Short answer: a WordPress care plan should include tested updates, off-site backups, security monitoring, uptime monitoring, performance checks and a fixed amount of time for small content or development changes each month. For agencies, a good care plan also includes a monthly report you can send to the client under your own brand.
Most agencies know they should offer ongoing website support. Fewer have a clear answer when a client asks, “What exactly am I paying for each month?” This guide breaks down what a WordPress care plan should cover, what to leave out and how to package it so clients see the value.
What is a WordPress care plan?
A WordPress care plan, also called a maintenance plan or support retainer, is a monthly service that keeps a website secure, updated, backed up and working after launch. It replaces ad-hoc “can you just fix this?” requests with a defined scope and a predictable monthly fee.
For the client, it means fewer surprises. For the agency, it means recurring revenue and a reason to stay in regular contact with the client.
Why do WordPress sites need ongoing maintenance?
WordPress itself, along with plugins and themes, releases updates regularly, including security fixes. Sites that don’t get updated become easy targets for automated attacks. Over time, small issues build up too: broken forms, slow pages, expired licences and plugins that no longer work with the current version of WordPress.
Most hacks and breakages don’t happen on launch day. They happen months later, when nobody is watching. I covered the common causes in why WordPress sites get hacked.
What should a WordPress care plan include?
1. Tested updates
Updating core, plugins and themes is the foundation of every plan. The important word is tested. Updates should be applied on a staging copy first, checked, then pushed to the live site. Blind auto-updates on a busy client site are a risk, not a service.
2. Off-site backups with tested restores
Daily backups stored away from the hosting server, with at least 30 days of history. Just as important, someone should test a restore regularly. A backup that has never been restored is an assumption, not a safety net.
3. Security monitoring and hardening
Malware and file-change scanning
Login protection, two-factor authentication and rate-limiting
Regular user audits to remove old admin accounts
A clear plan for what happens if the site is compromised
4. Uptime monitoring
Checks every few minutes, with alerts to you rather than the client. You should know a site is down before the client calls.
5. Performance checks
A monthly look at page speed and Core Web Vitals, database clean-up and image optimisation. Performance slowly gets worse as content and plugins are added, so it needs regular attention. See how to pass Core Web Vitals on WordPress for what to check.
6. Development time
A fixed block of time each month for small changes: content updates, new sections, form changes or minor bug fixes. This is what clients notice most, so make it clear how much time is included and what happens when it runs over.
7. A monthly report
A short, white-labelled report showing what was updated, backed up, blocked and fixed. Without a report, a well-maintained site looks exactly the same as a neglected one, and clients start to question the fee.
What should a care plan not include?
Be clear about what sits outside the plan, or it will slowly turn into unlimited free work. Common exclusions are:
New features, new page templates or redesigns
Major plugin migrations or rebuilds
Content writing and SEO campaigns, unless sold separately
Hosting costs and premium plugin licences, unless you bundle them on purpose
Anything outside scope can be quoted separately or billed at an agreed hourly rate.
How should agencies package care plans?
Most agencies do well with two or three tiers. A simple structure looks like this:
Essential: updates, backups, security and uptime monitoring, monthly report
Growth: everything in Essential, plus performance checks and a block of development time
Priority: everything in Growth, plus more development time and faster response times
Price each tier based on the time and tools it really needs, and include the plan in every new website proposal rather than offering it after launch. Clients are far more likely to say yes when support is part of the original quote.
Should agencies run care plans in-house or white-label them?
If you have a developer with time to do updates, testing and monitoring properly every month, in-house works. Many agencies don’t, and maintenance ends up squeezed between client projects. A white-label developer can run care plans under your brand while you keep the client relationship and the margin. If you go that route, use the white-label WordPress checklist to vet your partner.
FAQs
Is a WordPress care plan worth it for small business sites?
Yes. Small business sites are often hit hardest by hacks and downtime because nobody is checking them. A basic plan with updates, backups and monitoring prevents most of the problems that lead to expensive emergency fixes.
How often should WordPress plugins be updated?
Security updates should be applied as soon as possible after testing. Other updates can be grouped into a weekly or fortnightly routine, applied on staging first.
What is the difference between a care plan and hosting?
Hosting keeps the server running. A care plan looks after the website on that server: WordPress updates, plugins, security, backups and changes. Some hosts include parts of this, but rarely the testing, reporting and development time agencies need.
Can I offer care plans to clients whose sites I didn’t build?
Yes, but start with an audit. Inherited sites often have outdated plugins, nulled software or poor hosting, and those need fixing before a care plan can be priced fairly.
Want to offer WordPress care plans without adding to your team’s workload? Get in touch and I’ll walk you through how I run them for agencies under their brand.
