Website Care & Maintenance: WordPress Care Plans, Nationwide

Website care and maintenance: keeping the site you paid for healthy, fast and secure

A website is not a finished object you buy once and hang on a wall — it is live software that runs every hour of every day on a server you do not control, built on a stack of code (WordPress core, a theme, a dozen or more plugins, PHP and a database) that all keep changing underneath it. Website care and maintenance is the ongoing work of keeping that software updated, secure, backed up, monitored and fast after launch, so the site you invested in keeps earning its keep instead of quietly rotting.

EVOTECH IT LLC provides website care and maintenance plans nationwide, from a US-based, remote-first team with more than 20 years of experience and a 5.0-star rating. We look after WordPress sites in particular — the platform behind a large share of the web — handling the updates, security patching, backups, uptime monitoring, content edits and performance tuning that most owners have neither the time nor the appetite to do themselves.

Building a site and caring for a site are two different jobs. If you still need the site itself, that is design and build work — see our web design and business websites pages. This page is about everything that happens after launch: the unglamorous, essential maintenance that keeps a live site healthy. Below is a straight, no-jargon guide to what that work involves, how we do it, and how to judge any care plan — including ours.

What a website care plan actually includes

Care plan is a vague phrase until you see the actual checklist. A real plan is a defined set of recurring tasks with someone accountable for each one — not a monthly charge for nothing. Here is what every EVOTECH website care plan covers:

• Software updates. WordPress core, theme and plugin updates, applied on a schedule after testing — not blindly auto-updated and not left to pile up for a year.
• Security patching & hardening. Fast application of security releases, plus login protection, file-permission hygiene and a web application firewall to cut down on attacks.
• Automated off-site backups. Regular full backups of files and database, stored away from your server, with retention and tested restores — because a backup you have never restored is not a disaster plan.
• Uptime & SSL monitoring. Round-the-clock checks that your site is online and your SSL certificate is valid, with alerts the moment something goes down.
• Performance tuning. Caching, image optimization, database cleanup and Core Web Vitals work so pages stay fast as content grows.
• Malware scanning & cleanup. Regular scans for injected code and, on covered plans, cleanup and reinstatement if the worst happens.
• Content edits & support. A monthly allotment of hands-on time for the text, image, page and small-feature changes every living site needs.
• Plain-English reporting. A periodic report of what was updated, what was held, backups taken and uptime — so you can see the value, not just trust it.

What a care plan is not is a blank cheque for unlimited redesigns or brand-new features. Large new pages, redesigns and custom development are quoted separately as fixed-scope projects. The plan keeps your existing site healthy; new construction is its own job.

Why an unmaintained website slows down, breaks, or gets hacked

It is tempting to treat a website like a printed brochure: pay once, and it just sits there. Software does not work that way. Left alone, a site does not stay the same — it slowly drifts toward broken. Here is what actually goes wrong.

Security holes open faster than you would think

Most WordPress sites are broken into not by a targeted hacker but by automated bots that scan the whole internet for known, already-patched vulnerabilities in outdated plugins and themes. When a plugin publishes a security fix, it effectively publishes a map of the hole to everyone who has not updated yet. Every week you skip updates widens that window.

Small breakages compound

A plugin author abandons their plugin. Your host upgrades PHP. A theme update changes a function another plugin relied on. Individually these are minor; together, over a year of no maintenance, they turn into a contact form that silently stops emailing you leads, a checkout that throws an error, or a layout that collapses on phones.

Speed decays

Databases bloat with old revisions, spam and orphaned data. Images get uploaded full-size. Plugins accumulate. The site that loaded in two seconds at launch is taking six a year later — and visitors leave before it finishes. Keeping a site fast is maintenance, not a one-time setting.

No backup means no recovery

The day a site is hacked, a bad update white-screens it, or a well-meaning edit deletes a page, the only thing that saves you is a recent, tested, off-site backup. Discovering you do not have one — or that the backup will not restore — is how a bad afternoon becomes a lost website and weeks of rebuilding.

