BlogWebsite Maintenance
WordPress Care Plan Features Worth Paying For, Ranked (and the Ones That Are Padding)
Rustam11 min read
The quick version: the WordPress care plan features worth paying for are, in order, updates that are tested before they reach your live site, off-site backups that someone has actually restored, security monitoring with clear terms for clean-up, checks that your forms and checkout still work, and you keeping ownership of every account. After that come included fixes and edits, licence and PHP tracking, speed work and a readable report. UX heatmaps are a genuine extra for sites that need to convert. Big PDF reports and "unlimited" promises are mostly padding.
I'm Rustam. I run Frame the Pixel, a design and WordPress maintenance studio in Malaysia, so I sell care plans myself and I'll describe mine at the end. The ranking below is about what protects a small business site, and I've tried to write it so you can hold any provider's quote up against it, mine included.
How I ranked these
Each feature is ranked by one question: if this were missing, how bad could the damage be, and how likely is it to happen? Losing the whole site with no backup is rare but catastrophic. A contact form failing after an update is common and quietly expensive. A monthly report with nice charts protects nothing on its own.
That gives three groups:
- Must-have (1 to 5): without these, you're paying for very little.
- Worth paying for (6 to 9): they save money or stress for most business sites.
- Nice to have (10): valuable for some sites, not a deal-breaker.
Then a short list of features that sound good on a sales page and rarely earn their keep.
The scorecard
- Updates tested before they go live (must-have)
- Off-site backups with tested restores (must-have)
- Security monitoring with written clean-up terms (must-have)
- Checks that forms and checkout still work (must-have)
- You own the accounts and licences (must-have)
- Fixes and small edits included (worth paying for)
- Licence and PHP tracking (worth paying for)
- Speed work (worth paying for)
- A short report written by a person (worth paying for)
- UX heatmaps and consultations (nice to have)
In plain words: the first five are the protection. Six to nine make the plan useful day to day. Number ten is about improving the site rather than protecting it.
1. Updates that are tested before they go live
Why it's first: updating is the job, and updating badly is how most self-inflicted breakages happen.
Updates aren't optional. Patchstack's State of WordPress Security in 2026 found 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 91% of them in plugins. So the plugins need updating regularly. But pressing "update all" on a live site is how a homepage ends up blank on a Monday morning.
WordPress can automatically roll back a plugin auto-update that causes a fatal error. That's useful, but it won't spot a broken layout, a missing Elementor section or a booking calendar that stopped loading. That takes a person looking at the pages after the update, ideally on a staging copy first.
Ask: "Who runs the updates, and what do you check before they go live?" If the answer is "they're automatic", you're buying software, not care.
2. Off-site backups with restores that have been tested
Why it's second: it's the feature that decides whether a disaster costs you a morning or the whole site.
Three details separate real backups from a checkbox on a feature list. The backup must be stored away from the server the site runs on, because a backup on the same server disappears with it. It must include both the files and the database. And someone must have restored one at least once to prove it works.
Ask: "Where exactly are the backups stored, how long are they kept, and when was a restore last tested?" Vague answers here are the biggest red flag in any quote.
3. Security monitoring with clean-up terms in writing
Why it's third: monitoring without a clear answer to "and then what?" just means you hear the bad news sooner.
Good monitoring watches for malware, suspicious logins and new vulnerabilities in the plugins you run. It should also include keeping an eye on Google's Security issues report in Search Console, which is where Google tells you it thinks the site has been hacked.
The part people skip is what happens after an alert. Is clean-up included in the plan, or billed by the hour? How quickly will someone start? Be wary of anyone who promises the site can't be hacked. No honest provider can guarantee 100% security. What they can promise is a fast response and a clear process.
Ask: "If the site is hacked, what do you do, how fast, and what does it cost on top of the plan?"
4. Checks that forms and checkout still work
Why it's fourth: the failures that cost the most money are often the ones that don't take the site down.
Uptime monitoring tells you whether the homepage loads. It won't tell you that the contact form stopped sending emails after an update, or that checkout fails on mobile. Those are the problems customers report before you notice, if they bother to report them at all.
A good plan includes submitting the key forms and, for shops, running a test order after updates. It's a ten-minute job that most cheap plans skip.
Ask: "After updates, do you test the contact forms and checkout, or just the homepage?"
5. You keep ownership of the accounts and licences
Why it's fifth: this is about the day you stop working with your provider, which you hope never comes.
Your domain, hosting, WordPress admin, Google accounts and premium plugin licences should all sit in your name, with your provider given their own access. If everything lives in the provider's accounts, leaving becomes a negotiation. I see this most on sites I take over, and my takeover checklist covers how to untangle it.
Ask: "Whose name are the hosting and licences in, and what do I get if we part ways?"
6. Fixes and small edits included
Why it matters: the alternative is paying an hourly rate every time you change a phone number.
Most business sites need small changes every month: new opening hours, a staff photo, a price update, a broken link. Plans that include fixes and content changes save you raising a quote for every one. The useful detail is how much is included and how quickly requests are handled, not whether the word "unlimited" appears.
Ask: "How many changes or hours are included, how fast do you turn them round, and what's the rate after that?"
7. Licence and PHP tracking
Why it matters: these are slow problems with hard deadlines.
Builder sites rely on paid plugins. Elementor's help centre says that if you don't renew Elementor Pro you can't update it or add Pro features, and that updating the free plugin without Pro "can lead to compatibility problems". Crocoblock says sites keep working after a licence lapses but stop receiving plugin updates. Someone needs to watch renewal dates.
