Quick answer: A WordPress care plan is an ongoing service that keeps your site updated, backed up, secure and monitored, with support when something breaks. In the UK it typically costs £20 to £100+ a month - budget plans are mostly automated, better plans test updates first and include real support. The big decision isn't the price; it's whether the care sits on top of hosting someone else runs, or whether one team handles both.
In this guide:
- What a care plan actually includes - proactive upkeep versus reactive fixes.
- What care plans cost in the UK in 2026, and why the range is so wide.
- Care plan versus managed hosting, and how to choose a provider.
Written for UK business owners, marketers and founders who have a WordPress site to look after and are weighing up a care or maintenance plan.
Most WordPress advice is about building a site. Almost none is about what happens to it afterwards - the updates, the backups, the security patches and the moment a routine plugin update quietly takes your checkout down at 5pm on a Friday.
That ongoing upkeep is what a care plan buys. But the market is genuinely confusing: the same service goes by several different names, prices range from £20 to several hundred a month for what looks like the same thing and hardly anyone explains where a care plan ends and hosting begins. This guide clears that up - what's included, what it should cost and how we think about it as a software consultancy that hosts and maintains WordPress sites ourselves.
What a WordPress care plan actually is
A WordPress care plan is an ongoing service that keeps a live site updated, backed up, secure and working - and gives you someone to call when it isn't. It's the difference between a site that's built once and left to rot, and one that's looked after so it keeps earning its keep.
The first source of confusion is the name. "Care plan", "maintenance plan", "maintenance package", "support and maintenance" and "support plan" all describe the same thing. Google treats them as one topic, and so should you - the label is just branding.
| You'll see it called | What it implies | What it actually is |
|---|---|---|
| Care plan | A proactive, ongoing partnership | The same service: keeping your WordPress site updated, backed up, secure, monitored and supported |
| Maintenance plan | Routine, scheduled upkeep | |
| Maintenance package | A fixed monthly bundle of tasks | |
| Support and maintenance | Upkeep plus a help desk | |
| Support plan | Priority access to developer time |
So don't get hung up on the wording. The only thing that matters is the scope: exactly what's covered each month, and what counts as an extra. That's where cheap and serious plans really differ, and it's what the rest of this guide unpacks.
What's included: proactive vs reactive
Every care plan splits into two kinds of work: proactive (scheduled tasks that prevent problems) and reactive (fixing things when they go wrong). Understanding the split is the single most useful thing you can know as a buyer, because the cheapest plans quietly load the cost onto the reactive side.
| Type | What it covers | Examples |
|---|---|---|
| Proactive (scheduled) | Planned upkeep that stops problems happening | Core, plugin and theme updates (tested first), backups, security scanning, uptime and performance monitoring, SSL (HTTPS) certificate renewal |
| Reactive (incident) | Putting things right when they go wrong | Repairing a broken update, malware cleanup, downtime recovery, emergency support |
Where cheap plans hide the cost. Proactive and reactive work look alike on a feature list, but they're priced very differently. The budget trick is to include the cheap proactive tasks and quietly bill the expensive reactive ones - so the broken update that testing would have prevented arrives as a repair invoice. Always check which side of that line a fix falls on.
Why does the upkeep matter so much? Because WordPress runs a huge share of the web, and its weak point is well documented: the plugins.
The pattern behind almost every hacked WordPress site is the same: a known vulnerability in a plugin that simply wasn't updated. Security firms Sucuri and Wordfence both report that most compromises exploit old, unpatched components rather than clever zero-day attacks. Proactive maintenance is what closes that gap - which is exactly why it's the part a care plan should never skimp on.
What good, better and premium look like
Not all care plans include the same depth. Here's roughly how the tiers stack up, so you know what you're comparing:
| Inclusion | Basic | Good | Premium |
|---|---|---|---|
| Updates | Automated | Tested on staging | Staging-tested with rollback |
| Update cadence | Monthly, automated | Fortnightly, tested | Weekly (daily for stores) |
| Backups | Weekly | Daily | Daily, off-site, tested restores |
| Security | Basic scan | Scan plus malware removal | 24/7 monitoring, firewall, hardening |
| Support | A few minutes of fixes | Monthly dev time | Priority response with an SLA (a guaranteed response time) |
| Hosting | Not included | Sometimes | Often bundled (managed hosting) |
What's not included - and why it matters
The quickest way to judge a care plan is to ask what it doesn't cover. Every plan draws a line between routine upkeep and project work - and the cheaper ones keep that line deliberately blurry, so the job you assumed was included arrives later as a quote. Here's where a credible UK plan usually draws it.
