What to include in a website care plan

A website care plan, or maintenance plan, should cover the work that keeps a site as delivered, and nothing that changes it. The sheet below applies that test line by line, ready to copy into your client agreement.

Skip the sheet

Scale the scope to what the site does

Brochure site 29 lines Content changes a few times a year Lead-generation site 30 lines The forms are the point Online shop 30 lines Orders arrive between backups Hosted builder 26 lines Squarespace, Webflow and similar

Every line, and what to write against it

Care plan for a brochure siteCare plan for a lead-generation siteCare plan for an online shopCare plan for a site on a hosted builder

Open any line for the reason it is there. A value is a promise to the client, not a tool's checking rate. Every value here is an example to adapt.

In the plan Check and fix

Each line protects something that already exists, on a schedule you can hold to.

Software updates Weekly Weekly, tested on a staging copy first In the plan

CMS, plugin and theme updates on a set schedule, with a backup taken right before each run so a bad update can be rolled back.

Brochure site: Backups drop to monthly on a quiet site and this line does not: updates arrive on the software's release schedule rather than on the site's.
Online shop: Test updates on a staging copy before they reach the live store.
Shop software and payment gateway plugin Named as updates in their own right In the plan

Name them in the scope, so nobody has to guess whether the shop software is covered. Technology Matters writes the split down: it lists "Regular WordPress CMS & Extension Updates (not including eCommerce software)" on its entry Maintain plan and adds eCommerce updates on Manage, one tier up. If a shop sits on a plan written for a brochure site, name the exclusion the same way.
Security fixes Within 1 business day of release In the plan

Security fixes applied within a stated time of their release, rather than at the next scheduled update run.
Backups Monthly, and before every update Daily and before every update, kept 30 days off-site At least daily, and before every update Only what the builder offers, stated in writing In the plan

Automatic, stored away from the site's own server, and kept for a stated period.

Brochure site: There is little new to lose on a site whose content changes a few times a year, so monthly works as long as a backup is also taken before every update.
Online shop: Orders arrive between backups, so back up at least daily.
Hosted builder: Check what the builder offers for backups before promising any, and write down what the client gets.
Restore test Quarterly In the plan

Test-restore a backup on a stated schedule, so you know a restore works before the day you need it.
Admin login review Quarterly In the plan

A regular review of who holds an admin login, with former staff and old contractors removed.
Contact form testForm testsTest order through checkout After every update Every form, after every update On a stated schedule In the plan

Forms still send and key pages still load.

Lead-generation site: Test every form, not only the one on the contact page, and check that submissions still arrive where they are meant to, whether that is an inbox or a CRM.
Online shop: On a shop the functional check becomes a test order through checkout. In Ireland, seowizard.ie puts "Order flow checks and checkout troubleshooting" on its eCommerce plan, which also states a faster response time than its other two plans.
Tracking and analytics tags After every update In the plan

On a lead-generation site the forms are the point, so check that the tracking and analytics tags still fire after an update.
Broken links and images Weekly In the plan

A broken link and a missing image are both silent: nothing on the site raises one, and they usually appear because something else moved. A renamed page, a deleted file, an embed the other end withdrew. The interval is how often somebody goes looking.

In the plan Check and report

Watched and written up, without a promise to fix what the check finds.

Uptime At least every 5 minutes In the plan

A regular check that the site responds, with an alert to you when it does not. As a starting point, check every few minutes, and write the interval as a floor so a faster check still keeps the promise.
Malware and vulnerability scan Daily In the plan

Scanning lowers the risk, so it belongs in the plan either way. Cleaning up a site that was hacked is a separate decision, and it is one of the gray areas below.
SSL and domain expiry Daily In the plan

Both dates, watched well ahead of the day. Watching a certificate expiry date is a different promise from renewing the certificate, which is why this line says check and report.
Page scores Monthly In the plan

The four Lighthouse scores, performance, accessibility, best practices and SEO, tracked over time so a heavy plugin or an oversized image shows up as a change you can point to. The interval here is how often you hand the client a reading, whatever a tool checks between them.
Report to the client Monthly In the plan

What was checked, what was found and what you fixed, sent on a schedule the client knows. What to put in it is further down this page.

Quoted separately

Work that sits right next to maintenance and is easy to absorb by accident. Give each one its own line and its own limit, so it cannot grow quietly inside the plan fee.

Content edits Quoted per request Quoted separately

Text changes, image swaps, a blog post uploaded. Define an edit: changing what is on an existing page is an edit, and building a new page is a project. How much time to include is a pricing decision, not a scope one. An allowance inside the plan works too, as long as it has its own limit; this row shows the other option.
HostingThe builder subscription Quoted separately, unless the agreement includes it On the client account and paid by the client Quoted separately

Either way works if the agreement says which. Neil Patmore's care plan page says hosting "is separate unless it is specifically agreed as part of your arrangement", while Inspirable offers "Hosting included, or keep your own host at the same price." If you do not host, write down that server outages and the host's own backups belong to the host, and that your plan covers the site itself.

