WordPress Care Plans: What to Include and What to Charge

Almost every web studio sells maintenance. In the 2025 Admin Bar survey of WordPress professionals, 93% said they do, yet about 55% earn less than $2,500 a month in recurring revenue. The gap is usually packaging, not demand: vague plans, no proof of work, and invoices someone has to remember to send.

This guide covers what to put in WordPress care plans, how to tier them, what to charge, and how to show clients the value every month. It is about WordPress specifically, so the examples use WordPress tools and terms.

What Should WordPress Care Plans Include?

A good care plan has seven parts. Each one is something you can do, measure, and show in a report.

1. Updates. WordPress core, plugins, and themes, applied on a schedule (weekly is common), ideally tested on staging first for anything that touches checkout or forms.
2. Backups. Daily for active sites, with a restore you have actually tested. A backup nobody has restored is a hope, not a backup.
3. Security and vulnerability monitoring. Watch for known vulnerabilities in the plugins the site runs, remove abandoned plugins, and review admin users.
4. Uptime monitoring. An alert when the site goes down, plus a record of how long it was down.
5. SSL and domain expiry. An expired certificate or domain takes a site off the internet just as surely as a hack does. Watch both.
6. Speed checks. A monthly look at load time and Core Web Vitals, with a fix list when something slips.
7. Support time. A set number of small changes per month (a text edit, a new staff photo, a form tweak) so "can you just..." has a home.

Then put the boundaries in writing: what counts as support time, how fast you respond, and what is billed separately (redesigns, new features, malware cleanup on a site you did not look after before). The same goes for the contract. If you need wording, start with the web design contract template.

A care plan is a promise with edges. Write down what is inside it, what is outside it, and how the client sees it working.

Why Security Monitoring Is the Selling Point

Plugins are where the risk lives. Patchstack counted 11,334 new vulnerabilities across the WordPress ecosystem in 2025, and 91% of them were in plugins. It also reported that 46% had no developer fix at the time of public disclosure.

That second number matters for how you word the plan. You cannot promise "we update everything the day a fix ships," because sometimes no fix exists. Promise what you control: you watch for known vulnerabilities, you act when a patch or a mitigation exists, and you tell the client what you did.

WordPress Maintenance Plans: Three Example Tiers

Three tiers is the common structure for a reason. It gives a client a cheap way in, a sensible middle, and a premium for sites where downtime costs real money.

The prices below are examples to start from, not a market rate. Published prices from care plan vendors range widely (from around $30 to $500 or more a month for similar-sounding plans), so price against the risk of the site and the time you spend, not against a blog post.

A few notes on using it:

• Charge for risk, not hours. A store that takes orders at 2 a.m. needs more than a brochure site, even if the monthly work is similar.
• Keep support time small and visible. Unused hours do not roll over. Say so up front.
• Make the middle tier the obvious pick. Most clients choose it when the cheap tier is clearly missing something they care about, like tested restores or support time.
• Do the math on your own time. If a Standard plan at $250 takes 90 minutes a month and you value your time at $95 an hour (the median in the Admin Bar survey), you keep about $107 a month per client. Ten of those is real recurring revenue. If you are still working out project pricing too, see how much to charge for a website.

How to Sell Website Care Plans

Clients rarely wake up wanting maintenance. They want to not get a call from a customer saying the site is broken. Sell that.

1. Offer it in the proposal. Put the care plan in as a line item on every new site proposal, not as an afterthought at launch. The web design proposal template shows where it fits.
2. Make it the default. "Hosting and care plan, billed monthly" as the standard, with opt-out requiring a conversation, converts better than an optional add-on.
3. Name the cost of not having one. One real incident from your own work (a plugin conflict, an expired certificate) beats any statistic.
4. Offer existing sites a free first check. Run your monitoring against their site, show what you find, and quote the plan from the findings.

How to Prove the Value Every Month

Clients cancel what they cannot see. If the only time you contact them is when something breaks, the plan looks like an expense. A monthly report fixes this by making invisible work visible.

A useful report is one page and answers four questions:

• Was the site up, and for how much of the month?
• What did you update, and what did you find?
• Is the site fast, and did anything change?
• What did the support time cover?

Send it on the same day every month, without being asked. For a closer look at turning that into something clients log in to see, read about client portal software.

Billing WordPress Care Plans on Autopay

Care plans only work as recurring revenue if the money arrives without you. Set the plan up as a recurring invoice on the first of the month, have the client save a card, and let autopay charge it. Chasing 12 clients for 12 small invoices every month costs more time than the plans earn.

Two habits help. Bill in advance, not in arrears. And bill annually if the client prefers, at a small discount, which improves your cash flow and gives the client one renewal decision a year instead of twelve.

Do Care Plans Work for Sites Built on Other Platforms?

Yes. The approach is the same on any platform: monitor the site, keep the software current, back it up, report on it, and bill monthly. Only the update and security details change. A site on Webflow, Shopify, or a framework deployed to Vercel has no plugin stack to patch, but it still has uptime, SSL, domain expiry, speed, and a client who wants proof you are on it.

If you look after a mix of sites, price by risk and time as above and keep one report format for all of them.

StackOS does not run backups for you. Those still come from your host or a backup plugin, and the report should say so honestly.

Frequently Asked Questions