What should a website care plan include?

Most websites are built, launched and then left. The software underneath keeps changing, security fixes keep arriving, and one day something stops working. A website care plan (also called a maintenance plan or support plan) is a monthly arrangement where someone is responsible for keeping the site secure, backed up and working.

Plans vary widely, and the names tell you little. This guide sets out what a good plan includes, so you can compare them properly.

The checklist

1. Hosting

Where the site lives. Ask whether hosting is included in the fee or charged separately, which provider is used, and whose name the account is in. If hosting is passed on to you, you should see the real cost.

2. Backups, and proof they work

Every plan says “backups”. Fewer test them. Ask how often backups are taken, where they are stored, how long they are kept, and when someone last restored one to check it worked. A backup that has never been restored is a hope, not a plan.

3. Security and software updates

Websites depend on code that is updated regularly, often to close security holes. A plan should say how often updates are applied, whether they are tested before they go live, and what happens if an update breaks something.

4. Uptime monitoring

Someone, or something, should check the site is up around the clock and tell the person responsible when it is not. Ask who is alerted and what they do about it, and remember that alerts at night do not mean someone works at night.

5. Time for changes

Most plans include a set amount of time each month for small changes: updating text, adding a page, swapping an image. Check how much, whether unused time carries over, and what extra time costs.

6. Response and fix targets

There are two different numbers: how quickly someone replies, and how quickly a fault is fixed. Both should be written down, along with the working hours they apply to. Be wary of a cheap plan promising round-the-clock cover.

7. A report

You should be able to see what you paid for: updates applied, uptime, time used, and anything that needs attention. A short report every month or quarter is enough, and it helps when trustees or a board ask what the money buys.

8. Clear exclusions

Good plans say what is not included. Usually that means redesigns, new features, writing content and marketing. Exclusions are not a bad sign. Vague plans are.

Questions to ask before you sign

Who owns the domain name, the hosting account and the website files?
If I leave, what do I get, and how long does it take?
What is the minimum term, and how much notice do I need to give?
Who actually does the work, and how do I reach them?
When was a backup of a client site last restored as a test?
Does the plan cover accessibility or only keep the site running?
Is the site’s analytics setup compliant without a cookie banner, or do I need one?

What a fair price buys

Plans can cost very little or quite a lot, and both can be fair. A low monthly fee can work for a simple site where almost everything is automated and nobody changes much. It cannot pay for much human time, so check what a person actually does each month.

Our own plans are one reference point:

Care Basic, £99 a month, for websites without payments: hosting, backups, uptime monitoring, monthly security updates, one hour of work and a quarterly report.
Care Plus, £249 a month, for sites with donations or forms, and small portals: everything in Basic plus a restore test every quarter, dependency updates and two and a half hours of work.
Care Systems, £549 a month, for larger systems: five hours of work, performance and security checks, a monthly review call and a monthly report.

All three have a six-month minimum, then roll on quarterly. Prices do not include VAT; Tibyan Labs is not registered for VAT, so none is added at present.

The differences between plans are mostly about time and risk. A site that takes donations carries more risk than a five-page brochure site, so it needs tested restores and faster response.

Warning signs

The supplier owns your domain or hosting account and will not transfer it.
“Unlimited changes” for a small fee. Someone’s time is being rationed somewhere.
No written response or fix targets.
No report, so you cannot see what was done.
A long minimum term with no clear exit terms.

If you do not want a plan

Some organisations would rather have their own staff or another supplier look after the site. That is reasonable, as long as someone is named as responsible. Ask for a proper handover: documentation, the code, access to every account, and a walk-through. We offer this as a Handover Pack for £750.