What does a website care plan cover?

A website care plan keeps a live site updated, backed up, secure, fast and working, and covers small changes so you do not need a new project for each one. A good plan lists what is included, how quickly problems are handled, and what is reported to you.

Why does a website need ongoing care?

A website is not a printed brochure. Software underneath it changes: the CMS, plugins, libraries, the server, the browser your visitors use. Each one releases updates, many of them security fixes. If nobody applies them, risks pile up. Forms stop sending, payment pages break, certificates expire, and attackers find known weaknesses.

Content ages too. Staff change, prices change, opening hours change. A site that still shows last year's offer costs you trust.

What should a care plan include?

These are the items worth looking for.

Updates. The CMS, themes, plugins and dependencies kept current, tested on a staging copy first where the site matters to the business.

Backups. Automatic copies of files and database, stored away from the main server, with a restore actually tested from time to time.

Security. Monitoring for malware and suspicious logins, security headers and firewall settings, strong passwords and two-step sign-in for admin accounts, and a plan for responding to an incident.

Uptime monitoring. An alert when the site goes down, and someone who acts on it.

Speed and health checks. Regular checks on Core Web Vitals, broken links, forms, SSL certificates and domain expiry. Our note on passing Core Web Vitals explains the numbers.

Small changes. A set allowance for text edits, new images, new pages and minor design adjustments.

Reporting. A short monthly note on what was updated, what was found and what is recommended.

What is usually not included?

Be clear about the limits. New features, a redesign, a new store, or rebuilding a section are separate projects. So are paid advertising and ongoing content writing, unless the plan says so. Hosting and domain renewals may be included or billed separately. Third-party licences, such as premium plugins, often belong to you.

Ask for a plain list of what is in and what is out.

What response times should you expect?

Ask how fast problems are acknowledged and fixed, and how you report them. A good plan names a response window for urgent issues like a site that is down or a checkout that fails, and a longer one for routine requests. It also says who responds, and through which channel. Many businesses in India and the Gulf prefer WhatsApp or a shared inbox, and that should be agreed in advance.

What does it cost to ignore maintenance?

Unmaintained sites tend to get hacked, slow down, or break when the host upgrades a server version. Recovering from an incident usually costs more, in money and lost trade, than steady care. For an online store, a broken checkout loses sales for every hour it stays unnoticed.

There is a legal side too. If your site collects personal data through forms, you are responsible for it under the Digital Personal Data Protection Act, 2023. Keeping software patched, restricting admin access and removing old data are part of treating that responsibly.

How often should things be checked?

Different items need different rhythms. Uptime is watched all the time. Backups run daily or weekly depending on how often content changes. Updates are usually applied monthly, with urgent security patches applied sooner. Speed, broken links and form tests suit a monthly check, and an annual review is a good time to ask whether the site still matches the business. Ask any provider to show you their calendar, not just a list of promises.

How do you compare care plans fairly?

Put the offers side by side and ask the same questions of each.

• What exactly is updated, and how often?
• Where are backups stored, and when was a restore last tested?
• How is the site monitored, and who gets the alert?
• What counts as a small change, and what is the monthly allowance?
• What is the response time for urgent issues?
• What do I receive each month?
• Who owns the accounts, code and content if I leave?
• Is there a minimum term, and how do I end it?

Watch out for plans that describe themselves in general terms but name nothing specific. Also be careful with plans where the agency holds the only copy of your logins.

Who should look after your site?

The team that built it knows it best, which is a strong reason to keep them, provided they are responsive. An in-house person is useful if you have enough work for them. A separate maintenance provider can work if the original builder has disappeared. In every case, the accounts, code and backups should be in your name.

How do you know if your site needs attention now?

Look for these signs: a slow site, forms that sometimes fail, an expired or warning-flagged certificate, updates pending for months, a hosting email saying your PHP version is ending support, or a site nobody has logged in to for a year. A Digital Health Check gives a quick written picture of speed, security headers, SEO basics, email setup and data protection basics. Fixes can follow in whatever order you choose.

We describe our own plans under website care and AMC and the wider Web Design & Development pillar. This is the kind of work we do for sites we built and sites we did not. To talk about yours, Let's Talk.