What is in a website care plan, and how do you choose one?

Strip away the marketing and a care plan is a bundle of recurring jobs that keep a website healthy. None of them are glamorous, and that's rather the point: they're the maintenance that quietly prevents the expensive emergencies. A good plan should spell out exactly which of these it includes, in writing, rather than hiding behind a vague promise of 'support'.

Hosting and the technical layer come first: the server your site lives on, the SSL certificate that shows the padlock and keeps data encrypted, and the domain renewal if that's bundled in. On top of that sits the ongoing software upkeep, applying security patches and version updates to the CMS, plugins, themes or framework before an out-of-date component becomes the hole someone climbs through.

Then there's the safety net. Regular backups stored off-site mean that if something does break (a bad update, a hack, a fat-fingered edit) the site can be rolled back to yesterday rather than rebuilt from scratch. Monitoring watches for downtime and security threats so problems are caught fast, ideally before a customer ever notices. And a sensible plan includes a monthly allowance of small content changes (swapping a price, adding a team photo, updating opening hours) plus a clear route to support when you need a human.

Every business with a website is, knowingly or not, choosing one of three approaches to upkeep. Being deliberate about which one you're on is half the battle.

A managed plan hands the whole list above to a provider for a monthly fee. You trade a predictable cost for not having to learn server admin, track security advisories, or scramble when the site goes down on a Friday night. DIY means doing it yourself: it can work well if you're technical, genuinely have the time, and stay disciplined about backups and updates, but for most owners the real cost is the hours it eats and the jobs that slip when the business gets busy. The third option, 'nothing', is the most common and the most expensive in the long run. The site runs untouched until the day it doesn't, and by then the bill is a rebuild rather than a patch.

There's no universally right answer. A simple static site for a sole trader needs far less hands-on care than a busy WordPress site with a dozen plugins or an e-commerce store taking payments. The point is to match the level of care to what the site actually is, and to the cost of it being down.

It's tempting to assume a finished website just keeps working. Most do, right up until they don't, and the failure almost always lands at the worst possible moment. Understanding the specific risks makes the monthly fee look less like an expense and more like insurance.

Security is the big one. Out-of-date software is the single most common way small business sites get hacked, because automated bots scan constantly for known, unpatched vulnerabilities. A compromised site can be defaced, quietly used to send spam or host scam pages, or have customer data exposed, which, depending on what you collect, can become a data-protection problem under UK GDPR, not just an IT one. Google may also flag a hacked site with a warning that scares off every visitor.

Downtime and breakage are the quieter risks. Hosting fails, an SSL certificate lapses and throws a 'not secure' warning across your site, or an unmanaged plugin update breaks the contact form so enquiries silently stop arriving. Without monitoring, you often find out days later, from a customer or from the leads that never came. And with no recent backup, recovery turns a few minutes' rollback into days of expensive rebuilding. For any business that relies on its site for enquiries or sales, the lost work usually dwarfs what a care plan would have cost.

Care plans are priced in all sorts of ways, and the spread between the cheapest and the dearest is wide because the work behind them is so different. Rather than anchoring on a number, it's more useful to understand what pushes the price up or down, so you can tell whether a quote is fair for what's actually being done.

The biggest factor is the platform. A WordPress site with a dozen plugins needs updates tested and applied every week, and each one is a chance to break something, while a lean static site has far less to go wrong and therefore far less to maintain. After that comes the size and complexity of the site: an online shop taking payments, a site with integrations and booking systems, or one with hundreds of pages simply takes more looking after than a five-page brochure. Then there's what you want from the plan beyond keeping the lights on: how many content changes you expect each month, whether you want new pages and features built as part of it, how quickly you need a response when something breaks, and how much downtime would actually cost you.

Be wary of two extremes. A plan that looks suspiciously cheap is often hosting with little else behind it: no real backups, no testing, no one actually watching. At the other end, a pricey retainer that won't say plainly what's included can be padding. The honest test is simple: a good provider will list exactly what you get, what's outside the plan, and how fast they respond when something breaks, and any quote should make sense against that list.

The best plan isn't the cheapest or the most expensive; it's the one matched to what your site is worth to the business and how much downtime would actually hurt. Start there. A site that brings in most of your enquiries or takes payments justifies more cover than a simple online business card.

From there, it's about reading what's really on offer. Ask what's included versus what's billed separately, how often backups run and where they're stored, what the response time is when something breaks, and whether updates are tested before they go live or just pushed and hoped for. Crucially, check the change allowance (how many small edits you get and what counts as 'small') so you're not nickel-and-dimed for routine updates. And confirm the ownership basics: that you keep your domain, your site files and your data, and can leave with everything if you ever want to.

A care plan should buy you peace of mind, not a cage. If a provider is clear about what's covered, honest about what isn't, and doesn't lock you in, you're looking at a real managed service. If the details stay vague, that tells you what you'd actually be paying for.

Ongoing care is one of our core services, and we keep it deliberately straightforward. Our website care plan covers hosting, SSL and DNS, software and security updates applied and tested, off-site backups, uptime and security monitoring, spam protection on your forms, regular checks that lead capture and page speed are still working, and an agreed monthly allowance of content changes and ongoing development: new pages, new features and conversion improvements, done by the team that built the site. You get one named person, Harry, who knows your site and answers when you get in touch, not a ticket queue.

We don't sell off-the-shelf tiers or publish a rate card. Every plan is scoped in writing after a free consultation, because the right level of cover depends on the platform, the size of the site and how much ongoing development you want. Plans are a rolling monthly fee with no lock-in, you can cancel with 30 days' notice, and you own the domain, the site and your data throughout. We can usually take on a site we didn't build, and if your site is simple enough to run yourself, we'll say so and show you how.