| Usually included in a care plan | Usually a separate project (not included) |
|---|---|
| Core, plugin and theme updates, tested | A redesign, rebuild or a brand-new theme |
| Backups and tested restores | New features, custom development or integrations |
| Security scanning and monitoring | Cleaning up a site that has already been hacked |
| Uptime and performance monitoring | Content written, designed or published for you |
| Small content tweaks (text and images) | SEO campaigns, ads and marketing |
| A set amount of support or developer time | Hosting, if the plan is maintenance-only |
None of this is a provider being awkward. A care plan is priced for predictable, recurring upkeep - a known amount of work every month.
Open-ended jobs like a redesign, a new booking system or recovering from a breach are unpredictable by nature, so they're scoped and priced on their own. The issue is never that these things cost extra; it's a plan that won't tell you which side of the line they fall on until the invoice lands.
Two exclusions catch people out most often. Emergency hack recovery: many plans monitor and scan, but cleaning up an active compromise is billed as reactive work unless the plan says otherwise in writing.
The other is "unlimited edits", which almost always means small tweaks only - text and images, with new pages, features or design charged on top. Ask for that line in writing up front, before anything breaks.
How we handle it. We tell you what's in the plan and what counts as a project before you buy, in writing. Staging-tested updates, backups, security and support are the monthly job; anything that changes what the site does is quoted separately - so there are no surprises on the invoice.
What WordPress care plans cost in the UK (2026)
Most UK care plans sit between £20 and £100+ a month, with e-commerce and premium cover running higher. The wide range isn't random - it maps almost exactly onto how much of the work is automated versus done and checked by a human.
| Band | Typical UK price | What you get | Examples |
|---|---|---|---|
| Budget | £20-£50/mo | Mostly automated updates and monitoring, a few minutes of fixes | The Smart Bear from £20 |
| Mid | £50-£100/mo | Daily backups, staging, malware removal, some monthly dev time | ThriveWP £49-£89, WPmaintain £79-£99 |
| Premium | £100+/mo | Managed hosting, 24/7 security, larger dev allowance, e-commerce cover | Toast SiteCare to £240, managed-hosting plans |
A few things are worth knowing before you compare quotes. Prices are usually quoted excluding VAT, so add 20% for the real figure.
WooCommerce (the WordPress e-commerce plugin) and membership sites cost more because there's more to break and more to secure. And the headline price often hides the important detail: a £20 plan and a £90 plan can both say "updates and backups", but only one tests those updates before they hit your live site.
What UK providers actually charge in 2026
To sanity-check a quote, it helps to see the whole market rather than one company's price list. Here's a snapshot of published UK care-plan pricing in 2026, entry tier to top tier (ex VAT):
| Provider (UK) | Published monthly price | Roughly what it buys |
|---|---|---|
| Rubber Duckers | £25 to £190 | Managed hosting only, up to full multi-site care |
| Pixelish | £40 to £90 | Backup frequency and support speed rise with the tier |
| ThriveWP | £49 to £89 | Fortnightly to weekly updates, a WooCommerce-ready tier |
| Little Nerd | £50 to £80 | Standard care; the top tier adds hosting and SSL |
| Solve | From £49 (+£49 e-commerce add-on) | Human-tested cover, full workflow testing higher up |
| feelingpeaky | £95 to £245 | Priority support and monitoring at the top tier |
| WPmaintain | £79 to £99 | Bundled UK hosting, one-click staging, weekly proof-of-care reports |
| Toast SiteCare | £60 to £240 | Daily backups, 24/7 monitoring and malware removal, monthly health reports |
Published prices as of July 2026, rounded; always check each provider for current figures.
Two things stand out. Most UK business sites land between roughly £25 and £250 a month; at the top of the market, dedicated-engineer plans (the global marketplace Codeable is a good yardstick) run from around £110 to £780+ a month.
Price mostly tracks how much human testing a plan involves, which is why how the work is done matters more than any feature grid.
