---
id: 13012
title: "WordPress Care Plan: What to Buy Beyond Hosting"
slug: "wordpress-care-plan"
lang: "en"
url: "https://heshamsaad.com/en/wordpress-care-plan/"
markdown_url: "https://heshamsaad.com/en/wordpress-care-plan.md"
translations: {"ar":"https://heshamsaad.com/ar/wordpress-care-plan/"}
description: "Compare a WordPress care plan vs hosting-only support: what managed care includes, when to buy, how to judge proposals, and SLA details that protect MENA sites."
author: "Khadija"
date_published: "2026-10-14T17:00:00Z"
date_modified: "2026-10-24T17:09:58Z"
categories: ["Security & Maintenance"]
tags: ["Managed WordPress","WordPress Care Plan","WordPress Maintenance Services","WordPress Site Care","WordPress Support Egypt"]
featured_image: "https://heshamsaad.com/wp-content/uploads/2026/10/wordpress-care-plan-og-v2-en.jpg"
word_count: 2320
reading_time_min: 12
content_sha256: "99ba6216d59108349c1f6c73e9ca64757a0abce3c25293c4801b4a6641164c25"
---
# WordPress Care Plan: What to Buy Beyond Hosting
Hosting keeps your files online. A WordPress care plan keeps the site current, recoverable and watched so a business in Egypt, Saudi Arabia or the Gulf is not one forgotten plugin update away from [downtime](https://heshamsaad.com/en/wordpress-site-down/). This article is about buying and judging managed care, not about doing every weekly task yourself. If you want the DIY task list, use our separate [weekly and monthly WordPress maintenance checklist](https://heshamsaad.com/en/wordpress-maintenance-checklist/). Here we focus on what a care service should include, when it is worth paying for, how to read a proposal, and which SLA details actually protect you.
I sell and deliver ongoing WordPress support for MENA companies that already have a live site and need calm operations more than another redesign pitch. If you are comparing providers, start with our [WordPress care plan](https://heshamsaad.com/en/sitecare/) page so you can see how we scope updates, backups and response windows. Use the sections below to prepare questions for any vendor, including us.
## Care plan versus hosting-only support
Many hosting panels advertise "WordPress managed" or "automatic updates." That usually means the host patches the server stack, offers one-click WordPress installs, and may auto-update core or a short plugin list. It rarely means a named human reviews your forms after an update, tests Arabic RTL layouts, restores a broken checkout, or opens a ticket when Search Console reports a spike in 404s.
WordPress documents updating from the dashboard, managing plugins and themes, Site Health checks, backups and restoring a database from backup. Those docs describe what must happen. They do not assign an owner. A care plan is the contract that names who runs those tasks, how often, on which environment, and what happens when an update breaks a live form.
| Need | Typical hosting panel | WordPress care plan |
|---|---|---|
| Server uptime and SSL | Usually included | Assumes host handles base stack |
| Core, plugin, theme updates | Often automatic or optional | Scheduled, reviewed, rolled back if needed |
| Backup restore tested | Snapshot exists; restore rarely practiced | Restore drills and documented RTO |
| Malware or hack response | May offer a security add-on | Defined incident steps and contacts |
Buy hosting for reliability and speed. Buy a care plan when the cost of an unmaintained business site (lost leads, payment failures, brand damage after a hack) exceeds the monthly fee. The two products should cooperate, not compete, and you should know which party owns DNS, SSL renewal, PHP version bumps and WordPress application work.
## What a complete WordPress care plan should include
Vague marketing pages list "security and speed." Demand a written scope. At minimum, a business-grade plan for a service site or small store should spell out the following buckets. A good plan also monitors email delivery, so problems like [WordPress not sending emails](https://heshamsaad.com/en/wordpress-not-sending-emails/) get caught early. Ask who handles rollbacks when a [WordPress update broke my site](https://heshamsaad.com/en/wordpress-update-broke-site/), because that is the moment a care plan earns its price.
### 1. Updates with a safe path
WordPress publishes how to update core from the dashboard and how the Updates screen surfaces plugin and theme changes. A care plan should say whether updates run on staging first, how often (for example weekly for plugins, after review for major core), who approves exceptions, and how rollbacks work. Auto-updating everything on production without a restore point is not a plan; it is hope.
### 2. Backups you can actually restore
Official WordPress backup guidance stresses regular copies of files and the database, plus a restore path. Ask where backups live (not only on the same disk as the site), how many days you keep, whether restores are tested on a schedule, and who can trigger one at 2 a.m. Cairo time. A backup that has never been restored is an untested promise.
### 3. Security hygiene, not slogans
WordPress hardening guidance covers HTTPS, least-privilege users, file permissions, and keeping software current. A care plan should include role audits, login monitoring or rate limits where appropriate, malware scanning if offered, and a written path when the site is compromised. Pair that with our separate article on [recovering a hacked WordPress site](https://heshamsaad.com/en/fix-hacked-wordpress-site/) so you know what emergency work looks like before you need it. If you're not sure where the site stands today, start with a [WordPress security audit](https://heshamsaad.com/en/wordpress-security-audit/) before signing a plan.
