WordPress
What a WordPress care plan should actually include
Most maintenance retainers are an automated update and an invoice. Here is what the money should be buying.
WordPress maintenance is sold in a vague enough way that it is hard to compare offers. This is the list to hold a quote against.
The minimum
- Off-site backups, tested. Daily for a shop, weekly for a brochure site. Stored somewhere other than the same server. A backup nobody has ever restored is a hope, not a backup.
- Updates on staging first. Core, plugins and theme applied to a copy, checked, then pushed. Auto-updating a live shop is how checkout breaks on a Saturday.
- Uptime monitoring with an alert that reaches a human.
- Security scanning and a documented response if something is found.
- PHP version management. Running an end-of-life PHP version is the most common serious risk we find, and it is invisible from the front end.
What separates a good plan
- A monthly report you can read. What was updated, what broke, what was fixed, what is coming. Not a plugin-generated PDF of green ticks.
- A defined response time for "the site is down" versus "please change this text".
- Included small changes. An hour or two a month covers the requests that would otherwise become awkward little invoices.
- Licence management. Someone tracking that the premium plugin renewals actually happen, because an expired licence stops receiving security patches.
What to check before signing
Who owns the hosting account and the domain? If the answer is the agency, get that changed. You should be able to leave with your site intact. Ask what happens to backups if you cancel, and ask for the restore procedure in writing.
A rough price
For a straightforward business site, €40–90 a month is realistic in the German and Canadian markets. A WooCommerce store with plugins and a payment provider is €120–300. Below about €30 you are paying for an automated updater and nobody is looking at anything.
The uncomfortable maths
A compromised site costs a few thousand euros to clean, plus the search damage from being flagged, plus the emails to customers. Two years of a decent care plan usually costs less than one incident, and unlike the incident it is a planned expense.
Working on something like this?
Tell us what you are building — we reply to every enquiry.