WordPress care plans that make sites better, not just safer
Most WordPress sites don’t fail on launch day. They decay quietly: plugins go stale, pages slow down, a form stops sending, and nobody notices until enquiries dip.
Why work with Nirmal Gyanwali on WordPress care plans?
The opposite is possible. PRD Burleigh Heads went from 24 to 93 on mobile PageSpeed without a rebuild, in the recorded lab tests (Google PageSpeed Insights, August 2024 against August 2026). That is what WordPress care plans are for, when they’re done properly.
I’m Nirmal Gyanwali, founder of WP Creative. My view is simple. Your website is an asset. Assets need owning, not just maintaining. Someone has to be accountable for whether it gets better each month, not only for whether it stays switched on.
My team runs the care plans. Automated checks monitor selected conditions around the clock. People review alerts and fix issues within the agreed support arrangements. I set the direction and the standards.
What is a WordPress care plan?
A WordPress care plan is an ongoing monthly service that keeps your site updated, secure, backed up and monitored, with a team on hand for fixes and improvements. The difference from basic maintenance is intent. Maintenance keeps the lights on. A care plan treats your website as a business asset that should earn more every month.
Basic maintenance
A proper care plan
Plugin updates and a report
Updates tested on staging first, then released
Reacts when something breaks
Monitoring with a named alert owner and escalation route
No development time
Time each month for improvements
Nobody owns performance
A named team and a written response time
Looking for local support? See my pages on WordPress maintenance in Sydney, website maintenance in Melbourne and WordPress maintenance in Brisbane. This page is about the decision itself.
Is a WordPress care plan worth it?
It is worth it when your website brings in enquiries or sales and changes more than a few times a year. Then the real question is what one broken checkout, one hacked week or one month of slow pages would cost you. For a brochure site that never changes, a care plan is usually more than you need. I learned this from the founder’s side of the table. I started WP Creative on 22 January 2016 with an $18,000 loan and took no salary for nine months, so every client decision mattered. Ten years on, many clients stay with us long after their project, because a website keeps needing an owner long after launch. The work that counts starts when people use it.
A care plan is worth it when
It probably isn’t when
The site drives leads, sales or bookings
The site is a digital business card
Your marketing team has a backlog of website work
The site changes once a year
You run ads, campaigns or ecommerce
Nobody will act on what the plan finds
Downtime or a hack would make the news, or the board
You only want plugin updates at the lowest price
The useful comparison is the work promised in writing: routine updates, recovery, monitoring, response, improvement time and what happens when you leave. A plan’s label does not establish its scope.
Should I pay for a care plan or a basic maintenance plan?
Pay for maintenance to keep the site as it is. Pay for a care plan to make it better. They are different products. Maintenance buys updates, backups and a report. A care plan buys a team with time to improve the site: faster pages, better forms, new landing pages. Compare them on outcomes, not on hours.
Updates-only maintenance
- What you get Updates, backups, a report
- Who owns the result Check the named owner and scope
- Cover when someone is sick Ask for the cover arrangement
- Suits Sites that stay the same
A care plan
- What you get A team, monitoring and improvement time
- Who owns the result Check the provider’s written responsibilities
- Cover when someone is sick Ask for the cover arrangement
- Suits Sites that must keep earning
Doing it in house
- What you get Whoever you can hire
- Who owns the result Name your internal owner
- Cover when someone is sick Agree internal or partner cover
- Suits Large teams with steady website work
If you only want updates at the lowest price, a care plan is the wrong product, and I’d rather tell you now. My comparison of WordPress maintenance packages covers other options.
Does an AI-built website need different maintenance?
The same basics, plus four checks. Review AI-written code before it ships. Audit which AI tools and plugins can access the site, and remove what nobody uses. Keep crawler rules deliberate, so good AI crawlers get in and scrapers don’t. And log every change an AI workflow makes, so a person can see it and roll it back.
That is AI website maintenance in plain terms. Whether the AI-built code itself is secure is a separate question, answered on my AI website security page.
