What a Website Care Plan Actually Covers (and Whether You Need One)

Almost every web designer offers a monthly plan after launch, and the names are vague: maintenance, care, support, hosting. Here is what is actually inside one, why a website needs it, and how to tell a useful plan from a monthly fee for nothing.

A website is not finished on launch day

A WordPress site is made of the WordPress software itself, a theme and a set of plugins (the add-ons that run your forms, booking and so on). All three get updates, many of them security fixes. Left alone, a site doesn’t stay the same. It slowly falls behind.

The numbers are bigger than most owners expect. Patchstack, a WordPress security company, counted 11,334 new security holes in WordPress plugins and themes during 2025, up 42% on the year before. Almost all of them (91%) were in plugins. Nearly half had no fix available when they were made public, and the most-targeted ones were being attacked within hours.

That is not a reason to avoid WordPress. It runs a huge share of the web, and these holes get found because so many people check it. It is a reason to make sure someone is watching your site.

What a care plan should include

Hosting and a security certificate

The server your site lives on and the padlock in the browser bar. Without the certificate, browsers warn visitors that your site is not secure.

Backups you can actually restore

A backup is only useful if it restores. A good plan backs your site up every day, keeps a copy somewhere other than the server and tests that a restore works.

Updates

WordPress, theme and plugin updates applied regularly, with someone checking afterwards that the forms and booking still work.

Monitoring

Alerts when the site goes down, so it gets fixed before a customer tells you.

Security

A firewall that blocks attacks before they reach the site, malware scanning, and someone to clean up if something gets through.

Help when you need it

A real person to email when you want an opening-hours change or something looks wrong, with a stated reply time.

Questions to ask before you sign

• What happens if my site gets hacked? Is the clean-up included or extra?
• How often are backups taken, where are they kept, and when was a restore last tested?
• How quickly do you reply, and who replies?
• Can I leave? Who owns the domain and the site if I stop paying?
• Are small content changes included, or billed by the hour?

Do you need one?

If you or someone on your team is comfortable running updates, testing backups and dealing with a security problem, you can look after a site yourself. Most owners would rather spend that time on the business, and the cost of one hacked or broken site (lost bookings, a blacklist warning in Google, an emergency fix) is usually more than a year of care.

Our care plans

Every site we build gets its first 30 days of care free. After that there are three plans, and each one includes everything in the plan before it:

Plan	Monthly	On a yearly plan	What it adds
Essential	$35	$28 a month	Hosting, SSL, daily tested backups, updates, uptime alerts, form spam protection
Secure	$64	$52 a month	Firewall, malware scanning and removal, an off-server backup, security monitoring, next-business-day support
Complete	$99	$79 a month	Up to 4 content updates a month, a monthly report, Google Business Profile updates, a new town page every month

There are also 3-month and 6-month terms in between, and Premium clients get 20% off any plan for life. Full details are on our pricing page.

Questions owners ask next