Technical · 6 min read
WordPress security care plans: what agencies should include and resell
What a WordPress security care plan should include, what it cannot promise, how to word it in a proposal and what to look for in a partner.
November 11, 2026
Key takeaways
- Security in a care plan is a set of routine jobs, not a guarantee. Sell the work and the response, not the outcome.
- The core jobs: updates with checks, backups with tested restores, user and plugin hygiene, login protection, monitoring and a written incident process.
- Say plainly what the plan cannot promise, and put it in the proposal before a client asks.
- Price the plan around the effort of looking after a site, not around fear.
- A good partner works under your brand, documents what they did and never contacts your clients.
If you are asking what a WordPress care plan is, the short answer is a recurring service where someone keeps a client’s site updated, backed up, watched and supported. Security is the part clients care about most and the part agencies word least carefully. This post takes the security angle. For the broader scope, including support and change requests, start with our guide to what a WordPress care plan should include.
What security work belongs in a care plan
Most people stop at updates and backups. A WordPress web care plan that deserves the word “security” goes further.
- Updates with checks. Core, themes and plugins updated on a schedule, then the key pages and forms checked afterwards. Updates without a look afterwards just move the risk. WordPress documents the process in its upgrading guide.
- Backups and tested restores. A backup is only useful if someone has restored from it. Agree how often backups run, where they are stored away from the site itself, and that a restore is rehearsed. See the backup guidance.
- User and plugin hygiene. Remove plugins nobody uses, retire accounts of people who have left, and give each person the lowest role that lets them do their job.
- Login protection. Strong, unique credentials, a second factor for administrators and limits on repeated login attempts. The hardening guide covers the fundamentals.
- Monitoring. Uptime checks, alerts when files change unexpectedly and a regular scan for known problems.
- Incident response. A written answer to “what happens when something looks wrong”: who is told, who acts, how the site is restored and how the cause is traced.
What a care plan cannot promise
This is where proposals go wrong. No one can promise that a site will not be compromised. New weaknesses are found in software all the time, and a tidy plan reduces risk without removing it. Write the limits down:
- It cannot guarantee a site will stay clean, only that the routine work is done and the response is fast and organised.
- It cannot cover damage from credentials a client shares, plugins they install themselves or hosting changes nobody mentioned.
- It cannot fix a site built on abandoned or poorly written components at no extra cost. That is a project.
In the plan and out of the plan
| In the security plan | Outside it (quote separately) |
|---|---|
| Scheduled updates with before and after checks | Rebuilding components that can no longer be updated |
| Backups and a rehearsed restore | Recovery after a client shares access carelessly |
| User, role and plugin review | Security training sessions beyond an agreed amount |
| Login protection and monitoring | Full external security audits or compliance reports |
| A written incident process and clean-up | Legal, insurance or data-breach notifications |
How to word it in a proposal
Use plain sentences a client can repeat to their own boss. For example: “We keep your site updated and monitored, keep tested backups, review who has access, and if something goes wrong we restore the site and find out why. We cannot promise that no site is ever affected by a problem, which is why recovery is part of the plan.”
Put the exclusions on the same page as the inclusions, not in small print. It makes the conversation about scope calm instead of defensive. Our piece on why client sites get hacked is useful reading for how to explain the usual causes without alarming anyone.
Pricing it without numbers
Think in terms of effort and exposure rather than a fixed figure copied from someone else.
- Number and complexity of sites. A brochure site needs less attention than one with memberships, bookings or a shop.
- Response expectations. A same-day response commitment costs more than next-business-day.
- Restore rehearsal frequency. More frequent checks mean more time.
- Who bears the clean-up cost. Decide whether clean-up after an incident sits inside the plan or is billed on top, and say so.
Recurring revenue also helps your cash flow, which is a separate argument covered in retainer vs project-based work.
Doing this with a partner
If you do not want to run this in-house, we are a small, owner-led studio that builds and looks after WordPress and Elementor sites under your brand. You can see how our care plans are structured, including pricing, and how our white-label WordPress development works day to day. We never contact your clients, an NDA is available, and we do not run SEO, ads or social.
When you assess any partner, ask:
- Can they show you how a restore is tested, not just that backups exist?
- Do they write down what was done on each visit?
- How do they handle access, and who holds the credentials?
- What is their incident process, in steps?
- Will they stay invisible to your client?
Next step
Take one live client site this week and run the list above against it. Note what is missing, then decide what goes in your standard plan. If you would like a second pair of eyes, contact us or read how we work first.
Frequently asked questions
What is a WordPress care plan?
What should a WordPress care plan include besides updates and backups?
Can an agency promise a site will not be hacked?
Should security be a separate add-on or part of every plan?
Sources and further reading
- Security overview — WordPress’s own starting point for site security.
- Hardening WordPress — practical measures for reducing exposure.
- Backups — what to back up and how to plan for restoring.
- Upgrading WordPress — the update process and precautions.
- WordPress documentation — general reference for site owners.
- WordPress requirements — hosting requirements to check when reviewing a site.
Ready to talk?
Looking for a white label web partner you can actually rely on?