A WordPress website is never really finished. The core software, the theme and every plugin keep receiving updates, the hosting company changes the PHP version underneath, the security certificate renews in the background, and a contact form that worked in the spring can quietly stop delivering email by the autumn. A care plan means someone deals with all of that every month, checks the site still works afterwards and tells you in plain English what was done.
The updates are not the point. The point is that your enquiry form, your booking calendar or your checkout keep working while you run the business, and that if something does go wrong there is a recent, tested backup to put it right without starting from scratch.
Who a care plan suits, and who it does not
It suits UK small businesses whose WordPress site brings in enquiries, bookings or sales, but where nobody in the business owns the job of keeping it healthy. The usual signs:
- The developer who built the site has moved on, or charges by the hour every time you need a small change.
- You log in, see a column of update notices and close the tab, because the last time someone pressed “update all” the homepage broke.
- You run a WooCommerce shop and a broken checkout on a Saturday would cost you real orders.
- Several people have logins and you are not sure who still has access.
It does not suit sites on Wix, Squarespace or Shopify, where the platform handles its own software. It is also the wrong spend for a site that needs replacing: if the theme has been abandoned and the page builder fights you on every edit, monthly maintenance only keeps a poor site running. In that case a planned website redesign is the better use of the money.
What a care plan covers
Updates, tested before they reach the live site
I apply updates to WordPress core, the theme and each plugin on a staging copy of your site first, check the pages and forms that matter, then repeat the same updates on the live site. Higher-risk updates, such as a major WooCommerce release or a new version of a page builder, go through one at a time rather than in a batch. If an update breaks something I cannot fix quickly, I roll it back and explain why in the report, rather than leaving the site half working.
Backups kept away from the server
Backups of the files and the database, taken as often as the site changes (a shop taking orders needs them daily, a brochure site far less often) and stored outside your hosting account so that a failed or compromised server does not take the backups with it. A backup is only worth something if it restores, so I restore one to a test location on a schedule agreed before the plan starts. Backups contain personal data under UK GDPR (form entries, customer orders, user accounts), so they have a fixed retention period and a recorded storage location that your privacy policy can describe accurately.
Security checks
Regular malware scans, a review of administrator accounts so former staff and past developers no longer have access, two-factor login for anyone with admin rights, and a watch for plugins with a published vulnerability or an author who has stopped maintaining them. Deleting a plugin nobody uses is often the most useful security change of the month.
Uptime, certificates and renewals
Uptime monitoring that alerts me when the site stops responding, a check that the SSL certificate is renewing, and a reminder well before the domain renewal date. An expired domain takes the website and the company email down together, and it is an entirely avoidable outage.
Forms, email and tracking
Each month I send a test enquiry through every important form and confirm it arrives. By default WordPress sends mail straight from the web server, which many inboxes treat with suspicion, so I check that form notifications go through a properly authenticated mail service. I also check that analytics and ad conversion tags still fire after updates, and that the cookie banner still holds them back until a visitor consents, which PECR requires. When the numbers look wrong, the steps in my guide to checking your conversion tracking works are the ones I follow.
Search Console and sudden problems
A monthly look at Google Search Console for new indexing errors, security warnings and important pages dropping out of the index, plus a check for a stray noindex or a staging copy pushed live with “Discourage search engines” still ticked. Longer-term search work belongs in a WordPress SEO or technical SEO project. The care plan is there to catch problems the week they appear.
Small changes
Time each month for the small edits that otherwise wait for weeks: new opening hours, a price change, a staff photo, a new page built from an existing layout. How much time is included is agreed before the plan starts.
What happens each month
- A fresh backup is taken and confirmed before anything is touched.
- Updates are applied on staging, the key pages and forms are checked, and the updates are then applied live.
- The live site is checked again on a phone and a desktop: the homepage, main service pages, contact form and checkout if you have one.
- Security scan, user account review and plugin review.
- Search Console, the uptime log and certificate and domain dates are reviewed.
- Small changes from your list are completed.
- You receive a short report: what was updated, what I found, what I recommend and anything that needs a decision from you.
Urgent problems between visits, such as the site being down, a defaced page or a form that has stopped sending, are handled as they come in. How quickly urgent issues are picked up, and in which hours, is agreed in writing before the plan starts.
What a care plan does not include
- New features, new page templates or design changes, which I quote separately.
- Moving the site to a different host. That is a planned project with its own checks, not a monthly task.
- Writing new content or running ongoing SEO.
- Cleaning up a site that was already infected before the plan began.
- Hosting fees, premium plugin licences and domain renewals. These stay in the business’s own name and accounts, so you never depend on me to keep them paid.
Problems I see most often on UK WordPress sites
- Too many plugins. Dozens installed, many of them switched off, and several no longer updated by their authors. Every one is code that can be exploited, even when it is inactive.
- Lapsed licences. A premium theme or page builder bought once, with the licence never renewed, so updates silently stopped arriving and the site is running an old version with known holes.
- One shared admin login. The same username and password used by the owner, two former members of staff and every developer the business has hired.
- Backups in the wrong place. Copies kept only on the same hosting account, or only as the host’s own snapshots, which you may not be able to download if you leave.
- A silent contact form. Enquiries failing for weeks, and nobody noticing because it looked like a quiet month.
- PHP upgrades. The host moves to a newer PHP version, an old plugin starts throwing errors and part of a page disappears.
- Ownership. The domain, hosting or premium licences registered to the developer rather than the business.
Your hosting company is not maintaining your site
Plenty of hosts sell “managed WordPress”. With managed hosting the host usually looks after the server, server-level caching, its own backups and often WordPress core updates. What it does not normally do is check that your contact form still sends, that a plugin update has not broken your booking calendar, or that the person who left last year can no longer log in. It is worth reading your host’s terms to see exactly what “managed” covers. The gap between that and a site that works for your customers is the part a care plan fills.
What you receive
- A monthly written report in plain English.
- Off-server backups with a stated retention period and location.
- An access record: who has which login, where the domain, hosting and DNS are held, and every renewal date, all in the business’s name.
- A prompt when something needs your decision, such as an abandoned plugin to replace or a licence to renew.
What it costs
Each quote is written in GBP after a free audit or a first call, and agreed in writing before any work starts, including any minimum term and notice period. The price depends mainly on how many plugins the site runs, whether it takes payments and how much change time you want each month. I review the site once before quoting, so the plan matches what is actually installed rather than a guess.
Next step
Send me your web address and a line on what the site does for the business, whether that is enquiries, bookings or sales, through the contact page. I will look at it, tell you what state it is in and what I would fix first, and say honestly whether a care plan, a one-off clean-up or a rebuild makes more sense.