### 4. Uptime and basic performance watching
Uptime monitors catch total outages. They do not catch a slow checkout or a broken contact form. Agree on what is watched (homepage, login, a key form URL), notification channels, and whether the provider checks Core Web Vitals trends. Google and web.dev publish LCP, INP and CLS targets; a care plan does not replace a performance project, but it should notice large regressions after updates.
### 5. Content and small change hours (if sold)
Some plans include a small pool of content edits. If they do, define what counts (text swaps versus new templates), how requests are queued, and what is out of scope. Mixing unlimited design work into a maintenance fee is how both sides get frustrated.
### 6. Reporting you can read in ten minutes
Ask for a monthly note: updates applied, backups status, incidents, open risks, Site Health warnings that need a decision. Screenshots of a green dashboard are not enough if they hide deferred major updates.
## When a MENA business should buy managed care
You do not need a care plan for a personal blog you update yourself every Sunday. You usually do need one when any of the following is true.
- The site brings leads, bookings or orders, and downtime has a clear cash cost.
- Arabic and English both ship, so updates need RTL and bilingual smoke checks.
- WooCommerce or payment gateways sit on the same install as the marketing site.
- No one on staff owns WordPress updates with calendar time reserved each week.
- Past updates were skipped for months, then done in a rush after something broke.
- Agencies hand off builds without a maintenance owner; the site then ages quietly.
If you are still building the site, finish the build first, then attach care. A care plan is not a substitute for unfinished development. For new builds and larger changes, see our [WordPress development for business sites](https://heshamsaad.com/en/wordpress-development/) page, then layer care once the site is live and stable.
## How to judge a care plan proposal
Force every vendor to answer the same written questions. Compare answers side by side instead of comparing only monthly price.
1. Environments: Is staging included? Who pays for it? Are risky updates tested there first?
2. Update policy: Core, plugins, themes: cadence, exclusions, who can pause auto-updates.
3. Backup policy: frequency, retention, offsite copy, last successful restore date.
4. Access model: Do they create their own admin user? Do they use least privilege? Are you the account owner on hosting and domain?
5. Hours and channels: WhatsApp, email, ticket system; business hours in Egypt or Gulf time; after-hours path for outages only.
6. Included versus billable: malware cleanup, theme conflicts, new page builds, plugin license renewals.
7. Exit terms: How you get a full backup, credentials list and revoke vendor access on day one of a switch.
Serious providers answer in writing. Vague providers sell anxiety. Price matters, but opaque scope is usually more expensive after the first incident.
## SLA details that actually protect you
An SLA is only useful if it defines response, not only uptime percentages copied from a host. Ask for these definitions in plain language.
- Severity levels: site down, checkout failing, admin inaccessible, non-urgent visual bug.
- Response time: how quickly a human acknowledges each severity during contracted hours.
- Resolution target: best-effort estimate, with honesty when a third-party plugin is the blocker.
- Maintenance windows: when planned updates run, and whether you get advance notice.
- Communication: who on your side is notified, and in which language if your team works in Arabic.
- Credits: what happens if response times are missed (credit, extension, or nothing).
Do not confuse host SLA (server reachable) with application SLA (WordPress works). Your care provider should state which layer they own. When updates need a safe rehearsal environment, our guide to a [WordPress staging site before risky changes](https://heshamsaad.com/en/wordpress-staging-site/) explains why staging belongs in the contract, not as an optional add-on you discover after a broken live update.
## Red flags when buying WordPress site care in Egypt
Local and regional proposals often share the same weak spots. Treat these as walk-away signals unless the vendor fixes them in writing.
- "Unlimited support" with no definition of a support ticket.
- No mention of backups, or backups stored only on the production server.
- Auto-updates enabled everywhere with no staging and no rollback story.
- Vendor insists on owning the hosting account in their name.
- Security claims with no reference to hardening practices or update cadence.
- One flat fee that quietly excludes WooCommerce, multilingual sites or custom plugins.
- No monthly report and no named engineer you can reach.
Also ask how they handle plugin licenses. Renewing a paid plugin is often the client's cost; applying the update after renewal is care work. Mixing those lines creates surprise invoices.
## DIY checklist versus paid care: choose deliberately
Some teams keep a thin internal checklist and only buy care for after-hours incidents. Others outsource the whole rhythm. Both can work. What fails is assuming someone is maintaining the site when nobody has a calendar block or a contract. WordPress Site Health will surface PHP, HTTPS and critical issues, but someone still has to act on the warnings. Official hardening and update docs only help if a person runs them.
If your team will stay DIY, follow the checklist post linked above and schedule restore tests. If you will buy care, keep a short internal owner anyway: someone who approves major updates, holds hosting credentials, and reviews the monthly report. Managed WordPress for business works best when the client still owns strategy and access, and the provider owns the operational loop.