01
AI-written code gets reviewed
The same code review as any other change, tested on a staging copy before it reaches the live site.
02
AI access gets audited
Every AI tool, plugin and integration gets the least access it needs, and access nobody uses is removed.
03
Crawler rules get decided
Which AI crawlers to welcome or block is a business decision, not a default. I cover it on my AI-ready website page.
04
AI workflows get logged
If an assistant drafts or publishes, there is a record and a rollback, so a person can see every change.
What should any WordPress care plan include?
Whoever you choose, ask for seven things in writing. Updates tested on a staging copy before release. Off-site backups that have actually been restored. Uptime and security monitoring with a person reading the alerts. A written response time. Accounts in your name. A monthly note of what changed. And time to improve the site, not only maintain it.
Add the recovery limits: backup frequency, files and database included, retention, last restore test, maximum acceptable data loss and restoration target. Separate a response commitment from a fix target, and name exclusions such as incident clean-up, third-party licences or extra development.
If a quote can’t show you these, ask why. A lower-cost plan that skips three of them costs more in the end.
- Updates tested on staging, then released
- Off-site backups, with a restore tested, not just scheduled
- Uptime and security monitoring, and a named person who reads the alerts
- A written response time for a site-down issue
- Your domain, hosting, data, tracking and documentation in your name from day one
- A short monthly note: what changed, what was found, what’s next
- Development time for improvements: landing pages, speed, forms, integrations
Care plans in practice
These are results from specific clients in specific periods, not a guarantee for every site. What each plan covers, and its response times, are set in the plan agreement before work starts.
99.89%
uptime and no malware detected in 40 selected security scans in one reporting month, June to July 2026
24 to 93
mobile PageSpeed score, live site, August 2024 to August 2026, and 100% of flagged vulnerabilities patched in the month they appeared, across five sampled monthly reports
A credit data analytics company
On a care plan since 2022. Security patches, plugin updates and marketing execution across a complex, multi-stakeholder site. Four years on, my team is still their go-to web team.
A medical device company
A multi-year care engagement covering maintenance, security and website delivery alongside the client’s marketing team.
Who care plans are for
Good fit
- Businesses whose website drives leads or sales
- Marketing teams with a backlog of website work
- Teams that have outgrown a solo developer
- Companies needing a written response time
Not a fit
- Anyone who only wants plugin updates
- Sites that change once a year
- Anyone after the lowest-priced updates-only service
- One-off fixes with no ongoing care
More questions about WordPress care plans
Should plugin updates go straight to the live site?
No. Updates should go to a staging copy of your site first, be tested, and only then be released. Some updates include security fixes, and how urgently one should go out depends on the severity of the vulnerability it fixes. Any update can also clash with another plugin. Testing first is the difference between a routine Tuesday and a broken checkout on a Friday night.
An urgent vulnerability needs its own route: assess whether the site is exposed, apply the supported fix or mitigation promptly, then verify the affected journeys. A monthly report saying “patched within the month” does not establish how long the site was exposed.
What should happen when my site goes down?
Monitoring should route the alert to a named person; it cannot guarantee noticing every failure before a customer does. Someone should respond within a written time, diagnose whether it is the server or the site, and fix it or escalate it while you get updates in plain English. You should have a named contact and an escalation path, so nobody is hunting for a phone number.
Should I sign a long care plan contract?
Only if the saving is worth more to you than the freedom to leave. Whatever the term, make sure your site, hosting, data and documentation stay in your name, so leaving is simple. The best reason to keep a provider is that the site keeps getting better, not that you can’t get out.
What should a care plan cost?
For what drives the number, read WordPress maintenance costs in Australia and what a website should cost; for WP Creative’s plans, see WP Creative.
Put your website on a care plan
Tell us about your site and what keeps going wrong. On a free call, you’ll talk with me or my team, and we’ll tell you whether a care plan is worth it for you, or whether you don’t need one.
Prefer the phone? 02 8278 7530
