What a website care plan should include (and what to ask)

A website isn’t finished the day it launches. The software underneath it gets updated, plugins change, hosting needs attention, and every now and then something breaks. A care plan is the arrangement that makes sure someone is looking after all of that, so you don’t find out about a problem from a customer.

Care plans vary a lot. Some are genuinely useful. Some are a monthly fee for very little. This note covers what we think a good one includes, and the questions we’d ask if we were on your side of the table.

Why it matters

Most sites for small businesses and community organisations run on a content management system, often WordPress. That system, its theme and its plugins all receive regular updates, many of them security fixes. A site that isn’t updated slowly becomes easier to break into, and harder to update safely the longer it’s left.

Hosted platforms like Shopify or Webflow handle the core software for you, which is one of their real advantages. Even then, someone still needs to watch apps and integrations, keep content current and notice when something stops working. We compared those trade-offs in choosing a CMS.

What a good care plan includes

Updates, done carefully

Updates to the core software, theme and plugins should be applied regularly, but not blindly. A good provider tests updates, ideally on a staging copy of the site first, checks the site afterwards, and can roll back if something goes wrong.

Backups you can actually restore

Backups should be automatic, stored somewhere separate from the website itself, and kept for long enough to go back past a problem nobody noticed for a while. The part people forget is testing: a backup only counts if it has been restored successfully at least once.

Monitoring

Someone should know when the site goes down, when a security certificate is about to expire, or when a form stops sending. Uptime monitoring and basic security scanning are cheap to set up and catch problems early.

Security basics

Strong passwords, two-factor login for admin accounts, removing old user accounts and unused plugins, and keeping an eye on login attempts. None of this is glamorous, but it’s where most real-world problems start.

Hosting, preferably green

Ask where your site is hosted and what powers the data centre. Some hosts run on renewable energy or are working towards it, and the Green Web Foundation keeps a public directory you can check. A lighter site helps too: fewer plugins and smaller pages mean less work for the server on every visit. Our note on page-weight budgets explains how we keep that in check.

A little time for changes

Many plans include a small amount of time each month for content edits or small fixes. That’s useful if it’s clear how much time you get and what happens to time you don’t use.

Accessibility and performance check-ins

An occasional check that pages are still fast and still accessible is worth including. Sites drift as content gets added: a huge image here, an inaccessible embed there. Catching that early is easier than fixing it all at once.

Questions to ask a provider

Before you sign up, ask:

• What exactly is updated, how often, and do you test updates before applying them to the live site?
• Where are backups stored, how long are they kept, and when did you last test a restore?
• How will I know if the site goes down, and how quickly will you respond?
• Who owns the hosting account, the domain and the site files? Can I get them if we part ways?
• What’s included in the monthly fee, and what’s charged extra?
• Where is my site hosted, and what powers it?
• Will I get a short report of what was done each month?

The ownership question is the most important one. You should always own your domain, have admin access to your site and be able to move it elsewhere. A provider who makes that difficult is a risk, however good their service is.

Do you need one at all?

Not every site needs a formal plan. A small brochure site on a hosted platform, with someone on your team who’s comfortable making updates and keeping an eye on things, may be fine on its own. A site with an online store, bookings, member logins or lots of plugins is a different story. The more your site does, and the more it matters if it stops, the more a care plan is worth.

If you do look after the site yourself, the same list applies. Put the updates, backups and checks in a calendar, and make sure more than one person knows the logins.

Our rule of thumb

A good care plan is mostly invisible. Your site stays up, stays secure and stays quick, and you get a short note each month saying what was done. If you can’t tell what you’re paying for, ask.

If you’d like to talk about looking after your site, have a look at our website care or tell us what you’re working on. We’ll give you an honest view of what your site actually needs.