WordPress Care Plan Checklist for Agencies (2026)

Short answer: a WordPress care plan (also called a maintenance plan) is a monthly service where an agency keeps a client's site updated, backed up, secure and online, answers their support requests, and sends a report showing what was done. The plans that keep clients are the ones that make the work visible: a care plan nobody sees is a care plan that gets cancelled.

The care plan checklist

Updates

• WordPress core, plugins and themes updated on a schedule (weekly is common).
• Each update made safely: a backup first, a visual check after, and a rollback if something breaks.
• Updates for known security vulnerabilities applied the same day, not on the next scheduled run.
• Premium plugins and themes included, not just those from WordPress.org.

Backups

• Daily backups, with a copy stored off the server (cloud storage).
• Several restore points kept (at least the last 7).
• Hourly database backups for online stores, where an hour of orders matters.
• A tested way to restore, including a site so broken that WordPress will not load.

Security

• Vulnerability monitoring for core, plugins and themes, with alerts.
• Login protection: addresses locked out after repeated failed logins.
• Two-factor authentication for administrators, and a regular review of who has admin access.
• File scans that flag changed core or plugin files and anything suspicious in uploads.
• Basic hardening, such as turning off the theme and plugin file editor.

Uptime and performance

• Uptime checks every few minutes, with alerts to the agency (email, Slack) before the client notices.
• SSL certificate expiry monitoring.
• Regular page speed and Core Web Vitals checks for desktop and mobile.

Support

• A clear way for clients to ask for help: email that turns into a ticket, not a personal inbox.
• A monthly allowance of support or development time, tracked per client.
• Response times written down, so expectations match.

Reporting

• A monthly report sent automatically, under the agency's brand.
• What it should show: updates made, vulnerabilities fixed, backups taken, uptime, performance, support time used and, where useful, traffic and search data.
• Written for the client, not the developer: "26 security updates completed, 99.98% uptime" says more than a log file.

Three example tiers

	Essential	Business	Commerce
Updates	Weekly, safe updates	Weekly, safe updates	Weekly, safe updates, plus same-day security fixes
Backups	Daily, 7 kept	Daily, 30 kept	Daily, 30 kept, plus hourly database
Security	Vulnerability alerts	Plus login protection and file scans	Plus admin 2FA and hardening
Uptime	Monitoring	Monitoring	Monitoring, faster checks
Support time	None or pay as you go	1 hour a month	3 hours a month
Report	Monthly	Monthly, with analytics	Monthly, with analytics and search data

Price each tier on the time it saves the client and the risk it removes, not on your hourly rate. A store losing a day of sales to a hacked plugin values same-day patching far more than a brochure site does.

How to prove the work every month

Clients do not see updates, backups or blocked attacks. Unless you show them, the care plan looks like a bill for nothing. Three habits fix that:

1. Send the report automatically on the same day each month, so it never depends on someone remembering.
2. Lead with outcomes: problems prevented, time saved, uptime kept. Keep the technical detail below.
3. Include the support time used against the allowance, so the client sees the value of hours they did not have to think about.

Running care plans for many clients

The checklist above is easy for three sites and hard for fifty. Agencies running care plans at scale use one dashboard for all of it: updates, backups, security, uptime, support tickets, time tracking and white-label client reports. That is what Glow is built for. See a sample care plan report.

Frequently asked questions

What is the difference between a care plan and a maintenance plan?

Usually nothing: both describe a monthly service that keeps a WordPress site updated, backed up and secure. "Care plan" tends to include support time and reporting, while "maintenance plan" sometimes means updates and backups only.

How often should WordPress be updated?

Weekly is a good routine for most sites, with security fixes applied as soon as they are released. Every update should start with a backup.

Should backups be stored on the same server?

Not only there. A backup on the same server disappears with the server. Keep at least one copy in separate cloud storage.

What should a WordPress maintenance report include?

Updates made, security issues fixed, backups taken, uptime, site speed, support time used and, if the client cares about it, traffic and search performance. Send it monthly, under your brand.

Do clients actually read maintenance reports?

They read short ones. A one-page summary with a few clear numbers at the top gets read; a twelve-page log does not.

Start free with Glow: free for your first site, no credit card.