WordPress Care Plans: How to Package, Price and Sell Them

Building a website is a project. Looking after it is a relationship, and it is the part that pays the bills in a quiet month. WordPress care plans turn a one-off job into steady recurring income, and they give your client something they probably did not know they needed: someone whose job it is to notice when things go wrong.

This guide is for agencies and freelancers who already build WordPress sites and want to offer care plans properly, or fix the ones they offered half-heartedly. We will cover what to put in, how to tier it, how to think about price, how to onboard a site, and what happens when an incident hits. No made-up market statistics, just a framework you can adapt.

What a WordPress Care Plan Actually Includes

Strip away the marketing names ("Guardian", "Platinum Shield") and almost every care plan is a bundle of the same six jobs.

Updates

WordPress core, plugins and themes get updates all the time, and old ones are a leading way sites get hacked. The plan covers applying them on a regular schedule, ideally testing the risky ones on a staging copy first. WordPress applies minor and security releases of core in the background on most hosts, but major releases, plugins and themes still need someone to press the button, as the official Updating WordPress docs explain. If you want to understand why this matters so much, our article on WordPress plugin vulnerabilities explains it.

Backups

Untested backups are the classic false comfort. Include taking them, keeping them somewhere safe and, importantly, being able to restore. Our backup strategy guide goes through what to keep and how often.

Security

This means keeping the sign-in area protected, watching for malware and file changes, and acting on warnings. It is the part clients value most once they understand it.

Uptime Monitoring

Someone should know the site is down before the client's customers do. A simple uptime monitor that pings the site and alerts you is cheap and makes you look very switched on.

Small Edits

Change a phone number, swap a photo, fix a typo, add a new team member. Most clients send a stream of tiny requests, and they feel better knowing there is an allowance for them.

Reporting

A short monthly note saying what was done: "Applied the month's updates, took a fresh backup, blocked repeated sign-in attempts, and the site was up the whole month." It proves the plan is working during the months when nothing visibly happens.

Pro tip: When you do the job well, nothing happens. Reporting is how invisible work becomes visible, so never skip the monthly note.

How to Package Care Plans Into Tiers

You can offer one plan, but tiers help clients choose and give you a natural upgrade path. Three tiers is the usual sweet spot, and each should be defined by clear differences, not vague adjectives.

The names and numbers are examples, not a recommendation. What matters:

• Differences are things you can count or promise. "More edits" and "faster response" are easy to explain and easy to deliver.
• The middle plan is the one you want. Design it so most clients choose it. The cheaper plan makes it look reasonable, and the top plan makes it look sensible.
• Do not promise what you cannot staff. A "within an hour" response is a real commitment, so price it as one.
• Keep it simple enough to remember. If you need a spreadsheet to explain the plans, you have too many.

Be precise about what is excluded too. Redesigns, new features and big content jobs are projects, not care. Say that in the agreement, kindly, and offer a standard hourly rate for work outside the plan.

Pricing Thinking for WordPress Care Plans

There is no universal right price, and anyone quoting you a "market average" is guessing. Price from your own numbers instead. Here is a way to think about it.

1. Count the time. For a typical site, how many minutes a month do updates, checks, reporting and a few edits genuinely take? Be honest, and include the time you spend switching between sites.
2. Add the tools. Security, backup, uptime and reporting tools cost money per site. Spread that cost across the sites you manage.
3. Add the risk. If a plugin update breaks a client's checkout on a Friday night, who deals with it? That on-call risk deserves a fee, even if it only happens once a year.
4. Decide your hourly worth. If you value your time at a certain amount, the plan should pay at least that after all of the above.
5. Add a margin. You are running a business. A plan that just about covers your time leaves no room for the month everything goes wrong.

Then sanity-check against the value to the client. A site that brings in leads or sales has a clear cost when it is down or hacked. You are not selling updates; you are protecting something that earns money.

A few pricing habits that tend to age well:

• Bill upfront and recurring. Monthly or yearly by card, not by invoice chasing.
• Offer a yearly option. Clients who pay for the year are easier to retain, and you get cash earlier.
• Review annually. Prices that never change quietly erode as your costs and the client's site grow.
• Do not discount into trouble. A cheap plan that eats your evenings is a bad deal for both sides.

What Clients Actually Value

Here is the awkward truth. Most clients do not care about core updates, PHP versions or file integrity checks. They care about outcomes.

• "My site is up." Nobody wants to find out from a customer that the website is down.
• "I am not going to get hacked." Or, if I do, someone will fix it quickly and I will not be blamed. (When a client asks you "is WordPress secure?", our plain-English answer is a good link to send.)
• "I know who to call." A named human who answers beats a ticket system with a clever name.
• "I can see you are doing something." Reports and short check-in messages matter more than you think.
• "I am not going to be surprised by a bill." Clear scope, clear price and no panic invoices.

