What a WordPress care plan should include (and what it should not)

Updates, backups, monitoring, restores and support: what a WordPress care plan covers, what it does not, and how agencies resell it fairly.

November 4, 2026

What a WordPress care plan should include (and what it should not)

Key takeaways

A good care plan is specific about what it covers and equally specific about what it does not.
Core inclusions: scheduled updates with checks, backups that are tested, security basics, uptime and form checks, and a named way to ask for help.
New pages, redesigns and new features are projects, not maintenance.
If you include a change allowance, define its size, how to request it and what happens when it runs out.

A care plan sounds simple: keep the site updated and safe. The trouble starts when nobody has written down what “keep it updated” means, and the plan quietly becomes unlimited free edits. A good plan is specific about what it covers, and just as specific about what it does not.

What belongs in a care plan

Updates. WordPress core, themes and plugins, applied on a regular schedule rather than whenever someone notices. Checking the site after updates matters as much as running them. WordPress documents the process in its upgrading guide.
Backups, and restores that work. A backup nobody has tested is a hope. Ask how often backups run, where they are stored, and whether restoring has been tried. See WordPress’s backup guidance.
Security basics. Login protection, removing unused plugins and users, and a response plan when something is flagged. WordPress’s hardening guide lists the fundamentals, and our piece on why client sites get hacked explains the usual causes.
Uptime and form checks. Someone watches that the site is up and that the contact form still delivers.
A named way to ask for help, with a stated response time.

Smiling woman working on a laptop at a cafe table — Most clients buy a care plan for peace of mind: someone is watching, and someone answers.

What usually should not be in it

New pages, redesigns and new features. These are projects. Quote them as projects.
Content writing and ongoing SEO. Different skills, different pricing.
Fixing problems caused by outside changes, such as a client installing plugins unannounced or a host migration nobody mentioned.

Write these boundaries in plain language. When a request falls outside, the plan should make “that is a small project, here is the price” an easy conversation instead of an awkward one.

In scope and out of scope

In the plan	Out of the plan (quote separately)
Scheduled core, theme and plugin updates	New pages and sections
Backups and a tested restore	Redesigns and new features
Security clean-up and monitoring	Content writing and SEO campaigns
Uptime and form checks	Fixes for changes made by others
A named support contact	Training sessions beyond an agreed amount

Watch out: A plan that never says no gets abused. Without written boundaries, “small tweaks” slowly become unpaid project work.

Include a small allowance for changes?

Many agencies add a modest bucket of minor edits, such as text and image swaps, so clients feel looked after. If you do, define it: how much, how requests are made, and what happens when it is used up. An undefined allowance is the most common way a care plan loses money. See our thinking on retainers vs project work.

Speed belongs in the plan too

Sites slow down as they age: new plugins, bigger images, extra scripts. A monthly look at the key pages catches it early. Our Core Web Vitals checklist is a good template for that review, and if you are taking on a site that has already drifted, start with the takeover audit.

Tip: Put the first care-plan review on the calendar at handoff, not after the first problem. A short note of what was checked builds trust.

Selling it to clients

Do not lead with a feature list. Lead with the outcome they care about: the site stays up, stays safe, and someone answers when something looks wrong. Then show the list. Most clients buy peace of mind. A clear brief and handoff at the start of the project makes it easier to explain what the plan will cover.

Laptop screen showing a video call with a houseplant beside it — A quarterly check-in call is an easy way to show the value of the plan to a client who rarely sees the work.

Reselling under your brand

If you resell a care plan, the client deals with you, and a partner works behind you. Make sure the partner’s scope matches what you promised. Ours is described on the care plans page, and our white label WordPress development service pairs with it for agencies that want builds and care from one studio. See also how we work. To discuss a plan for your clients’ sites, contact us.

Frequently asked questions

Is a care plan the same as hosting?

No. Hosting keeps the server running; a care plan looks after the WordPress site on it. Some hosts bundle both, so check what is actually included.

How often should updates run?

On a regular schedule, with a check afterwards. The right interval depends on the site; what matters is that it is consistent and tested.

What if a client refuses a care plan?

That is their choice. Put in writing that maintenance, security and restores are then not covered.

Should a care plan include emergency fixes?

Decide and state it. Many plans cover restoring from a hack or failed update, while larger repairs are quoted.

Sources and further reading

WordPress: upgrading — the official process for updating.
WordPress: backups — what to back up and how.
WordPress: hardening — security fundamentals.
WordPress: security overview — the wider picture.
WordPress: performance optimisation — keeping sites fast over time.
web.dev: Web Vitals — monthly speed checks use these measures.

Keep reading

Ready to talk?

Looking for a white label web partner you can actually rely on?

Book a Call Elementor Development