Hosted builder: On a hosted builder the platform is the host, so this line is about whose account holds the subscription and who pays for it. Say both in the agreement: an account in your name that the client funds and one in the client name that you administer hand over differently when the plan ends.
Performance work Quoted, with an end date Quoted separately

Tracking page scores is maintenance. Compressing every image, replacing a slow theme or adding a CDN is optimization work with an end date, so quote it.
Accessibility audit and fixes Quoted, with the audit priced first Quoted separately

Watching an accessibility score for drops fits the plan. An accessibility audit, and the fixes that follow it, are specialist project work.
Plugin and theme licensesPaid templates and add-ons Quoted separately, or billed on to the client Quoted separately

A premium license can lapse, and the updates stop with it. Decide whether the plan pays for them or the client does, and whose account each one sits in.
Hacked site cleanup Quoted, work starts within 4 business hours Quoted separately

Included, included up to a time limit, or quoted separately: any of the three works once it is written down, and this row shows the third. Say how quickly work starts either way. The gray areas below have the two plan pages that draw this line differently.

Not in the plan

Work that changes the site, or grows the business, is a project or a separate service. Name it here anyway, so the client can see where the line falls.

Software updates on a hosted builder Done by the platform Not in the plan

The platform runs the servers and updates its own software, so the software updates line comes out of the plan. Say so in the agreement rather than leaving the line off it, so the client can see why this plan is smaller.
Redesigns, new pages, features and integrations Quoted as a project Not in the plan

They change the site rather than keep it working as delivered.
Moving to a new host, domain or platform Quoted as a project Not in the plan

A move is one-off work with an end date: DNS to change, a new environment that behaves differently, and a round of testing before the plan picks the site up on the new host. Say in the agreement that the plan resumes once the site is live there.
Writing content, SEO and marketing campaigns A separate service, with its own goals Not in the plan

Checking that pages stay indexable and keep their SEO score fits maintenance, because it protects the site as delivered. Keyword research, content and link building aim to change results. An article on The Admin Bar puts search engine optimization under its author's heading "A few services I (personally) would not include", and one reason it gives is that a client disappointed by rankings or traffic can end up canceling the care plan too, even though the two do different jobs.
Email hosting and mailbox problems Not covered Not in the plan

The same Admin Bar article lists email under the services its author would not include, alongside search engine optimization, accessibility and policies such as privacy policies, terms of service and cookie consent. Whichever of those you keep out, name it in the agreement.
Host, payment provider and third-party outages Reported, not repaired Not in the plan

Failures inside services you do not control, such as the host, a payment provider or a third-party API. The plan can cover noticing the failure and telling the client. It cannot promise the repair.

Hosted builder: On a hosted builder the platform itself is one of those services, so its outages sit here too.

Response times

Support runs when someone asks rather than on a schedule, so this band sets the times to answer in and the hours they are counted in.

Site down Within 1 hour, 8:00 to 20:00 every day

The severity the plan is most visibly measured against, so it is the one worth stating precisely. A response time with no hours beside it means nothing, so this line carries its own window rather than running on the business hours below: a site is down at the weekend too. Set the hours on the row to ones you can answer in.
A form or key page brokenCheckout or a key page broken Within 4 business hours

The middle severity is whatever the site exists to do: a form on a lead-generation site, checkout on a shop.
Routine request Within 2 business days

Everything that is not urgent, so a routine question cannot be read as an outage.
Business hours Monday to Friday, 9:00 to 17:00

Without this line the response times above that count in business time are open ended. "Within 4 business hours" starts counting at the next hour the agreement says you are working, so a Friday evening message and a Tuesday morning one run on different clocks and only this line says which. Set the hours you will answer in rather than the ones that read best, because these are the times those lines are measured against. The Site down row carries its own window, so it does not run on these hours.

Ending the plan

The notice period, and what the client receives at the end.

Notice period 30 days, in writing

The number is the easy half. "In writing" is the half that settles arguments, because a plan cancelled in a passing remark has no date on it and nothing to count 30 days from. Make it run both ways: whatever notice the client owes you, you owe the client. The notice period is also the window the handover below has to happen in, so a short one is a decision about that too.
At the end Admin access, the latest backup, a note of open work Admin access, a note of open work

What the client receives when the plan stops. A handover written into the agreement is one less thing to negotiate on the way out.

Hosted builder: There may be no backup to hand over on a hosted builder, so say what there is instead.

What you leave out is a decision too

"Including SEO services also increases the client canceling their care plan (which is essential for the site’s health) when their rankings or traffic aren’t meeting their expectations".

