What Is a Website Care Plan? (And What Should It Cost?)

Your website launched. The invoice was paid. Everything worked.

Then, quietly, things started to drift. A plugin update broke a form and nobody noticed for three weeks. The SSL certificate lapsed on a Sunday. Page speed crept up as the image library grew. Someone asked for a small content change and there was no one obvious to ask.

None of these are disasters on their own. Together, they're how a good website becomes an embarrassing one over eighteen months.

A website care plan is the arrangement that prevents that drift. It's a monthly agreement with whoever looks after your site — covering updates, backups, security, monitoring, and usually a block of time for actual changes. Think of it less like insurance and more like a service contract for something you depend on every day.

This guide covers what a care plan actually includes, what it should cost, and how to tell a genuine one from a line item that buys you nothing.

What a website care plan actually includes

The term gets used loosely, which is part of the problem. Here's what a real plan covers, roughly in order of how essential each item is.

The non-negotiables

Software and dependency updates. Your CMS, plugins, themes, libraries, and server packages all release updates — many of them security patches. Someone has to apply them, and apply them carefully, because a bad update can break a live site. This is the single most important line in any care plan.

Backups, tested. Daily or weekly backups stored off-server, with a known restore process. The word that matters is tested. Plenty of businesses discover their backups were failing silently at the exact moment they need one.

Uptime monitoring. Automated checks that alert someone when the site goes down — ideally before your customers tell you.

Security scanning. Malware scans, vulnerability checks against known CVEs in your dependencies, and a firewall or WAF where appropriate.

SSL certificate management. Renewals handled so a certificate never lapses. Modern setups largely automate this, but someone still needs to own it.

The ones that separate a real plan from a token one

Performance monitoring. Tracking Core Web Vitals and page speed over time, not just at launch. Sites get slower gradually; without measurement, nobody notices until rankings drop.

Included development time. A defined block of hours each month for content changes, small features, and fixes. This is what turns a care plan from passive protection into something that keeps improving the site.

A staging environment. Somewhere to test changes before they hit production. Any provider updating a live site directly is taking a risk with your business.

Defined response times. Written commitments, tiered by severity — a site outage and a typo fix should not be treated the same. Vague "we'll get to it" is not a response time.

Reporting. A monthly summary of what was done, what was found, and what's coming. You should never have to ask what you're paying for.

What's usually not included

Worth knowing so you're not surprised:

• Full redesigns or rebuilds
• Major new features beyond your included hours
• Third-party licence and subscription fees (plugins, CDN, monitoring tools)
• Content writing, unless explicitly agreed
• Paid advertising management

WordPress care plans: what's different

WordPress runs a huge share of the web, and the same extensibility that makes it popular is what makes it harder to keep healthy. A WordPress care plan should include everything above, plus a handful of things specific to the platform.

Plugin vulnerability monitoring. Most WordPress security incidents start in a third-party plugin or theme, not WordPress core. A proper plan actively tracks your installed plugins against new vulnerability disclosures, with a plan for what happens when one affects you.

Coordinated update testing. Core, theme, and plugin updates interact with each other — applying them one at a time with no testing is how page builders and custom post types quietly break. Updates should go to staging as a batch, get checked, then go live together.

A deliberate policy on automatic updates. WordPress can auto-apply certain updates. That's fine for a simple brochure site and risky for anything complex with custom functionality. Someone should have actually decided the policy, rather than leaving whatever the default happens to be.

PHP version tracking. PHP versions go end-of-life on a published schedule, and hosts eventually force the upgrade whether you're ready or not. A good plan checks compatibility ahead of time and fixes issues before the host makes the decision for you.

Database housekeeping. Post revisions, expired transients, orphaned metadata, and spam comments all accumulate in a WordPress database over time. Periodic cleanup keeps a content-heavy site from slowing down.

Licence renewals. Premium plugins and themes stop receiving updates — including security updates — the moment a licence lapses. It's a small thing that causes a disproportionate number of avoidable problems.

If a provider pitches you a generic care plan and can't speak to plugin monitoring or update testing specifically, they're describing a plan built for a simpler platform than the one you're running.

Website care plan pricing: what you should expect to pay

Pricing varies with your platform, traffic, complexity, and how fast you need help when something breaks. The figures below are typical market ranges — treat them as orientation, not quotes.

Figures in USD. Euro and Singapore dollar pricing tends to land in broadly similar ranges — the drivers are complexity and response speed, not currency.

What actually moves the price

Four things, mostly:

1. Complexity. A WordPress brochure site and a headless commerce platform with three integrations are not comparable work.
2. Traffic and criticality. If an hour of downtime costs you real money, you're paying for faster response, and that costs more to staff.
3. Included development hours. This is usually the biggest single variable. A plan with fifteen hours of monthly dev time is a different product from one with none.
4. Response commitments. 24/7 coverage with a one-hour critical response requires people on call. That is genuinely expensive, and you should only buy it if downtime justifies it.

Be careful at the bottom of the market

A $29/month "care plan" is almost always an automated updater and a backup script with no human attached. That can be fine for a personal site. For anything your business depends on, the gap shows up the first time something goes wrong and there's no one to call.

Equally, expensive doesn't guarantee good. The question isn't what does it cost — it's what am I actually getting, in writing.

How to tell a real care plan from a bad one

Five questions that expose the difference quickly:

"What happens if my site goes down at 2 a.m. on a Sunday?"

A real plan has an answer with a number in it. A weak one has an answer with the word "usually" in it.

"Do you test updates before applying them to my live site?"

If there's no staging environment, they're updating production and hoping. That's a risk you're paying them to take on your behalf.

"What's included in my hours, and what happens if I don't use them?"

Clear plans state this plainly. Vague ones leave it deliberately fuzzy so every request becomes a negotiation.

"Can I see a sample monthly report?"

Providers doing real work are happy to show you what reporting looks like. Providers doing nothing have nothing to show.

"Am I locked in?"

Be a little wary of long mandatory contracts. The most confident providers often run month-to-month, because they'd rather earn the relationship than trap you in one. A client who has stayed three years without a contract tells you more than a two-year lock-in ever could.

Do you actually need one?

Honestly — not everyone does.

You probably don't need a care plan if: your site is a simple static page that rarely changes, you have in-house technical staff who own it, or the site genuinely doesn't matter much to your business.

You probably do if: your site generates leads or revenue, you're on a CMS with regular security updates, you handle any customer data, you don't have someone internal who owns the platform, or you've already been burned by something breaking with nobody to call.

The honest test: if the site went down tomorrow morning, who would fix it, and how long would it take? If you can't answer that quickly, the care plan is worth more than its price.

Frequently asked questions

The short version

A website care plan is someone taking responsibility for your site after launch. Expect to pay $50–150/month for basic protection, $200–500 for a plan that includes real development time, and more when downtime genuinely costs you money.

Judge plans on what's written down — response times, included hours, staging, reporting — not on the monthly number. The cheapest plan that leaves you calling an unanswered inbox during an outage isn't cheap.

At Redevon IT, ongoing platform care is the service we built the company around — we've been looking after clients' platforms since 2012. If you're comparing care plans, or inheriting a site someone else walked away from, tell us what you're working with and we'll give you an honest read on what you actually need.