Updates and security patching, done the safe way

Applying updates sounds trivial — click the button. The reason businesses pay for it is that clicking the button on a live site, with no testing and no plan, is exactly how sites break. Our process gets the security benefit of staying current without the risk of a bad update taking your site down.

What we keep updated

• WordPress core — major and minor releases, including the security-only point releases that must go on fast.
• Plugins — usually the largest source of both features and vulnerabilities on a WordPress site.
• Themes — including the parent theme behind a child theme.
• PHP compatibility — when your host moves to a newer PHP version, we confirm your plugins and theme are ready first, so the upgrade does not white-screen the site.

Tested before it touches your live site

On covered plans we apply and check updates on a staging copy first — a private duplicate of your site — then push to live once we have confirmed the key pages, forms and checkout still work. Where a plugin update is known to be breaking, we hold it, tell you why, and find a safe path rather than blindly applying it.

Security releases jump the queue

Routine feature updates follow the regular schedule. A patch for an actively exploited vulnerability does not wait — it goes on as soon as we have verified it, because in that case the risk of waiting outweighs the risk of updating.

This is deliberately different from switching on blanket auto-updates, which is fast but unattended. When an auto-update breaks something at 2am, no one is watching, and your customers find the error before you do. Tested, monitored updates are the whole point of paying for care.

Backups and disaster recovery: the 3-2-1 rule

Backups are the single most important part of any care plan, because they are the one thing that can undo every other disaster — a hack, a bad update, a server failure, or plain human error. A care plan without solid backups is a car without a spare tyre.

The 3-2-1 rule

The backup standard we follow is simple: three copies of your data, on two different types of storage, with at least one copy kept off-site — away from the server the live site runs on. That last point matters most. A backup stored only on the same server as your website disappears with the server: if the box dies or the hosting account is compromised, the on-server backup dies with it.

What we back up, and how often

A complete backup is both your files (WordPress, theme, plugins, uploaded images and documents) and your database (pages, posts, settings, orders and users). For most business sites we run daily backups; for busy eCommerce or membership sites that change by the hour, we back up more frequently so a restore never costs you a day of orders. We keep a rolling history, so you can roll back to a known-good point, not just to yesterday.

Restores are tested, not assumed

A backup you have never restored is a guess. We verify that backups actually restore, so on the day you need one it is a fifteen-minute fix rather than the discovery that the backups were corrupt all along. And because the copies live off-site, we can rebuild your site even when the hosting account itself is the thing that failed.

Uptime monitoring and how we respond when a site goes down

You should never learn that your website is down from a customer, a lost sale, or a drop in traffic you notice a week later. Uptime monitoring is how we find out first.

Round-the-clock checks

We monitor covered sites from outside your server, on a short interval, 24 hours a day. If the site stops responding, returns an error, or its SSL certificate is about to expire or has broken, the system alerts us immediately. Expiring SSL is a common, avoidable outage — browsers throw a scary security warning and visitors flee — and it is entirely preventable with monitoring.

What we watch

• Is the site up and returning a normal page, not an error or a blank white screen.
• Is it responding fast — a sudden slowdown often warns of a problem before a full outage.
• Is the SSL certificate valid and not about to lapse.
• Is it still your site — watching for defacement or unexpected changes to key pages.

When something breaks

An alert is only useful if someone acts on it. When a monitored site goes down, we investigate the cause — a failed update, a host outage, a traffic spike, an expired certificate, or an attack — and either fix it or, if it is your hosting provider’s fault, escalate to them with the specifics they need to move quickly. Because we keep tested off-site backups, even a serious failure has a fast, proven path back to a working site.

Performance tuning and Core Web Vitals

Speed is not vanity. Google uses page experience as a ranking input, and every extra second of load time measurably increases the share of visitors who give up and leave. Performance tuning keeps your site fast as it grows — which, left unmaintained, it will not stay.

