Website care plans
A website is software. Left unpatched for a year it becomes one of the easier ways into a small business, and the first anyone usually knows is when Google flags the site as compromised.
The short answer
A website care plan covers hosting, software and plugin updates, monitored off-site backups, uptime and SSL monitoring, security hardening and a small allowance of content changes each month, for a fixed fee. It exists because the most common cause of a hacked small business site is not a sophisticated attack — it is a known vulnerability that had a patch available for months.
What a plan covers
- Managed hosting, or management of the hosting you already have
- Core, theme and plugin updates applied and checked, not applied and hoped
- Monitored off-site backups with periodic test restores
- Uptime monitoring, with someone actually notified when it fails
- SSL certificate renewal before it expires rather than after
- Security hardening and malware scanning
- A monthly allowance for small content and image changes
- A short monthly note on what was updated and anything worth knowing
What we find on unmanaged sites
- Plugins two or three major versions behind, with published vulnerabilities
- A backup that has not run since the hosting account was migrated
- An SSL certificate that expired and nobody noticed for a week
- Admin accounts for staff and contractors who left years ago
- A contact form that stopped sending in March
- Hosting on a shared plan alongside sites that are already compromised
A job like this
A Gold Coast agency’s site started redirecting mobile visitors to a gambling page. The entry point was a form plugin with a vulnerability patched fourteen months earlier. Cleaning it took two days, plus a week of Google flagging the domain as unsafe. A care plan costing a fraction of that would have applied the patch the week it shipped.
How a plan starts
01
Take stock
What the site runs on, what is out of date, who has access, and whether the backup has ever actually been restored.
02
Fix and harden
Bring everything current in a staging copy first, remove dormant accounts and plugins, then apply to the live site.
03
Set up monitoring
Uptime, SSL and backup monitoring pointed at somebody who will act on the alert.
04
Keep it boring
Monthly updates, tested restores, a short written note. The measure of success is that nothing happens.
Questions about care plans
Do we have to have built the site with you?
No. Most care plan sites were built by someone else. We audit first so you know what state it is actually in before committing to anything ongoing.
What if an update breaks the site?
That is why updates go onto a staging copy first and why the backup is tested. If something does break on the live site, restoring is minutes rather than a crisis.
Does the plan include new pages?
Small changes and content edits, yes. A new section or a redesign is quoted separately — bundling those into a monthly fee is how care plans quietly become expensive.
Can you host it, or do we keep our current host?
Either. If your current hosting is decent we will manage it in place. If it is a shared plan with poor isolation we will say so and quote the move.
Related: web design · website redesign · cyber security
Not sure what your site is running? The audit takes an afternoon.
Get a care plan quote