21 %
of visible WordPress versions are “insecure”
According to WordPress.org’s official list, which grades every version. The latest version is 7.1.3.
Study · measured on October 17, 2026
Website maintenance: the real state of 187 Québec small-business sites
We measured the real upkeep of the sites in our Law 25 study: WordPress version, footer year, security, phone speed. Then what real maintenance must cover, what it costs, and the questions to ask your agency.
- Original measures
- No site named
- Versions graded by WordPress.org
- Reading time: 7 minutes
What we found
The 200 small-business sites of our Law 25 study, visited again on October 17, 2026: 187 could be measured. None is named, since publicly pointing at a vulnerable site would help attackers.
27 %
show 2023 or earlier in the footer
Among sites that show a year. It is not proof, but a sign that nobody revisits the site.
65 %
are slow on a phone
Over 4 seconds to show the main content over slow 4G. Median time: 6.1 s.
100 %
have a secure connection (https)
The good news: the padlock has become the norm.
These are technical observations of the home page, not a security audit: a site may hide its version or be protected otherwise. This is not legal advice.
The detail
The platforms of the sites measured
- WordPress74 sites
- Other or custom48 sites
- Shopify24 sites
- Wix17 sites
- Squarespace10 sites
- GoDaddy9 sites
What real maintenance must cover
To have written in the contract, point by point.
Updates of WordPress, plugins and theme
How often a month, tested on a copy before going live, and who fixes it if an update breaks the site.
Backups, and a tested restore
Frequency, retention, an off-server copy, and a restore done at least once to prove it works.
Security monitoring
Firewall, file scanning, alert if hacked, and a written response time.
Uptime monitoring
Who is alerted when the site goes down, and how fast someone acts.
Security certificate (https) and domain name
Renewal tracked, and the domain registered in your name.
Small changes
How many hours a month are included, and the hourly rate beyond.
Speed and site health
A regular check of phone speed and broken links.
A report
Every month or quarter: what was updated, backed up, blocked or fixed.
Published maintenance prices
Only prices displayed by agencies themselves, with their source. Compare what is included, not only the amount.
- FaliaMonthly care (updates, security, backups, monitoring, changes, infrastructure included)from $65 a monthSource
- Agence ChocolatWordPress maintenance3 plans: $50, $75 and $99 a monthSource
- Agence ChocolatManaged hosting$50 – $150 a monthSource
- My Little Big WebWordPress maintenance and support$125 or $275 a month; +$75 with a page builder, +$125 with a WooCommerce storeSource
- WebCieSimple WordPress hosting$300 a yearSource
- WebCieHosting and maintenance$90 a month, or $190 with 1 hour of changesSource
- WebCieChanges on demand$110 an hourSource
- TreizeHosting (support included)from $360 a yearSource
Prices collected for our price guide; they may have changed. The price guide
The 7 questions to ask your agency
Copy them into an e-mail: the written answers will tell you whether your site is really maintained.
Hello, To review the upkeep of our site, could you answer the following questions in writing? 1. Which version of WordPress (or the platform) runs our site, and when was it last updated? 2. Are the plugins and theme up to date? Which ones are no longer maintained by their author? 3. How often is the site backed up, where are the copies kept, and when was a restore last tested? 4. What happens if the site is hacked or goes down: who is alerted, and how fast do you act? 5. How many hours of changes are included each month, and what is the hourly rate beyond? 6. Are the domain, hosting and accounts in our name, and do we have admin access? 7. Can you send us a maintenance report every month or quarter? Thank you,
Method and limits
The 200 small-business sites of our Law 25 study (local businesses listed in OpenStreetMap, excluding chains, large companies and organisations), visited on October 17, 2026 on the home page, on a simulated phone, clicking nothing. The Law 25 study
WordPress version: read from the “generator” tag or from WordPress files that carry its version, then graded with WordPress.org’s official list (latest, older but patched, or insecure). Many sites hide their version: the percentage covers only those that show it.
Speed: time to display the largest element of the page, in one measure, with a slow 4G network and a slowed processor, as Google’s tools do. Footer: the most recent year shown near “©” or “all rights reserved”.
Limits: one page, one moment, one speed measure; a site may be protected otherwise (firewall, host); an old footer year is only a clue. The margin of error is shown under each bar.
Frequently asked questions
Is website maintenance mandatory?
No law requires you to hire an agency for it. But a site that collects personal information (form, shop) must take security measures suited to protecting that information (Law 25, s. 10), and a site that is never updated becomes an entry point. This is not legal advice.
How much does website maintenance cost in Québec?
Agencies that publish prices charge from a few dozen to a few hundred dollars a month, depending on what is included. Compare the content, not only the price: tested backups, updates, response time, hours of changes.
How do I know if my WordPress is up to date?
In the WordPress dashboard, the “Updates” page shows the installed version. Compare it with the latest version published by WordPress.org, or ask your agency in writing.
Does a Wix, Shopify or Squarespace site need maintenance?
The platform updates its own software. Content, added apps, the domain, access and speed still need watching.
Why don’t you name the sites?
Because publicly pointing out that a site runs a vulnerable version would help attackers. Only percentages are published.
What now?
Guide written by the AgencyVerity team, Montréal. Updated October 17, 2026. Back to contents · All our guides