Core Web Vitals

Core Web Vitals are Google’s public, measurable yardstick for how a page feels to a real visitor: how quickly the main content appears (Largest Contentful Paint), how fast the page responds to a tap or click (Interaction to Next Paint), and how much the layout jumps around while loading (Cumulative Layout Shift). We measure these on your real pages and work to keep them in the good range.

What actually moves the needle

• Caching so repeat visitors and repeated requests are served instantly instead of rebuilt from scratch every time.
• Image optimization — compressing and correctly sizing images, which are the single biggest cause of slow pages, and serving modern formats.
• Database cleanup — clearing the revisions, transients and spam that bloat a database over time.
• Reducing plugin bloat — removing or replacing heavy or redundant plugins that load scripts on every page.
• A content delivery network (CDN) where it helps, so visitors are served from a location near them.

Performance and search visibility overlap, but they are not the same job. Care keeps the site technically fast and healthy; turning that speed into higher rankings and traffic is the domain of technical SEO, which builds on a fast, well-maintained foundation rather than replacing it.

Security hardening, malware scanning and cleanup

Security is not one product you install; it is layers, plus the discipline to keep them current. Most compromises exploit the boring basics — an outdated plugin, a weak password, an unprotected login page — so that is where care earns its money.

Hardening the basics

• Login protection — limiting failed login attempts to stop brute-force bots, and encouraging strong credentials and two-factor authentication for admins.
• A web application firewall (WAF) that blocks known malicious traffic before it ever reaches WordPress.
• Correct file and folder permissions, disabling risky file-editing from inside the dashboard, and removing unused plugins and themes that are just extra attack surface.
• Forced HTTPS with a valid SSL certificate on every page.

Scanning and cleanup

We scan covered sites for malware and for the tell-tale signs of a compromise — injected spam links, unknown admin users, modified core files, unexpected redirects. Catching these early, before Google flags your site or your host suspends it, is the whole point. On plans that include cleanup, if a site is compromised we remove the malicious code, close the hole that let it in, restore from a clean backup, and then harden so it does not recur.

Honest limits

No one can promise a site will never be attacked; anyone who does is selling something. What a real care plan promises is that your attack surface is kept small, problems are caught fast, and a clean, tested backup means an incident is a setback you recover from — not the end of your website.

Content edits and ongoing support: what counts and how fast

Every living website needs small changes: update the hours, swap a photo, add a team member, publish a new service page, fix a typo, change a price, put up a seasonal banner. A care plan includes a monthly block of hands-on time for exactly this, so you are neither learning WordPress yourself nor paying for a fresh quote every time you need a five-minute change.

What counts as an edit

The kinds of changes covered by care-plan support time include:

• Text changes — updating copy, prices, hours, contact details and staff bios.
• Image and media swaps — replacing photos, adding a gallery, updating a PDF or menu.
• Adding or editing pages and posts, and basic on-page formatting.
• Small functional tweaks — a new form field, a menu change, a plugin setting.
• Publishing content you have written, and troubleshooting the odd thing that misbehaves.

Where an edit becomes a project

The line we draw is honest: editing the site you have is a care-plan edit; building something substantially new is a project. A full redesign, a brand-new online store, a custom feature or a large batch of new pages is scoped and quoted separately — see web design or a new business website. This keeps the plan predictable and stops big work from quietly eating the small-edit time you are paying for.

How fast

We handle routine edits within a defined turnaround and tell you honestly when a request is bigger than the plan covers. If something is genuinely urgent — a wrong price live on the site, an event this weekend — say so, and we prioritise it.

Our website care process, step by step

A good care plan is boring in the best way — a predictable rhythm you never have to think about. Here is how ours works, from the first call to the ongoing cycle.

