The set-it-and-forget-it trap
You spend a few thousand pounds on a new website. It launches, it looks great, the team is pleased, and then nothing. It sits there. Months pass, maybe years. Nobody updates the plugins, nobody checks the backups are actually working, and the only time anyone logs in is to change a phone number.
This is the single most common website mistake we see from UK small and medium businesses. The site was treated as a project with a finish line, rather than an asset that needs ongoing care. And the thing is, it usually looks fine right up until the moment it doesn’t. A form stops working. A plugin update quietly breaks the homepage. Or, worse, the site gets hacked and the first you hear about it is a panicked call from a customer asking why your website is serving up pharma spam.
A proper web development and maintenance service treats your site as a living system, not a one-off deliverable. That shift in thinking is what a website care plan is all about.
What a website care plan actually is
A website care plan, sometimes called a website maintenance plan or managed website plan, is a recurring monthly service that keeps your site secure, up to date, fast and functional. It covers the technical work that needs doing whether or not anything has visibly gone wrong.
What it is not is a retainer for redesigning pages on demand, writing your blog posts, or running your social media. Those are separate services. A care plan is closer to a service contract on a company car. You’re paying so that someone qualified is keeping the engine healthy, the tyres inflated and the MOT current. You’re not paying for a new paint job every month.
The components that matter most are hosting, security monitoring, software updates, automated and tested backups, uptime monitoring, and a small allowance of developer time each month for minor fixes and tweaks. If a plan you’re looking at is missing any of those, it has gaps.
The real cost of not having one
The honest argument for a care plan is financial, not technical. Consider what goes wrong when maintenance is skipped.
Security breaches. According to the UK Government’s Cyber Security Breaches Survey 2025/2026, 43% of UK businesses identified a cyber security breach or attack in the last 12 months. Outdated website software, particularly unpatched plugins and themes, is one of the most common ways attackers get in. Cleaning a hacked website costs between £500 and £3,000 for most small business sites, and that is the technical work alone. It does not include lost revenue from being offline, reputational damage, or the weeks it can take for Google to re-index a site that was temporarily blacklisted for malware.
Emergency developer rates. Ad hoc developer support in the UK typically runs at £50 to £150 per hour. If you have no maintenance plan and something breaks, that is what you pay. Over a year, ad hoc support nearly always costs more than a monthly plan, even if you only call on it occasionally.
Broken forms and missed leads. A Cardiff plumber whose contact form stops submitting has no idea how many enquiries have disappeared into the void until they notice the phone has gone quiet. A small accountancy firm running a booking form that returns an error every Tuesday afternoon is quietly losing clients to competitors. These things happen, and they happen more often on sites that are not being actively monitored.
Downtime. Being offline, even briefly, costs you enquiries and revenue. Add in the reputational hit if customers reach a broken page or a security warning, and the sums mount quickly. Most of this is entirely preventable with basic uptime monitoring and prompt support.
What a proper plan must include
Not all care plans are equal. Here is what a genuinely useful plan covers, and why each element matters.
Managed hosting. Your hosting environment is the foundation everything else sits on. Slow, unreliable shared hosting is a real risk, not least because site speed now directly influences your search rankings. Good managed hosting on quality infrastructure should be part of any plan worth signing up to.
Security monitoring and software updates. WordPress, WooCommerce and other CMS platforms release updates regularly, and those updates frequently patch known vulnerabilities. An unpatched plugin is an open door. A plan should include regular, human-reviewed updates rather than just automated pushes that nobody checks.
Backups and restore testing. This one is underrated. Almost every basic plan includes backups. Far fewer actually test that those backups restore correctly. A backup you have never tested is not a backup, it is a hope. Your plan should specify how often backups run, how long they are retained, and whether restore testing is included.
Uptime monitoring. You should not have to rely on a customer telling you the site is down. Uptime monitoring alerts you the moment the site becomes unavailable, so problems get fixed in minutes rather than hours or days.
A monthly developer time allowance. Small things come up every month. A link needs updating, a PDF needs replacing, a phone number changes. Having a small block of developer time in the plan means these get done promptly rather than sitting on a to-do list for three months.
What cheap plans quietly leave out
Budget plans at the lower end of the market, typically under £40 per month, can look appealing on a spreadsheet. But the economics only work through automation and volume. Updates are pushed automatically, support goes through a ticket queue, and the service is largely hands-off. For a very simple site that rarely changes, it might be adequate. For most SME sites, it is not.
The gaps that turn into nasty surprises include: no human review of updates before they go live, meaning a plugin conflict breaks your homepage and nobody notices until a customer emails you; no actual restore testing of backups; no developer time allowance, so every small fix becomes a separate billable job; slow or non-existent support response times; and hosting bundled in from the cheapest possible provider to protect the plan’s margin.