Kyle Van Deusen, The Admin Bar, on four services he says he personally would not include in a care plan

Under the heading "A few services I (personally) would not include", that article names search engine optimization, accessibility, email, and policies: privacy policy, terms of service, cookie consent. Draw your own line, as long as the agreement says where it is. The sheet sets one plan at one level; how much to charge for website maintenance covers what published plans put at each tier.

A frequency turns a line item into a promise

A bare noun commits you to nothing. "Backups" can mean monthly or nightly, kept a week or a year, and the agreement does not say which. Write the interval against the line, and the retention window where there is one.

Pick that interval from what the site loses while nobody is looking. An outage costs from its first minute, so it is watched continuously. A backup is worth taking as often as the site gains something nobody could retype. Anything that can only break when something changes, such as a form after an update, is checked on release rather than on a calendar.

One site's overview in SiteLetter: uptime, Lighthouse scores, visual checks, SSL and domain status together — A real SiteLetter screen, with demo data. It checks and reports; the work in the plan stays yours.

Gray areas to settle before they cause a dispute

Six situations where more than one answer is reasonable. Four of them carry plan pages from the Sources list, quoted in their own words, and on three of those the pages land on different sides.

What to write down

Why, and where published plans land

01 If an update breaks something

The rollback is in the plan. Real development is quoted as a project.

A rollback that loses the orders, form entries and edits made since the backup is a second incident. Take the backup right before the update, and put the update back on only once the conflict is understood. Replacing a plugin its developer has abandoned is a different job from putting the site back, and the agreement should not treat them as one.

No plan page in the Sources list states this one, so the agreement is where it gets settled.
02 If the site is hacked

Pick one: cleanup included, included up to a time limit, or quoted separately.
Reducing the risk belongs in the plan, which is what the scan line on the sheet is for. Cleanup is the part two published plans put in different places.
- seowizard.ie Lists "Malware scanning and cleanup if needed" on its Standard Care plan.
- Fix My Site Lists Malware Removal on its Security Plan rather than its Maintenance Plan.
03 Whether hosting is in it

Which way it goes, and who owns the server side either way.
If you host the site, server uptime and server backups are yours. If the client's own host runs it, write down that server outages and host-side backups belong to the host and that your plan covers the site itself.
- Inspirable "Hosting included, or keep your own host at the same price."
- Neil Patmore "Hosting is separate unless it is specifically agreed as part of your arrangement."
04 If the client breaks it

Whether restoring is in the plan, and whether finding the cause is billable.

A client with admin access can install a plugin or edit a template and break a site the plan was keeping stable. The backup exists either way, so putting the site back is the cheap part. Working out what happened is the part that can land on either side. Say as well what the client can change without asking you first, because that is the line the rest of this rests on.

No plan page in the Sources list states this one, so the agreement is where it gets settled.
05 Problems that were there before the plan

Reviewed before the plan starts, and repairs quoted as one-off work.
A site you did not build arrives with its own history, and a plan that starts without looking at it quietly takes on every shortcut somebody else left behind. The review is also the moment to separate keeping a site working from repairing one, which is a distinction the first invoice is a bad place to make.
- JD Stride "We conduct an initial health check and address any pre-existing issues before bringing the site under our care."
- Neil Patmore "The appropriate plan and any initial repair work are confirmed after the website review."
06 Unused time

Where it goes: nowhere, forward a month, or the full year up front.
This only bites where the plan includes time for changes. That time has already been paid for, so silence about it is a question waiting to be asked, and the plan pages below each put it somewhere different.
- Technology Matters Its included time "Does not rollover to the next month".
- Authentic Web Solutions No rollover on month-to-month contracts, and annual plans get "the full year’s support time upfront".
- JD Stride Lists "Unused hours roll forward" on its top WordPress tier only.

What goes in the agreement beside the sheet

The sheet is the scope section of the agreement. A list of line items cannot say how work is asked for, whose name the domain is in, or who calls the host when it goes down.

Change requests. How a client asks for work, what counts as a change rather than a project, and that anything outside the plan is estimated before it starts.
Ownership and access. Who owns and pays for the domain, DNS, hosting and licenses, and whose account each one sits in. The sheet says where hosting and licenses are billed. This says who loses the site if a card expires.
Third parties. The host, the payment provider and the other services you watch but do not control, named. The sheet says an outage there is reported and not repaired. This says who raises it with them, and what you do for the client meanwhile.

Two halves of a maintenance report

The half a tool fills

What the checks found over the period, set against the period before. Without that comparison a reading is a number with nothing to measure it against. A client report can carry this half on its own.

The half only you can write

Updates applied, backups taken, scans run and problems fixed, in words the client understands rather than a list of plugin versions. In a quiet month the checks find nothing, and this is the only thing in the report that shows the month had work in it.