1. Free consultation. We talk by phone or video about your site, your platform, your traffic and what has gone wrong before. There is no charge and no obligation, and you get a clear, fixed-scope quote — never a vague open meter or an invented number.
2. Onboarding audit. Before we take responsibility for a site, we review it: current WordPress, plugin and theme versions, existing backups, security posture, performance, and anything already broken. You get an honest picture of its condition.
3. Baseline & safety net. We take a full off-site backup, set up monitoring, close any glaring security holes, and get the site to a known-good, recoverable state before routine work begins.
4. The ongoing cycle. On a regular schedule we test and apply updates, verify backups, review scans and monitoring, tune performance, and apply your content edits.
5. Reporting. You receive a plain-English report of what was done — updates applied or held, backups taken, uptime, and edits completed — so the value is visible, not assumed.
6. We are a call away. Between cycles, if something breaks or you need a change, reach us at (832) 359-2425 or through your plan. Same team, no ticket lottery, no offshore queue.

Care plan options: comparing coverage levels

Not every site needs the same level of care. A five-page brochure site that changes twice a year has very different needs from a busy online store taking orders around the clock. We fit the plan to the site rather than selling one size to everyone. The comparison below shows how coverage typically scales.

The right level is usually obvious once we look at how often your site changes and how much you would lose if it went down for a day. A restaurant site that lists a menu mostly needs reliability and speed; a store that takes payments needs frequent backups and fast security response, because an outage or a compromise costs real orders and hard-won customer trust. We recommend the lowest level that genuinely covers you — not the biggest — and you can move up or down as your site grows. Exact scope and pricing come as a fixed quote after a free consultation.

What affects the cost of a website care plan

We do not publish a single sticker price for website care, because the honest cost depends on your site — and anyone quoting a firm number before seeing it is guessing. After a free consultation we give you a fixed-scope quote you can rely on. The real drivers of cost are these.

• Platform and complexity. A simple brochure site takes less upkeep than a plugin-heavy site, an online store, or a membership platform with many moving parts.
• How often it changes. A site you update weekly needs more edit time and more frequent backups than one that changes twice a year.
• Traffic and stakes. A high-traffic or revenue-critical site needs tighter monitoring, faster response and more frequent backups, because downtime costs more per hour.
• Starting condition. A neglected site may need a one-time cleanup — updates caught up, bloat removed, security holes closed — before routine care begins. We tell you this up front rather than hiding it inside a vague retainer.
• Coverage level. Cleanup-if-hacked, staging and priority response cost more than basic monitoring and updates — you pick the level that fits.

It also helps to be clear about what you are choosing between. Doing it yourself, relying on your host alone, and a managed care plan are not the same thing:

Managed WordPress hosting is genuinely useful, and we work alongside it — but a good host keeps their servers healthy, not your specific site’s plugins, edits, performance and content. Those stay your responsibility, and that is exactly the gap a care plan fills.

Common website-maintenance mistakes (and how we prevent them)

Almost every website disaster traces back to one of a handful of avoidable mistakes. Knowing them helps you judge any care provider — including us.

1. Treating the site as finished at launch. The build is the beginning, not the end. A site with no owner and no maintenance plan is the one that gets hacked or breaks silently. Decide who is responsible for upkeep before you launch, not after the first incident.
2. Relying on unattended auto-updates. Blanket auto-updates beat never updating, but when one breaks the site at 2am nobody is watching, and customers find the error first. Tested, monitored updates are the point of a plan.
3. Keeping backups on the same server as the site. A backup that lives only on your hosting account vanishes if the account is hacked, suspended or fails. Off-site is not optional, and an untested backup is not really a backup.
4. Ignoring plugin sprawl. Every plugin is code that can break, slow the site, or open a hole. Sites accumulate plugins that were tried once and never removed. Fewer, well-chosen, maintained plugins beat a pile of abandoned ones.
5. No plan for the person who leaves. The freelancer who built the site moves on, the login is lost, and no one has the backups. Care means documented access, current credentials, and continuity that does not depend on one person’s memory.
6. Discovering there is no recovery plan during the emergency. The worst time to learn your backups do not restore is the day you need them. We test restores in advance, so a crisis becomes a routine fix instead of a catastrophe.

Related services

Frequently asked questions