At a minimum, website maintenance should cover CMS core, plugin and theme updates; regular backups with a tested restore process; basic security monitoring; and domain and SSL certificate renewal management. Anything that does not clearly cover all of those is leaving things out.
The three main tiers and what suits each business
For most UK small and medium businesses, professional website maintenance costs somewhere between £50 and £350 per month. There are broadly three tiers.
Basic (roughly £40 to £80 per month). At this level you are getting automated plugin and theme updates, scheduled backups, uptime monitoring and basic security scanning, with little or no human review involved. This suits a simple brochure site for a local service business that rarely changes and does not process payments or bookings online.
Managed (roughly £80 to £200 per month). This tier includes everything in the basic tier, plus human-reviewed updates, tested backups, a monthly developer time allowance for minor fixes, and faster support response times. This is the right level for most active SME websites: a services company running lead generation forms, a trade business with a portfolio, a local e-commerce shop, or a professional services firm where the website actively wins clients.
Premium (roughly £200 to £500 per month). At the higher end you are buying dedicated account management, regular strategy reviews, more developer time, priority support and in some cases SEO health checks or content updates. This level suits businesses where the website is a primary revenue channel and any downtime or performance drop has a direct financial impact.
DIY maintenance and what it actually costs you
Some business owners choose to handle maintenance themselves to avoid the monthly cost. It is a fair decision, but it is worth being clear-eyed about what you are taking on.
Maintenance is not passive. It requires real time, real attention and real expertise every single month. For a typical WordPress site, running and reviewing updates, checking backups, monitoring security alerts and dealing with minor issues takes a minimum of two to three hours per month once you factor in testing. If something goes wrong during an update, or a backup turns out to be corrupt, you are suddenly looking at an afternoon of your time or an emergency call to a developer at those ad hoc hourly rates.
For most SME owners, their time is worth more than the cost of a care plan. A solicitor, a plumber or an accountant billing at a professional rate is almost certainly not saving money by doing their own plugin updates at 9pm on a Sunday.
How your care plan connects to SEO and site performance
A poorly maintained website does not just risk downtime. It quietly damages your search rankings too.
Google’s March 2026 core update made Core Web Vitals significantly more consequential. The headline change is structural: performance is now evaluated across your entire site rather than page by page. A handful of slow-loading templates can drag down rankings across your whole domain, even on pages that individually load quickly. Early tracking data following the rollout showed affected sites experiencing meaningful traffic drops, with some losing over 50% on their worst-hit sections.
An unmaintained site tends to slow down over time as database bloat accumulates, image libraries grow unoptimised and plugins multiply. A good care plan includes periodic performance checks and optimisations to keep your site in the shape it needs to be in to compete. This is where SEO and ongoing maintenance naturally overlap. You cannot rank well with a slow, broken or compromised site, no matter how strong your content is.
Five questions to ask any provider before you sign up
- Is hosting included, and what infrastructure does it run on? Managed hosting bundled into the plan is a strong positive. Generic shared hosting is not.
- Are updates reviewed and tested by a human before they go live? Automated-only update plans leave you exposed when a plugin update conflicts with your theme or breaks a key page.
- How are backups stored, how often do they run, and do you test restores? Ask specifically whether restore testing is included, not just backup creation.
- What is the support response time, and how do I contact you in an emergency? A ticket queue with a 48-hour SLA is not the same as a phone number and a four-hour response commitment.
- Is there a monthly developer time allowance, and what does it cover? Know upfront what is included and what triggers an additional charge. Surprises on an invoice are avoidable if the scope is clear from the start.
How Cardiff Web approaches ongoing website support
We work with small and medium businesses across Wales and the wider UK, and ongoing website support is a natural extension of the work we do building and developing sites. If we built your site, we already know how it is structured, which makes maintenance faster and more effective. If you have a site built elsewhere, we are happy to take it on after an initial audit.
Our approach to web development and ongoing support is grounded in the idea that a website is a business asset, and assets need managing. That means proper hosting, security that is actually monitored, backups that are tested, and a real person who picks up the phone or responds promptly when something needs attention.
We also understand how maintenance connects to broader digital performance. A site we look after is one we can advise on from a performance and search visibility perspective too, because the two are inseparable. And if a site has grown beyond what maintenance can solve and genuinely needs new functionality or a rebuild, we offer bespoke software development to take things further.
If you are not sure what level of care your current site needs, the best starting point is a conversation. Get in touch and we will take a look, give you an honest assessment, and explain exactly what we would recommend and why.