What Is a Website Care Plan (And Why Your Site Needs One)
Here’s a conversation I have about twice a month.
Someone calls. Their site is down, hacked, or unreachable. They got an email from their host saying the account is suspended, or their Google rankings vanished, or customers are getting a scary red warning when they try to visit. They want to know how fast I can fix it and how much it’s going to cost.
I ask when they last updated the site. Usually the answer is some version of “I don’t know, we haven’t touched it since it was built.”
That’s the whole problem. That’s also what a website care plan prevents, and why I’m going to spend a few minutes actually explaining what they are instead of just selling you one.
A website isn’t a painting, it’s a garden
When people pay for a website build, they mostly treat it like a painting. It gets hung on the wall, they’re happy with how it looks, and they assume it’ll sit there looking nice forever. No maintenance required.
Websites don’t work like paintings. They work like gardens. The technology underneath — WordPress core, PHP versions, the plugins, the theme, the security patches — is constantly moving. Every month, new vulnerabilities are discovered and patched. Every month, plugins release updates. Every month, malicious bots are scanning the internet for unmaintained WordPress sites to exploit.
A site that gets zero attention for a year doesn’t stay the same. It quietly decays. Plugins go out of date. Security holes open up. Load times creep up as things get bloated. And then one day something breaks, or someone exploits a vulnerability, and suddenly you’re the person calling me in a panic.
What’s actually in a care plan
Different agencies package these differently, but any legitimate care plan includes roughly the following:
Software updates. WordPress core, your theme, and every plugin get updated on a regular schedule — ideally after they’ve been tested on a staging copy of your site so nothing breaks in production. This alone is what separates a real care plan from a check-cashing service.
Backups. Automated, off-site backups of both your files and database, ideally daily. “Off-site” matters. If your backups live on the same server as your site and the server dies, you lose both. Proper care plans use services like UpdraftPlus with cloud storage, BlogVault, or similar.
Security monitoring. Tools like Wordfence, Solid Security, or Patchstack actively scan for malware, block malicious login attempts, and alert you if something’s wrong. Some care plans include active malware removal if your site does get infected — that’s a real service and worth having.
Uptime monitoring. A system that checks your site every few minutes and alerts someone the moment it goes down. If your site crashes at 2am on a Saturday, you want to know at 2:05am, not at 11am Monday when a customer emails you.
Performance monitoring. Regular checks on your site’s load times and Core Web Vitals, with actual action taken when things slip. A lot of “care plans” skip this part, which is why you can have a care plan and still end up with a slow site.
Minor content updates. Most plans include an hour or two per month of hands-on work — updating your hours, swapping a photo, adding a new testimonial, fixing a typo. This is more valuable than people realize. Instead of emailing your developer for a quote every time you want to change something, you just ask.
Monthly reports. You get an email or PDF showing what was done, what was updated, any security issues that came up, and how the site is performing. If you’re paying for a care plan and not getting any kind of report, you’re paying for trust with no evidence.
What a care plan is not
Let me draw some lines, because some agencies get creative with what they bundle.
A care plan is not SEO. SEO is its own ongoing service with its own pricing and its own deliverables. Don’t let anyone sell you “care plan with SEO” at $99/month and expect meaningful search rankings — that’s a lie by omission.
A care plan is not ads management, content marketing, or social media. Those are marketing services. A care plan is infrastructure.
A care plan is not a full rebuild insurance policy. If you decide next year you want a whole new design, that’s a new project. Care plans keep what you have working well — they don’t entitle you to unlimited new work.
Who actually needs one
If your site is on Squarespace or Wix, you don’t really need one — the platform handles most of this internally. That’s part of what your monthly subscription pays for.
If your site is on WordPress, you need one. I don’t say that because I sell them. I say it because I’ve fixed too many WordPress disasters that started with “we didn’t think we needed maintenance.” The question isn’t whether to maintain it — it’s whether you want to do it yourself or pay someone.
If you’re technically comfortable, you can genuinely DIY this. Set up automated backups, keep plugins updated weekly, monitor uptime with a free service like UptimeRobot, run PageSpeed checks monthly, and stay on top of security patches. It’ll take you a couple hours a month. That’s a totally legitimate path if you have the time and the inclination.
If you don’t, pay someone. The going rate for a solid care plan in 2026 is $75 to $300/month depending on site complexity and how much proactive work is included. Below $75/month, something’s being skipped. Above $300/month, you’re probably paying for services you don’t need unless your site is complex.
What happens without one
Let me give you the real failure modes, because “your site might get hacked” sounds abstract until it happens.
The most common scenario isn’t a dramatic hack. It’s slow decay. Your site gets a little slower every quarter. Your forms stop working and you don’t notice for two months. Your contact page breaks after a plugin update. Your SSL certificate expires and visitors get a scary browser warning. Each one is a small leak. Combined, they’re costing you customers you don’t know you’re losing.
The less common but more dramatic scenario is the actual breach. Someone exploits an outdated plugin, injects malicious code, and your site starts redirecting visitors to a sketchy pharmacy site. Google flags it. Your rankings disappear. Your email provider blocks emails from your domain. Cleaning this up costs real money and real time, and even after it’s clean, your SEO takes months to recover.
Both of these are preventable. Not with luck — with the specific, boring work that a care plan covers.
The honest pitch
I run a care plan program for clients. If you want to know more about what’s actually in it and what it costs, it’s laid out here. I try not to be cagey about pricing or deliverables.
But the real point of this article isn’t to sell you mine. It’s to tell you that if you own a WordPress site and nobody is actively maintaining it, that’s a problem you should solve, with me or without me. DIY it with a weekend and a calendar reminder. Hire a freelancer. Use one of the WordPress management services. Or pay an agency. Anything is better than nothing.
The worst thing you can do is keep doing nothing and hope the site holds up. Because it won’t — not forever. These things always catch up eventually, and they always catch up at the worst possible time.
If you want me to take a quick look at your site and tell you what kind of shape it’s actually in — for free, no sales pitch — send the URL over and I’ll get back to you with a real assessment. Here’s how to reach me.