What you'll pay by site type
| Site type | Typical UK care (ex VAT) | Why |
|---|---|---|
| Brochure or marketing site | £25-£75/mo | Few moving parts; mostly updates, backups and monitoring |
| Business site with forms and integrations | £75-£150/mo | More to test on each update - forms, bookings, CRM links |
| WooCommerce or online store | £150-£400/mo | Payments, stock and checkout need frequent, tested updates |
| High-traffic or business-critical | £400-£1k+/mo | Dedicated engineer time, tighter SLAs, high availability |
Care and hosting, one price. Our managed WordPress hosting builds the care into the hosting from £99 a month (ex VAT) - updates, backups, security and support, on UK infrastructure we run ourselves. One bill, one team, no separate maintenance retainer to stack on top.
Care plan vs managed hosting: do you need both?
This is the question almost no one answers clearly. A care plan maintains your site; hosting runs the server it lives on. Traditionally they're two separate things you buy from two separate suppliers - and that split is the source of a lot of pain.
Most care plans don't include hosting. So the typical setup is: you host with one company, then pay an agency a monthly retainer to maintain the site on top. It works, but it has a built-in flaw - when something breaks, you're often stuck in the middle.
The finger-pointing problem. When your host and your maintainer are different companies and the site goes down, each can blame the other: the host says it's a plugin, the maintainer says it's the server. You're the one chasing two suppliers while your site is offline. One team that owns both removes that gap entirely.
| Care plan on top of separate hosting | Managed hosting with care built in | |
|---|---|---|
| Hosting | Bought separately | Included |
| Updates and backups | Yes, from the maintainer | Yes, tested against the same infrastructure |
| When an update breaks the site | Host and maintainer can point fingers | One team owns the fix |
| Suppliers to chase | Two | One |
| Typical cost | Care £50-£90 + hosting £15-£30 | From £99, all in |
Look at that last row. A mid care plan plus separate managed hosting often lands at roughly the same monthly cost as managed hosting with care built in - but with two bills, two contracts and two companies to coordinate. For most businesses, bundling the two is simpler and no more expensive.
How safe updates actually work
Plenty of cheap plans, and most commodity hosts, "maintain" your site by auto-updating everything and hoping for the best. It's better than nothing, but it's not the same as care - and the difference shows up at the worst possible moment.
WordPress updates break sites more often than people expect. A plugin update changes how it hooks into another plugin; a theme update clashes with a customisation; a PHP change (PHP is the programming language WordPress runs on) deprecates something a plugin relied on.
On a site with a dozen plugins, that's a lot of moving parts. When an unattended auto-update goes wrong, it goes wrong live, in front of your customers, with no one watching.
The engineering answer is simple in principle: test first. A proper care plan applies updates to a staging copy of the site, checks the important pages still work - especially checkout on an e-commerce site - and only then pushes them live, with a backup ready to roll back if needed. That's the bit automation skips, and it's the bit that keeps a business-critical site up.
How an engineer ships a safe update
"Test on staging" is easy to say. In practice a careful update follows the same disciplined path a software team uses to ship code - because a WordPress site is exactly that: software.
- Stage a copy. Updates go onto a staging clone of the live site first, never straight to production.
- Update and check for conflicts. Plugins, theme and core are updated together and checked for the conflicts that break layouts or features - the classic "plugin A no longer talks to plugin B" failure.
- Run a visual-regression check. Before-and-after screenshots of the key pages catch the silent breakages - a shifted layout, a vanished button, a broken form - that a quick glance misses.
- Test what earns money. The checkout, the booking flow, the contact form: the paths that actually matter get clicked through by hand.
- Mind the PHP version. WordPress runs on PHP, and an out-of-date or mismatched version quietly breaks plugins. Keeping it current and compatible is part of the job.
- Deploy with a rollback ready. Only once it's checked does the update reach the live site - with a fresh backup so it can be rolled back in minutes if something slips through.
Automation does none of this. It updates and hopes. That's the gap between a maintenance plan and a coin toss - and it's the main reason plans with real engineer time cost more than ones without.
"Automatic updates" is not a maintenance plan. If the only thing standing between a bad plugin update and your live checkout is a host's automatic updater, you don't have a care plan - you have a coin toss. Ask any provider exactly how updates are tested before they reach your live site.
