What is in a website care plan (and what should it cost)?

Strip away the marketing and a care plan is a bundle of recurring jobs that keep a website healthy. None of them are glamorous, and that's rather the point — they're the maintenance that quietly prevents the expensive emergencies. A good plan should spell out exactly which of these it includes, in writing, rather than hiding behind a vague promise of 'support'.

Hosting and the technical layer come first: the server your site lives on, the SSL certificate that shows the padlock and keeps data encrypted, and the domain renewal if that's bundled in. On top of that sits the ongoing software upkeep — applying security patches and version updates to the CMS, plugins, themes or framework before an out-of-date component becomes the hole someone climbs through.

Then there's the safety net. Regular backups stored off-site mean that if something does break — a bad update, a hack, a fat-fingered edit — the site can be rolled back to yesterday rather than rebuilt from scratch. Monitoring watches for downtime and security threats so problems are caught fast, ideally before a customer ever notices. And a sensible plan includes a monthly allowance of small content changes — swapping a price, adding a team photo, updating opening hours — plus a clear route to support when you need a human.

Every business with a website is, knowingly or not, choosing one of three approaches to upkeep. Being deliberate about which one you're on is half the battle.

A managed plan hands the whole list above to a provider for a monthly fee. You trade a predictable cost for not having to learn server admin, track security advisories, or scramble when the site goes down on a Friday night. DIY means doing it yourself: it can work well if you're technical, genuinely have the time, and stay disciplined about backups and updates — but for most owners the real cost is the hours it eats and the jobs that slip when the business gets busy. The third option, 'nothing', is the most common and the most expensive in the long run. The site runs untouched until the day it doesn't, and by then the bill is a rebuild rather than a patch.

There's no universally right answer. A simple static site for a sole trader needs far less hands-on care than a busy WordPress site with a dozen plugins or an e-commerce store taking payments. The point is to match the level of care to what the site actually is — and to the cost of it being down.

It's tempting to assume a finished website just keeps working. Most do — right up until they don't, and the failure almost always lands at the worst possible moment. Understanding the specific risks makes the monthly fee look less like an expense and more like insurance.

Security is the big one. Out-of-date software is the single most common way small business sites get hacked, because automated bots scan constantly for known, unpatched vulnerabilities. A compromised site can be defaced, quietly used to send spam or host scam pages, or have customer data exposed — which, depending on what you collect, can become a data-protection problem under UK GDPR, not just an IT one. Google may also flag a hacked site with a warning that scares off every visitor.

Downtime and breakage are the quieter risks. Hosting fails, an SSL certificate lapses and throws a 'not secure' warning across your site, or an unmanaged plugin update breaks the contact form so enquiries silently stop arriving. Without monitoring, you often find out days later — from a customer, or from the leads that never came. And with no recent backup, recovery turns a few minutes' rollback into days of expensive rebuilding. For any business that relies on its site for enquiries or sales, the lost work usually dwarfs what a care plan would have cost.

Pricing varies because the work varies, but there are sensible ballpark ranges. Treat any figure here as typical rather than a fixed quote — the right number depends on your platform, the site's size and how quickly you need things fixed.

At the entry level, in the region of £25 to £50 a month buys the essentials for a small, stable site: managed hosting, SSL, software updates, regular backups and basic monitoring, with a small monthly allowance for tweaks. A mid-tier plan, very roughly £50 to £100 a month, adds faster response times, more hands-on update testing, security hardening and a more generous change allowance — a fit for most established business sites. Higher tiers, from around £100 to £150+ a month, suit busy, complex or revenue-critical sites: e-commerce, sites with lots of moving parts, or businesses that simply can't afford downtime. These tend to include priority support, more proactive work and sometimes light ongoing improvements.

Be wary of two extremes. A plan that looks suspiciously cheap is often hosting with little else behind it — no real backups, no testing, no one actually watching. At the other end, a pricey retainer that won't say plainly what's included can be padding. The honest test is simple: a good provider will list exactly what you get, what's outside the plan, and how fast they respond when something breaks.

The best plan isn't the cheapest or the most expensive — it's the one matched to what your site is worth to the business and how much downtime would actually hurt. Start there. A site that brings in most of your enquiries or takes payments justifies more cover than a simple online business card.

From there, it's about reading what's really on offer. Ask what's included versus what's billed separately, how often backups run and where they're stored, what the response time is when something breaks, and whether updates are tested before they go live or just pushed and hoped for. Crucially, check the change allowance — how many small edits you get and what counts as 'small' — so you're not nickel-and-dimed for routine updates. And confirm the ownership basics: that you keep your domain, your site files and your data, and can leave with everything if you ever want to.

A care plan should buy you peace of mind, not a cage. If a provider is clear about what's covered, honest about what isn't, and doesn't lock you in, you're looking at a real managed service. If the details stay vague, that tells you what you'd actually be paying for.

Ongoing care is one of our core services, and we keep it deliberately straightforward. Every site we build can sit on a care plan that covers the essentials properly — secure managed hosting, SSL, software and security updates, regular off-site backups, uptime and security monitoring, and a monthly allowance of small changes — with a senior team here in Shropshire actually on the other end, not a ticket queue.

Because we build for speed and keep sites lean, there's usually less to go wrong in the first place, which keeps the upkeep light and the cost sensible. We're plain about what each level includes and what it doesn't, the price is fixed monthly with no lock-in, and you own everything throughout: the domain, the site and your data. If the site outgrows its plan or you want to scale the marketing alongside it, that's a conversation, not a surprise on your invoice.