What it usually includes
Monitoring from outside, software and plugin updates, backups with tested restores, security checks, a number of small changes, agreed response times for incidents and a monthly report. Tiers differ by response time, hours included and audit depth. On backups, the UK National Cyber Security Centre advises keeping a copy in a separate safe location and checking, once it is made, that it contains all your important data; WordPress’s own documentation says a typical site needs both its database and its files to be restored.
What makes it renew
Clients cannot see work that prevented a problem. A written checklist, a log of actions, a monthly report with honest numbers and early warnings about expiring domains and certificates make the value visible.
Limits to write down
What is excluded, which parts depend on third parties such as hosting or payment providers, what counts as a change request and what an out-of-hours response means.
An example of what a plan promises
A small plan might promise: monitoring from outside with an alert to a named person; updates applied within a week of release after a check on a staging copy; a backup restore tested every quarter; certificate and domain expiry dates reviewed monthly; and a one-page report in the first week of each month. Each promise has an owner and a date in a checklist, so when a client asks what the fee pays for, the answer is a list of dated actions. Tiers then differ in response times and hours included, not in whether these basics happen.
What to check
That every promised task has an owner, a schedule and a record of being done.
Sources
Read on . Standards and vendor pages change; confirm the current text before you rely on it.
- UK National Cyber Security Centre, Backing up your data (www.ncsc.gov.uk)
- WordPress developer documentation, Backups (developer.wordpress.org)