WooCommerce and business-critical care
If your site takes payments, care stops being optional. A WooCommerce store is a live application handling money, stock and customer data, usually with a stack of extensions for payments, shipping and marketing - every one a thing that can break or be exploited. That's why e-commerce care costs more, and why it needs a different rhythm.
The stakes are simply higher. On a brochure site a broken update is embarrassing; on a store it stops sales and can expose customer data.
A single failed plugin update on checkout can cost more in one lost afternoon than a year of care. So a serious e-commerce plan does more, more often:
What good WooCommerce care adds
- Checkout and payment testing after every update - a real test transaction through the payment gateway, checked end to end.
- A higher update cadence - stores run more plugins and change more often, so weekly testing becomes the norm.
- Stock, tax and shipping checks - the integrations that quietly drift when a plugin updates.
- More frequent backups - an order database changes by the minute, so daily or better, with tested restores.
- PCI-aware security - taking card payments carries a duty of care under PCI (the card-payment security standard), so hardening, monitoring and patching matter even more.
- Performance under load - caching that doesn't break the cart, sized for sale-day traffic.
As a rule of thumb, expect WooCommerce care to sit a tier above the equivalent brochure-site plan - typically £150 to £400 a month in the UK, more for high-volume stores. It's the clearest case of care paying for itself: the first time a tested update stops a broken checkout reaching customers, it's covered its cost.
How to choose a WordPress care plan
Once you know to look past the name and the headline price, choosing well comes down to scope, testing and exit terms. Here are the questions that separate a real care plan from a monthly invoice for very little.
Five questions to ask before you sign
- Exactly what's proactive (included) versus reactive (billed as an extra) each month?
- How are updates tested before they reach my live site - is there a staging copy and a rollback?
- If an update or a hack takes my site down, who fixes it and is that included?
- Where are backups stored, how often and have restores actually been tested?
- Do I keep my hosting, domain and accounts, and what are the exit terms?
Things that catch people out
None of these is automatically a deal-breaker - providers genuinely differ - but they're the details that catch people out, so it's worth clarifying each one up front.
- "Unlimited edits" - it usually means small content tweaks only (text and images), one at a time, with new pages, features and design work billed on top. Ask what actually counts as an edit.
- Staging - some providers test updates on a staging copy first, others push straight to your live site. Worth knowing which, especially for a busy or business-critical site.
- Support hours and response times - check when support is available, how quickly they aim to respond and whether that lines up with your working day.
- Contract length - some plans are rolling monthly, others tie you in for a year. Check the notice period and how you'd leave if you needed to.
- A vague scope - "we'll maintain your site" can mean a lot or very little. Look for a written list of what's included and some form of monthly reporting.
Clear red flags: no published pricing (or "contact us" for everything), no staging or update testing, no tested backups and "unlimited" anything with no written definition. Any one of those is a reason to ask harder questions before you commit.
DIY vs a care plan
You don't have to outsource everything. On a simple, low-stakes site, doing the basics yourself is a perfectly sensible starting point - and you'll understand your own site better for it.
You can handle
- Running updates on a quiet, simple site
- Taking backups with a reputable plugin
- Strong passwords and two-factor authentication
- Keeping an eye on obvious errors and uptime
Get a care plan for
- Testing updates before they hit a live, revenue-earning site
- Fast, expert recovery when something breaks or gets hacked
- WooCommerce, membership and complex plugin stacks
- The consistency of it being done every month, when you're busy
The honest test is what a day of downtime would cost you. If the answer is "not much", DIY the basics. If your site takes bookings, sells products or is how customers find and trust you, the reliability of a proper care plan pays for itself the first time it catches a bad update before your customers do.
And sometimes the honest answer is that you don't need a plan yet. A simple brochure site you rarely touch, with automatic backups and a couple of plugins, can often get by on a careful annual check rather than a monthly retainer.
If you have an in-house developer, or the site is brand new and still under a build warranty, a care plan may just duplicate cover you already have. A plan buys reliability you'd otherwise lack, so there's little sense paying for it before you need it.
Where to start: care and hosting from one team
If you've read this far, you know what to look for: a clear split between proactive and reactive work, updates that are tested before they go live and no gap between whoever hosts your site and whoever looks after it. That last point is exactly why we built our service the way we did.