## What good handover looks like after you sign
Day one should not be a mystery. Expect a kickoff that covers:
1. Inventory of plugins, themes, custom code and license expiry dates.
2. Admin users: remove abandoned accounts, set roles using WordPress roles and capabilities guidance.
3. Backup baseline and a restore dry run on staging if available.
4. Uptime and form checks aimed at your real conversion URLs.
5. Shared channel, severity definitions and first month's update calendar.
If the site was neglected, the first month may include catch-up updates and cleanup billed as a one-time project. That is normal. Pretending a neglected install needs only a cheap monthly fee is how providers disappear when hard work appears.
## Frequently asked questions
### Is a WordPress care plan the same as managed hosting?
No. Managed hosting focuses on the server environment, often with tooling around WordPress installs. A care plan focuses on the application: updates, backups you can restore, security follow-up, and human response when something breaks in the site itself. Many businesses buy both from different companies. If you're comparing hosts, our guide to [managed WordPress hosting](https://heshamsaad.com/en/managed-wordpress-hosting/) explains what the host should cover and what stays with you.
### How much should a care plan cost?
Prices vary by site complexity, languages, store features and response hours. Compare scope before price. A cheap plan that excludes staging, restore tests and incident work is not cheaper after the first outage. Ask for line items, not only a single number.
### Can my developer just "keep an eye on it" without a plan?
Informal watching fails when the developer is busy shipping other projects. If you trust a developer, put the cadence, backups and response rules in a short written plan anyway. Care is a process, not a vibe.
### What should I do before switching care providers?
Export a full backup, list all admin users, confirm you own hosting and domain logins, rotate passwords after the old vendor's access ends, and ask the new provider for a kickoff inventory. Keep the old backup offline until the new restore path is proven. If the old developer still holds those logins and has stopped replying, follow our [WordPress website takeover](https://heshamsaad.com/en/wordpress-website-takeover/) guide before the new provider starts.
## Your next step
Write one page that lists your stack (hosting, PHP version if known, WooCommerce or not, languages), your worst recent incident, and the hours you need covered. Send that page to every vendor and compare their answers on updates, backups, staging and severity response. If you want a clear scope from our team, [book a free consultation](https://heshamsaad.com/en/free-consultation/) and bring any proposals you already have. We will tell you what belongs in care versus what needs a separate fix project.
When you are ready for ongoing updates and support rather than another DIY reminder, return to the [WordPress care plan](https://heshamsaad.com/en/sitecare/) service page and share your stack notes. Calm sites are not lucky. They are maintained on a schedule with an owner who answers when something breaks.
## References
- [WordPress Documentation: Updating WordPress](https://wordpress.org/documentation/article/updating-wordpress/)
- [WordPress Documentation: Dashboard Updates Screen](https://wordpress.org/documentation/article/dashboard-updates-screen/)
- [WordPress Documentation: Managing Plugins](https://wordpress.org/documentation/article/manage-plugins/)
- [WordPress Documentation: Appearance Themes Screen](https://wordpress.org/documentation/article/appearance-themes-screen/)
- [WordPress Documentation: WordPress Backups](https://wordpress.org/documentation/article/wordpress-backups/)
- [WordPress Documentation: Restoring Your Database From Backup](https://wordpress.org/documentation/article/restoring-your-database-from-backup/)
- [WordPress Documentation: Site Health Screen](https://wordpress.org/documentation/article/site-health-screen/)
- [WordPress Documentation: HTTPS for WordPress](https://wordpress.org/documentation/article/https-for-wordpress/)
- [WordPress Documentation: Roles and Capabilities](https://wordpress.org/documentation/article/roles-and-capabilities/)
- [WordPress Documentation: FAQ My Site Was Hacked](https://wordpress.org/documentation/article/faq-my-site-was-hacked/)
- [WordPress Advanced Administration: Hardening WordPress](https://developer.wordpress.org/advanced-administration/security/hardening/)
- [WordPress Advanced Administration: Upgrading WordPress](https://developer.wordpress.org/advanced-administration/upgrade/upgrading/)
- [WordPress Advanced Administration: HTTPS](https://developer.wordpress.org/advanced-administration/security/https/)
- [WordPress.org: Security](https://wordpress.org/about/security/)
- [WordPress Hosting Handbook: Server Environment](https://make.wordpress.org/hosting/handbook/server-environment/)
- [web.dev: Web Vitals](https://web.dev/articles/vitals)
- [web.dev: Largest Contentful Paint](https://web.dev/articles/lcp)
- [web.dev: Interaction to Next Paint](https://web.dev/articles/inp)
- [web.dev: Cumulative Layout Shift](https://web.dev/articles/cls)
- [Google Search Central: SEO Starter Guide](https://developers.google.com/search/docs/fundamentals/seo-starter-guide)