SiteLetter covers the monitoring half of that report, and only that half: it checks and reports, and it does not update, back up, scan for malware, test forms or fix anything. Uptime checks your homepage every minute, from the EU. Visual Changes checks every monitored page once a day. The results arrive as a branded report, ready to forward with your own log of updates and fixes, or to go to the client from your own domain once you have verified it. How it sits next to your maintenance tool is on the website care plan page.

Acme Agency

Weekly Report

acme-client.com · 12 pages · 2026-09-21 - 2026-09-27

Page Scores

Performance

Accessibility

Best Practices

SEO

Uptime

99.94% ↑ +0.03%

Visual Changes

Checked 12 pages - 2 meaningful changes

/pricing Possibly broken

Hero image area is blank - broken image placeholder visible.

/ Content update

Hero copy rewritten and a new testimonial card added.

A sample weekly report, branded with the agency name and color. With a verified sending domain, the From address is the agency's too.

Sources

Each entry opens on the words it rests on, quoted exactly as the page printed them in September 2026. Plans change, so treat anything here as needing a re-read after three months.

JD Stride - website care plans jdstride.com.au

As read: "Daily backups (30-day retention); Unused hours roll forward; We conduct an initial health check and address any pre-existing issues before bringing the site under our care."

(Australia. The backup line is a row in the WooCommerce plan table. Unused hours roll forward is a row in the WordPress plan table, filled in on the top Growth tier only and marked with a dash on the other two)

Open the page
Feeling Peaky - WordPress support and maintenance feelingpeaky.com

As read: "Prime care; Website backups monthly; Growth care; Daily website backups"

(UK. Prime care is the first plan in the pricing table and Growth care the next one up)

Open the page
Pulsar - contrat de maintenance web pulsar-agency.com In French

As read: "Pack Essentiel; Sauvegardes externalisées quotidiennes du site (rétention sur 6 mois); Maintenance préventive (mises à jour CMS et extensions chaque trimestre); PACK Pro; Maintenance préventive (mises à jour au minimum mensuelle du CMS et extensions)"

(France. In English: daily off-site backups kept for 6 months, and preventive updates to the CMS and extensions every quarter on Essentiel, at least monthly on Pro)

Open the page
Technology Matters - WordPress care plans technologymatters.com.au

As read: "Maintain; Regular WordPress CMS & Extension Updates (not including eCommerce software); Manage; Regular WordPress CMS, Extension and eCommerce Updates; Does not rollover to the next month"

(Australia. Maintain is the entry plan and Manage the next one up. The rollover line is the tooltip beside the included-time line on Manage and on Master)

Open the page
seowizard.ie - website maintenance seowizard.ie

As read: "STANDARD CARE; Response time: up to 24 hours; Malware scanning and cleanup if needed; PREMIUM CARE; Response time: up to 24 hours; eCOMMERCE; Response time: up to 12 hours; Order flow checks and checkout troubleshooting"

(Ireland. The three plans in the order the page prints them)

Open the page
Neil Patmore - WordPress care plans neilpatmore.co.uk

As read: "Hosting is separate unless it is specifically agreed as part of your arrangement.; The appropriate plan and any initial repair work are confirmed after the website review."

(UK)

Open the page
Inspirable - WordPress care plans inspirable.com

As read: "Hosting included, or keep your own host at the same price."

(US)

Open the page
The Admin Bar - what is a website care plan and what's included? theadminbar.com

As read: "my personal experience from running an agency since 2017; hours of research I did visiting over 100 agency websites; A few services I (personally) would not include; Search Engine Optimization.; Accessibility.; Email.; Policies.; Including SEO services also increases the client canceling their care plan (which is essential for the site’s health) when their rankings or traffic aren’t meeting their expectations; not understanding those are two different functions; offer policies (like Privacy Policies, Terms of Service, and even cookie consent solutions)"

(An article by Kyle Van Deusen dated March 13, 2025. The four services are the bold lead-ins of the list under that heading; the SEO fragments come from its first item, where the page separates them with an em dash, and the policies fragment from the Policies item)

Open the page
Fix My Site - plans fixmysite.com

As read: "Maintenance Plan; Security Plan; Malware Removal"

(Malware Removal is listed on the Security Plan card and in the Security column of the comparison table, not under the Maintenance Plan. The site geo-redirects, so from outside the US it may serve a regional version of this page)

Open the page
Authentic Web Solutions - website maintenance packages authenticwebsolutions.com

As read: "Support time does not roll over for month-to-month contracts. However, annual plans provide the full year’s support time upfront, allowing you to use it anytime within the 12-month period."

(US. The answer to the page FAQ about unused support time)

Open the page

Next guide

How much to charge for website maintenance

Prices quoted from 67 providers' own pricing pages in 5 markets, tier breakdowns, and a revenue calculator.

Put a white-label report behind your care plan

Start free with 14 days of full monitoring on your first site.

Start free See how it powers your care plan