A WordPress care plan keeps a site maintained: updates, backups, an uptime check and a monthly report, usually for a flat fee. Managed operations takes responsibility for the site when production breaks, with a written response commitment, diagnosis and a review afterwards. A care plan is enough for many sites. A site that carries real revenue or leads needs to know which of the two it is paying for before the next outage.
The difference shows most clearly on the worst day of the year. This guide starts with scope and ends with a checklist for a provider call.
What does a WordPress care plan usually include?
A WordPress care plan, also sold as a WordPress maintenance plan or maintenance service, is a recurring service that performs upkeep on a schedule. Freelancers, agencies and specialist maintenance companies sell them. A typical plan includes:
- Core, plugin and theme updates, applied weekly or monthly.
- Scheduled backups.
- An uptime check that emails or texts the maintainer when the home page stops responding.
- A malware or vulnerability scan.
- A monthly report listing what was updated.
- A small block of time for content edits or minor fixes.
This is useful work. Plugins that go unpatched are a common way into WordPress sites, and a plan that applies updates on a cadence reduces that risk. For a brochure site or a small blog, a good care plan from a responsive maintainer covers much of what is likely to go wrong.
Managed operations is a different service. An operations provider takes responsibility for how a production environment runs. That includes monitoring a person reads, incident response graded by severity, a release process with rollback, backups with restore tests, and a written account of serious incidents. The environment can be one site or many, on almost any host.
Where does a care plan stop?
A care plan is built around tasks done on a schedule. Managed operations is built around outcomes when something goes wrong. The table below shows where the two usually diverge. Individual providers vary, so treat it as a list of questions, not a verdict on any one plan.
| Area | Typical care plan | Managed operations |
|---|---|---|
| Updates | Applied on a schedule, sometimes with a visual check | Staged first, applied in a window, with a rollback path |
| Backups | Taken on a schedule | Taken on a schedule and restored as a test, with a record |
| Monitoring | Home page uptime check that alerts the maintainer | Checks on key flows such as login, forms and checkout, read by an on-call person |
| Outside office hours | Best effort, when the maintainer sees the alert | Covered on plans that include incident coverage |
| Response time | Rarely written down | Acknowledged response per severity level, written into the agreement |
| Diagnosis | Time-boxed, often billed as extra hours | Part of incident response, up to the boundary of the application code |
| Server and hosting layer | Usually the host’s responsibility | Operated, or coordinated with the host |
| After a serious incident | An email explaining what happened | A written review with root cause and follow-ups, where in scope |
Three terms in that table are worth defining. A severity level ranks an incident by business impact, for example “production down” versus “degraded”. An acknowledged response means a person has received the incident, confirmed it and started work, which is different from an automated receipt. An SLA, or service level agreement, is the contract that states those response commitments and what happens when they are missed. The knowledge base explains how to write a severity bar a non-engineer can read.
The care-plan column reflects what a flat monthly fee can fund. That fee is rarely sized to keep someone awake at 2 a.m. for every client, and not every site needs that.
The three moments a care plan stops being enough
Three events tend to force the question of moving from a care plan to managed operations.
An outage the plan did not cover. The uptime check fired on a Saturday evening. The maintainer saw it on Monday. Or the home page stayed up while checkout failed, and the check only watched the home page. Nobody broke the agreement, because the agreement never promised a response at that hour. The article on the cost of downtime and how much resilience to buy helps put a figure on that weekend.
A security incident. A plugin vulnerability was exploited between two update cycles, or a compromised admin account started adding spam pages. Cleaning malware may be in the plan. Containing the incident, preserving evidence and finding how the attacker got in often is not. The knowledge base outlines the first 60 minutes of a WordPress incident, which shows how much work sits outside a routine cleanup.
Growth past a single small site. The business now runs a store, a members’ area, several language sites or a campaign calendar. Updates that were safe on a brochure site now risk breaking checkout. One maintainer is watching more surface than one person can cover. In one example scenario, a national publisher replatformed from a single VPS to managed WordPress operations, and the scenario notes that afterwards “their developer stopped being on call. Plugin updates stopped being a Friday-evening exercise.”
If none of these has happened and none is likely, a care plan may be all the site needs.
What does each option cost in money, time and risk?
The two services are priced in different ways, so compare what drives the price rather than the monthly invoice.
A care plan is usually a flat monthly fee per site, sometimes tiered by update frequency, backup retention or included hours. The cost is predictable. The risk is what sits outside the scope: emergency work billed as extra hours, or a maintainer who is unavailable when the site fails.
Managed operations is usually a monthly retainer scoped to the environment. The drivers are the coverage window (business hours, extended or around the clock), the response commitment per severity, the number of sites and environments, traffic, release cadence and how many developers ship changes. Coverage is a driver buyers often underestimate, because round-the-clock response needs a staffed rotation. A site whose customers sleep when you do may only need business-hours coverage. The article on how managed cloud hosting is priced walks through these drivers.