PHP is the same kind of problem. php.net lists PHP 8.2 security support ending on 31 December 2026, and WordPress recommends PHP 8.3 or greater. A plan that tests the newer PHP version on staging before the host forces it is worth more than it looks. My Elementor maintenance guide goes into the builder side of this.
Ask: "Do you track my licence renewals and PHP version, and who pays for the licences?"
8. Speed work
Why it matters: sites get slower over time unless someone pushes back.
Speed work in a care plan usually means image optimisation, caching and trimming unnecessary code. Google's Core Web Vitals guidance says a good page shows its main content within 2.5 seconds, responds to input within 200 milliseconds and keeps layout shift to 0.1 or less. Ongoing speed work keeps you near those numbers as new content goes up.
It ranks below the protection features because a slow site still works. It ranks above the report because it actually changes something.
Ask: "What do you do about speed each month, and how do you measure it?"
9. A short report written by a person
Why it matters: it's how you know the work is happening.
A useful report says what was updated, what broke and how it was fixed, whether the backups ran, and anything you need to decide. Half a page written by the person who did the work beats twenty pages of auto-generated graphs.
Ask: "Can I see an example report?"
10. UX heatmaps and consultations
Why it's last but still on the list: it improves the site rather than protecting it.
Heatmaps show where visitors click, how far they scroll and where they give up. On a site that's meant to bring in enquiries or sales, that's often where the next improvement comes from. On a five-page brochure site that rarely changes, it's a nice extra rather than a need. If you're choosing between better backups and heatmaps, take the backups.
Ask: "Do you only report what the heatmaps show, or do you suggest and make changes?"
Features that are often padding
These aren't always useless. They're just commonly oversold.
- "Unlimited" anything. Unlimited edits with no stated turnaround can mean a long queue. Ask for real numbers.
- "24/7 monitoring" on its own. A free uptime tool can watch your site around the clock. The value is in who responds to the alert and how fast, so ask about that instead.
- Long auto-generated PDFs. Charts of uptime percentages and plugin counts look busy and say little. See feature 9.
- "Hack-proof" guarantees. Nobody can honestly promise that. Look for written clean-up terms instead (feature 3).
- Bundled premium plugins you don't own. Handy until you leave and the licences go with the provider. See feature 5.
Questions to ask any provider
If you only have five minutes on a call, ask these, in this order:
- Who runs the updates, and what do you check before they go live?
- Where are the backups stored, how long are they kept, and when was a restore last tested?
- If the site is hacked, what do you do, how fast, and is clean-up included?
- After updates, do you test forms and checkout?
- Whose name are the hosting, domain and licences in?
The answers to those five tell you more than any price. For what the routine should look like month to month, see my WordPress maintenance checklist. If you're not sure your site needs a plan yet, the warning signs list will tell you quickly. For budgets, I've covered maintenance costs in Malaysia and in the UK and Europe.
What's in a Frame the Pixel care plan
Here's how my own plans line up against the list. Everything below comes from my website maintenance page.
- Software updates: WordPress core, theme and plugin updates, applied carefully so nothing breaks. Updates run monthly, and fixes and changes are handled weekly through the month.
- Security monitoring: proactive protection and a fast response if the site is ever compromised. I don't guarantee 100% security, and the page says so.
- Backups: regular backups on your hosting server or in Google Drive, OneDrive or Dropbox, depending on your host.
- Speed optimisation: image optimisation, caching and code minification.
- Fixes and content updates: bugs and errors fixed, and content changes handled when you need them.
- UX heatmaps (Premium plan): heatmaps and consultations, with UI and UX improvements based on how visitors actually behave.
E-commerce sites are covered, including keeping payment gateways working. If you don't want a plan, there's one-time support at an hourly rate.
The sites I know best are built with Elementor and Crocoblock, and I often take on sites someone else built. I work with clients in Malaysia, the UK, Europe and elsewhere, every day from 9am to 5pm (GMT+8), and I invoice through Wise so you can pay in your own currency. I quote after looking at your site, because plugins, hosting and how often you change content all affect the work.
Want to see how your site would fit? Send me the address here or email contact@framethepixel.com. I'll tell you which features you actually need, even if that points to the smaller plan.
FAQ
What should a WordPress maintenance plan include?
At minimum: updates tested before they go live, off-site backups with tested restores, security monitoring with clear clean-up terms, checks that forms and checkout still work after updates, and confirmation that you own the hosting, domain and licences. Fixes, licence tracking and speed work are worth paying for on most business sites.
Is a WordPress care plan worth it for a small business?
If the site brings in enquiries or sales, usually yes. Patchstack counted 11,334 new WordPress ecosystem vulnerabilities in 2025, most of them in plugins, so updates can't be left for months. A plan is worth it when it includes people checking the work, not just automated updates.
Are automatic updates enough instead of a care plan?
Not on their own. WordPress can roll back a plugin auto-update that causes a fatal error, but it won't notice a broken layout, a missing page section or a contact form that stopped sending. Someone still has to check the site afterwards.
Should backups be included in a WordPress care plan?
Yes, and they should be stored off the server, cover files and the database, and be restored at least occasionally to prove they work. Ask where they're stored and when a restore was last tested.
What's the difference between website maintenance and a care plan?
Mostly the name. Both describe ongoing updates, backups, security and fixes. What matters is what's actually included, so compare plans feature by feature using the scorecard above rather than by the label.
Do care plans include hack clean-up?
Some do and some charge extra. No honest provider can guarantee a site will never be hacked, so look for written terms on what happens after an incident: who responds, how quickly, and whether clean-up costs extra.