WordPress Care Plans: What Should Be Included

The short version: A real WordPress care plan covers five things: managed updates with testing, off-site backups with a tested restore, security scanning and hardening, uptime and performance monitoring, and a monthly report that proves all of it happened. If a plan cannot show you a report and a restored backup, you are paying for a promise, not a service.

1. Updates – managed, not just automatic

Core, theme, and plugin updates are the highest-value item on the list, because out-of-date plugins are how most WordPress sites get compromised. The operative word is managed: updates applied on a schedule, with a backup taken first and the site checked afterwards, so a bad update is caught by the plan and not by your customers. Pure auto-update with nobody looking is a setting, not a service – you can switch it on yourself for free.

2. Backups – and a restore that has been tested

Daily backups, stored off the server (a backup on the same host dies with the host), kept for at least 30 days. The question that separates real plans from theatre: when was a restore last tested? A backup that has never been restored is a hope. A serious plan restores to a staging environment on a schedule and says so in the report.

3. Security – scanning, hardening, and a named response

Malware and file-integrity scanning on a schedule, with alerts that reach a human.
Hardening basics handled: login protection, least-privilege user accounts, removal of abandoned plugins and themes, which are attack surface even when deactivated.
A stated incident path: if the site is compromised, who cleans it, how fast, and whether cleanup is included or billed – in writing, before it happens.

4. Monitoring and small fixes

Uptime monitoring that pages someone when the site goes down, and performance checks that catch the slow creep of plugin bloat. Most plans also include a small monthly allowance for minor content changes – text edits, image swaps, a new page section. That allowance is genuinely useful; just get its size and its limits (what counts as "small") in writing, because this is where vague plans generate surprise invoices.

5. What should not be in a care plan

Red flags: "SEO included" with no defined deliverable; hosting resold at a markup with no say in quality; page-building or development work implied but never specified; and lock-in language around your own site – your domain, hosting account, and licenses should stay in your name, with the plan providing a clean exit and a full backup handover. A care plan is maintenance, not a redesign subscription and not an SEO retainer; plans that blur those lines usually under-deliver on all three.

6. The monthly report is the product

Everything above is invisible when it works – which is exactly why the report matters. One page a month: updates applied, backup status and restore test, scan results, uptime, and anything that needs a decision. If a provider will not commit to reporting, assume the work is not happening. For agencies, the same standard applies white-label: your clients should receive reports you are proud to put your name on.

Want care you can verify?

We run WordPress maintenance for small businesses and white-label care for agencies – updates, tested backups, security, and a report you can check.

WordPress Management Service Ask a Question

WordPress Care Plans: What Should Actually Be Included (and What Should Not)