Write your plan descriptions in that language. "Weekly updates tested on a copy of your site before we touch the live one" is clearer to a business owner than "Staging-first update management". Lead with what the client gets, then list what you do.

Onboarding a Client Site Properly

The first week sets the tone. A tidy onboarding also prevents the classic mistake of taking over a site and then being blamed for problems that were already there.

1. Get access, then document it. (Our WordPress website handover checklist has the full list for taking a site over.) Admin login, hosting, domain registrar, DNS and any third-party services. Store credentials in a proper password manager, never in email threads.
2. Take a full backup before touching anything. And confirm you can restore it. This is your starting point and your safety net.
3. Audit what is there. List the plugins and themes, which are outdated, which are unused and which look abandoned. Note the PHP version and whether the site is on HTTPS (if not, force HTTPS in WordPress before anything else). Our hardening checklist and our WordPress security audit are useful templates.
4. Fix the obvious. Remove unused plugins, apply pending updates, set up two-factor for administrators and clean out stale admin accounts.
5. Record the baseline. Screenshots of key pages, a note of what works (forms, checkout, bookings) and a security score. When a client says "it was fine last month", you have proof of what "fine" looked like.
6. Set up monitoring and alerts. Decide who receives them. You, the client or both.
7. Send a welcome message. Explain what you are doing, what to expect each month and how to reach you. Keep it short and friendly.

If the audit turns up serious problems, such as outdated plugins with known flaws or signs of an earlier hack, tell the client plainly and quote the clean-up separately. It is much easier to have that conversation on day one than after something breaks.

Handling an Incident Inside a Plan

Sooner or later a site you look after will be hit, whether by malware, a hijacked admin account or a bad update. The worst time to decide what your plan covers is while it is happening.

Decide in advance, and write it down:

• What is included (for example, restoring from a backup and a basic clean-up) and what is billed separately (deep investigation, repeated incidents caused by ignored advice).
• How fast you respond at each tier.
• Who the client contacts out of hours, if anyone.
• What you need from the client, such as access to hosting and approval to restore.

When it happens, a calm sequence helps:

1. Contain. Put the site in maintenance mode if needed, change passwords and sign out all users.
2. Assess. Run a malware scan, check recently changed files and review user accounts.
3. Restore or clean. If a recent clean backup exists, a restore is often faster and safer than hunting through files (see how to restore WordPress from backup). Our guide to recovering a hacked WordPress site walks through it.
4. Close the hole. Find how they got in (usually an outdated plugin or a weak password) and fix that, or the problem returns.
5. Tell the client. Plainly, quickly and without drama: what happened, what you did and what changed to prevent it.

Handled well, an incident is the moment a client decides never to leave you. They saw the plan work.

Recurring Revenue Without the Burnout

The business case for WordPress care plans is simple. A project pays once. A care plan pays every month for as long as the client stays, and clients who are well looked after tend to stay and to send you their friends.

To keep it healthy:

• Standardise. The more your sites share a toolset and a process, the less each one costs you in time. Our guide to how to manage multiple WordPress sites goes into the detail.
• Automate the boring parts. Scheduled scans, alerts and digests should arrive without you opening each site.
• Count your cost per site honestly. If a client takes triple the time of the others, they are on the wrong plan.
• Set a sensible limit. There is a number of sites you can look after well, and it is better to know it before you pass it.
• Make the sale part of every project. Offer the care plan with the launch quote, not as an afterthought three months later.

Where Stack Guard Fits for Agencies

Security is the part of your WordPress care plans where the right tool saves the most time (our guide to choosing the best WordPress security plugin covers what to look for), and the part where the cost per site matters most. Stack Guard's Agency plans are priced per year by number of sites:

That per-site figure is a plain division, so it is easy to put straight into your cost sheet from the pricing thinking above. The full list of plans, including Free and Pro, is on the pricing page, and a 14-day money-back guarantee applies to a first purchase.

On Agency plans, white label puts your plugin name, company, website and logo on every email Stack Guard sends, so clients receive alerts and digests from your service, not ours. It is a small thing that makes the plan feel like yours.

Two more agency features are coming soon: client-ready security reports and a branded sign-in page. They are not available yet, so do not promise them to clients today. Until the reports arrive, you can keep writing your own monthly note using the activity log and scan results.

For a deeper look at running security across many sites, read our WordPress security guide for agencies, or see the agency overview for how the plugin fits an agency workflow.

A Short Checklist Before You Launch Your WordPress Care Plans

• Pick three tiers with differences you can count.
• Work out your real cost per site and your price from it.
• Write the scope, exclusions and incident terms down in plain language.
• Prepare an onboarding checklist you reuse every time.
• Set up monitoring, backups and security tooling you can run across all sites.
• Decide what your monthly note will say.
• Offer the plan with every new project quote.

Start your WordPress care plans with two or three friendly clients, learn what takes longer than you thought, and adjust before you open the doors wider.