Why this deserves its own line item
Security work is frequently bundled invisibly into a general maintenance fee, which means it's the first thing that gets silently under-resourced when margins get tight and the last thing clients think they're paying for specifically. Pricing it explicitly does two things: it protects your margin on the work involved, and it makes the value visible to the client instead of assumed.
Three pricing models to choose from
1. Flat add-on per site. A fixed monthly amount added to your existing maintenance fee — e.g., an additional $25-75/month per site depending on your market and the depth of coverage. For context, Sucuri's own consumer-facing platform plans run $229-$549/year per site (roughly $19-$46/month) for monitoring plus unlimited cleanup — a reasonable anchor if you're pricing a comparable bundle with your own service layer and margin on top. Simple to sell, simple to bill, easiest for clients to understand. Works best when your monitoring setup is largely automated.
2. Bundled into a premium maintenance tier. Security monitoring becomes the differentiator between your "basic" and "plus" maintenance plans. Works well if you're trying to upsell existing basic-tier clients rather than sell a new line item cold.
3. Priced per incident, with monitoring included as a loss-leader. Monitoring is offered free or low-cost, and revenue comes from remediation when something is actually found. This can work, but creates a perverse incentive to under-invest in the monitoring that would otherwise reduce your incident-response revenue — be honest with yourself about whether this model serves the client or your invoicing.
For most agencies, model 1 or 2 is the more defensible and more scalable choice.
What determines where you land in the range
- How automated your monitoring actually is. If it requires meaningful manual review time per site, your price needs to reflect that labor. If it's largely automated, you can price lower per site and still protect margin.
- What's included when something is actually found. Does the fee include a certain amount of remediation time, or is incident response billed separately? Be explicit about this in the contract.
- Your market. What agencies charge varies significantly by region and client size. General WordPress maintenance plans (not security-specific) commonly run $50-$300/month depending on scope — security monitoring as a line item typically sits well under that, since it's one component of a broader care plan, not the whole thing. Anchor to your own market, not a generic number.
How to introduce this to existing clients without it landing as a surprise fee hike
- Frame it around what's new, not what's being added to their bill: "we're now including active security monitoring with plain-language reporting, which wasn't part of your plan before."
- Lead with a concrete example of what it catches — a real (anonymized, if needed) finding is more persuasive than a feature list.
- Offer it as an opt-in upgrade first for price-sensitive clients, and fold it into the default plan for new clients going forward.
The actual test of whether your pricing is right
If a real security finding comes in and you can resolve it within the scope of what the client is already paying for, without feeling like you're doing unpaid work, your pricing is sound. If every real incident becomes a scramble to justify additional billing after the fact, the base price is too low relative to what you're actually delivering.
- Sucuri: current platform pricing — real published rates for comparable monitoring + cleanup coverage
Automate the monitoring so your margin on this line item is protected.
Install free →