We're a UK software consultancy, so managed WordPress is home ground - the same engineers who build software host your site and maintain it. Care isn't bolted on top of someone else's hosting; it's part of the same service, on UK infrastructure we run ourselves.
Want to see what that looks like in practice? Thornbury & Vale is our own demo site - a real WordPress build with a blog, an online store and the pages a growing business actually needs. Have a look around: it's hosted and looked after exactly the way yours would be, fast, SEO-ready and secure, with the updates and backups handled for you. It's the kind of site you could be running for your own business, without giving any of that a second thought.
Updates are tested, backups are real and when something needs fixing there's one team on the hook rather than two suppliers pointing at each other. As the money page puts it, it's hosting built by consultants who host, not by hosters trying to look like consultants.
Managed WordPress hosting with care built in. Four tiers from £99 a month (ex VAT) - Essentials, Business and Professional you can buy in a few clicks, plus a bespoke Enterprise tier from £2,950. UK-hosted, your domain stays yours, no lock-in and a 30-day money-back guarantee. See the managed WordPress hosting plans.
Sources
Security, market and pricing figures in this guide are drawn from the sources below, checked as of July 2026.
- Patchstack. State of WordPress Security in 2026 (plugin share of vulnerabilities, exploitability trend). patchstack.com. 2026.
- Patchstack. State of WordPress Security in 2024 (vulnerabilities disclosed in 2023). patchstack.com. 2024.
- WPScan. WordPress vulnerability statistics. wpscan.com. 2025-2026.
- Sucuri. Hacked Website and Malware Threat Report (outdated plugins on compromised sites). sucuri.net. 2024.
- Wordfence. WordPress threat intelligence and vulnerability reports (compromises exploiting unpatched components). wordfence.com. 2025-2026.
- W3Techs. Usage statistics of content management systems (WordPress market share). w3techs.com. 2026.
- WordPress.org. Updating WordPress, staging and site maintenance guidance. wordpress.org. 2025-2026.
- The PHP Group. Supported versions and the security-support timeline for PHP. php.net. 2026.
- WooCommerce. Documentation on hosting, performance and securing a store. woocommerce.com. 2026.
- PCI Security Standards Council. PCI DSS, the card-payment security standard. pcisecuritystandards.org. 2026.
- UK WordPress care-plan pricing, taken from providers' published prices (accessed July 2026): ThriveWP, Solve, Pixelish, Rubber Duckers, Little Nerd Web Design, feelingpeaky, WPmaintain, Toast SiteCare, The Smart Bear and Codeable.
Frequently asked questions
A WordPress care plan is an ongoing service that keeps a live WordPress site updated, backed up, secure and working. It bundles the routine upkeep - core, plugin and theme updates, backups, security scanning, uptime and performance monitoring - with support when something needs fixing. The point is to stop a business-critical site quietly breaking or getting hacked because no one was maintaining it.
Yes, for practical purposes they're the same thing. "Care plan", "maintenance plan", "maintenance package" and "support and maintenance" all describe the same ongoing-upkeep service - the label is just branding. "Care plan" tends to imply a more proactive, partnership feel; "maintenance" sounds more like routine tasks. What actually matters is the scope: what's covered each month, and what counts as an extra.
A credible care plan covers proactive work - tested core, plugin and theme updates, regular backups, security scanning, uptime and performance monitoring, SSL upkeep - plus reactive support when something breaks. Better plans test updates on a staging copy first, keep off-site backups with checked restores and include some developer time each month. If a provider can't tell you exactly what's included and what's an extra, treat that as a warning sign.
Most UK care plans run from about £20 a month for basic, largely automated cover to £100 or more a month for proactive, human-tested plans, with premium and e-commerce cover going to several hundred a month. Budget plans (£20-£50) are mostly automation; mid plans (£50-£100) add staging, malware removal and some dev time; premium plans (£100+) add hosting, 24/7 security and larger dev allowances. At Red Eagle Tech, managed hosting with care built in starts at £99 a month.
For any site that earns money or matters to your reputation, usually yes. WordPress powers around 41.5% of the web, and Patchstack found roughly 91% of WordPress vulnerabilities come from plugins - most hacks exploit known flaws in software that simply wasn't updated. A care plan outsources that upkeep so a broken update or an unpatched plugin doesn't take your site down. For a simple, low-stakes site you rarely change, the basics may be enough for now.