Time matters too. A care plan asks little of you. Managed operations asks for an onboarding period, access to the host, agreed severity definitions and a contact who can make decisions during an incident.
Lock-in is worth checking for both. Ask either provider what you keep if you leave: backups, credentials, documentation and any runbooks written for your site.
When is a care plan the right choice?
A care plan is the better purchase, and managed operations is the wrong one, when these conditions hold:
- The site is a brochure, portfolio or small blog, and an hour of downtime is an inconvenience rather than lost sales or leads.
- Traffic is steady and the plugin set is small and common.
- Visitors are mostly awake when the maintainer is, so an overnight outage reaches few people.
- The maintainer answers within a time you are comfortable with, and has done so in past incidents.
- The budget for the site’s upkeep would not cover an operations retainer, and the risk does not justify one.
Managed operations is also the wrong purchase when what you need is development. An operations provider does not build features or fix defects in your theme or custom plugins. Those stay with your developer or agency. If you want a person to make content changes and small layout fixes each month, a care plan or a development retainer fits better.
What should agencies resell: care plans, operations, or both?
Agencies sell care plans because clients understand them and the revenue recurs. The difficulty starts when the agency’s senior developer becomes the escalation path for every client site. In one example scenario, an agency running fourteen client sites found that one developer’s personal phone was effectively the escalation path for all of them. The agency’s portfolio consolidation case study describes what changed once a support model was in place.
An agency has three workable models:
| Model | Choose it when | Watch for |
|---|---|---|
| Care plans run in-house | A small portfolio of similar sites, no written response promises to clients | Senior developer time drifting into hosting tickets |
| Care plans in-house, operations partner behind them | Some clients need after-hours response and the agency wants to keep the relationship | The scope split between agency and partner must be written down |
| Refer clients directly to an operations provider | The agency does not want to be in the hosting business | The client relationship for hosting moves outside the agency |
The middle model lets the agency keep selling the care plan it already has. The partner carries the pager, and the agency keeps building. The article on hosting for agencies managing multiple WordPress sites compares agency hosting models on margin and risk. The knowledge base covers managing WordPress updates across a fleet of sites for agencies that keep updates in-house.
Questions to ask a care-plan provider or an operations provider
Take these into the call. They work for a freelancer, a maintenance company or a managed operations provider.
- What exactly is in scope, and what is billed as extra? Ask for the list in writing.
- What happens when the site goes down at 9 p.m. on a Saturday? Who sees the alert, and when?
- Are there severity levels, and is there a written acknowledged-response time for each?
- Is the response time a commitment or a target, and what happens if it is missed?
- Do you monitor checkout, forms or login, or only the home page?
- When did you last restore one of our backups as a test? Can we see the record? The knowledge base explains how to verify that a WordPress backup is restorable.
- How is a bad plugin update rolled back, and how long does that take?
- If the site is hacked, what do you do, and what is outside your scope?
- After a serious incident, what do we receive in writing?
- What do we keep if we leave?
The knowledge base article on the clauses that decide whether enterprise WordPress support works goes deeper on questions 1 to 4. The blog’s guide to managed WordPress hosting versus managed WordPress operations covers the related question of whether the host or the operator is the gap.
Where Stack Harbor fits
Stack Harbor is a Canadian-owned managed cloud operations provider (MSP) for production environments, headquartered in Montréal. It serves businesses and agencies of roughly 5 to 200 people that run production systems without a 24/7 operations team of their own.
Its Enterprise WordPress engagements are scoped from a list covering architecture, operations, migration and support, and the client does not pay for every item. A hosting move is not required: if the current host works, Stack Harbor can operate the environment around it. It does not replace developers or an agency. Day-to-day work flows through the support desk, and a senior engineer owns Severity 1 incidents.
For ongoing coverage, Managed Cloud Ops puts the coverage window, response SLA, monitored assets and monthly project hours in a written, signed scope. On plans that include incident coverage, the service level agreement commits to an acknowledged response within 15 minutes for Severity 1 and 60 minutes for Severity 2, around the clock. Resolution is a target, not a commitment. Occasional or one-off work fits the Management, Monitoring & Support service better than a retainer.
For agencies, the Agency Infrastructure engagement is white-label by default, puts on-call with Stack Harbor rather than the agency’s senior developer, and includes help with care-plan structure and retainer packaging. Stack Harbor publishes no prices. Each engagement gets a fixed quote for a written scope after an assessment, as described on how Stack Harbor scopes and prices.
If your last outage happened outside your care plan’s hours, describe your WordPress site to Stack Harbor. If your site fits the care-plan conditions above, keep the plan and the maintainer you trust.
