there's no database or admin panel to secure against constant attack. It costs more to build in year one and dramatically less to run every year after. We've run the full five-year comparison against Squarespace elsewhere — the same maths, roughly, applies to WordPress, with the added twist that WordPress's ongoing cost includes a genuine security obligation that a platform-hosted site doesn't carry in the same way.
Where WordPress genuinely is the right call
None of this is an argument that WordPress is a bad platform. It runs a huge share of the internet for good reasons. If you need dozens of staff publishing content with proper role permissions, if your business genuinely needs WooCommerce or a specific plugin that solves an exact problem, or if your total budget is under $3,000 and you need something live in a few weeks, WordPress remains a legitimate, sensible choice — as long as whoever's running it is honest with you about the ongoing maintenance line item from day one, not three years in when the invoices have quietly become the story.
The failure mode isn't WordPress. It's being sold "free" and discovering the real number eighteen months later, spread across a hosting bill, a stack of plugin renewals, and a site that's been three versions behind for so long nobody remembers when the last update happened.
What to do with your own number
Pull up your current WordPress site's hosting invoice, add up what you're paying for plugin renewals — check your card statement for Yoast, Elementor, WPML, Wordfence, or whatever's running — and then be honest about how many hours a month someone actually spends keeping it updated. If nobody can answer that last question, that's the number to worry about, not the dollar figure.
If you want a second opinion on what your site is actually costing you to run — and whether a rebuild would genuinely pay for itself — book a 20-minute call. We'll go through your real numbers, not a template pitch, and tell you honestly whether staying on WordPress or moving off it is the better call for your business. Phone 0421 933 907 if you'd rather talk it through directly.