A care plan maintains your site; managed hosting runs the server it lives on. Traditionally they're two separate suppliers - you host somewhere, then pay an agency to maintain the site. Managed WordPress hosting with care built in combines both, so the same team owns the infrastructure and the upkeep. That removes the finger-pointing when an update breaks something, because there's no host to blame the maintainer, or vice versa.
Automated host updates are better than nothing, but they're not the same as a care plan. Most hosts apply updates automatically and hope nothing breaks - there's no staging test, no one checking the site afterwards and no one to fix it if a plugin conflict takes a page down. A proper care plan tests updates first, watches the site and owns the fix when something goes wrong. Automation covers the easy 90%; the last 10% is where sites break.
Proactive maintenance is scheduled work that prevents problems: tested updates, backups, security scans, uptime and performance monitoring. Reactive maintenance is fixing things when they go wrong: repairing a broken update, cleaning up malware, recovering from downtime. The distinction matters commercially, because many plans blur it - so when an update breaks your site, you find the fix is billed as an extra. Always check which is included.
Some of it, yes. Running updates, taking backups with a plugin and keeping strong passwords with two-factor authentication are all things a capable owner can manage on a simple site.
Where a care plan earns its money is testing updates before they go live, spotting and fixing a conflict fast, cleaning up after a hack and doing it consistently, month after month, when you're busy running the business. On a site that earns revenue, that reliability is the whole point.
That depends entirely on the plan, which is why it's the question to ask. On a proactive plan that tests updates on a staging copy first, a bad update is caught before it reaches your live site, and fixing it is part of the service. On a cheaper, automation-only plan, a broken update often lands live and the repair is billed as reactive work. Read how the plan handles this before you sign.
Usually a higher tier, yes. A WooCommerce store is a live application handling payments, stock and customer data, often with a stack of extensions for shipping, payments and marketing - each one a potential vulnerability or conflict. It needs more frequent backups, careful update testing so checkout never breaks and tighter security. Most providers price e-commerce care above brochure-site care for exactly this reason, and it's worth it when downtime means lost sales.
Both work; annual usually saves money. Care is an ongoing job - updates, backups and monitoring never stop - so a rolling plan is the norm. Many providers offer a discount for paying annually (we include two months free on annual plans, around 17% off). A sensible approach is to start monthly while you check the service is a good fit, then switch to annual once you're happy. Just make sure there's no long lock-in either way.
At a minimum: tested core, plugin and theme updates, regular off-site backups with checked restores, security scanning and monitoring, uptime and performance monitoring, SSL upkeep and a set amount of support time. Better plans test updates on a staging copy before they go live and include monthly reporting so you can see what was actually done. If a provider can't give you that list in writing, treat it as a warning sign.
Check for updates at least monthly for a simple site, and weekly for a busy or e-commerce site where a broken plugin costs sales. Frequency isn't the whole story though - what matters is testing. Updates should be applied to a staging copy and checked before they reach your live site, whatever the cadence. Critical security patches are the exception: apply those promptly, once tested.
Care plans cover recurring upkeep rather than one-off project work. A redesign, new features or integrations, content creation, SEO and marketing campaigns, plus recovering a site that's already been hacked, are usually quoted separately. Hosting may or may not be included, depending on whether it's a maintenance-only plan or managed hosting with care built in. The key is to get the line between 'included' and 'a project' in writing before you sign.
We publish our prices. Managed WordPress hosting with care built in starts at £99 a month (Essentials), then £329 (Business) and £1,295 (Professional), with a bespoke Enterprise tier from £2,950 - all ex VAT, with two months free on annual plans. Because we're a software consultancy, the same engineers host your site and maintain it - staging-tested updates, UK infrastructure, your domain in your name, no lock-in and a 30-day money-back guarantee.
Want your WordPress site properly looked after?
Managed WordPress hosting with the care built in - from a UK software consultancy that hosts and maintains sites for a living.
Four tiers from £99 a month (ex VAT). Staging-tested updates, UK infrastructure, your domain in your name, no lock-in and a 30-day money-back guarantee.
See our WordPress hosting plans
