What should a website care plan include?
A real care plan covers hosting, domain and DNS, SSL renewal with expiry monitoring, backups you have tested restoring, security patching, uptime checks that alert a human, and a defined amount of content-edit time. Ours are $79/month, or $149/month with priority response and larger monthly changes. The parts most often missing are DNS, alerting that actually reaches someone, and a written response time.
“Maintenance” is the vaguest line item in this industry. It can mean a genuine operational commitment or it can mean a plugin-update script and an invoice. The difference only becomes visible on the day something breaks, which is a bad day to discover which one you bought.
Rather than list best practice in the abstract, here are three things that actually went wrong on sites we now run, each of which a care plan is supposed to prevent.
Three real failures, and what should have caught them
1. A TLS certificate that expired and kept serving
One domain we took over was serving a Let’s Encrypt certificate that had expired on 16 March 2025. Every visitor arriving at it got a full-page browser security warning instead of a website. Nobody had noticed, because nothing was watching and the site did not go “down” — it went untrusted, which looks fine to an uptime checker that only reads a status code.
What catches it: certificate expiry monitoring with a threshold measured in weeks, not hours, and an alert that reaches a person. Ask specifically whether SSL expiry is monitored. “We have SSL” is not an answer to that question.
2. A DNS apex pointing at two places at once
The same domain had an apex record with two targets — one at a new host, one at the old CDN — left behind by a migration somebody started and never finished. The old CDN won every request, which is why the expired certificate above was the one being served. The `www` subdomain had never been moved at all.
What catches it: whoever maintains the site holding, or at least reading, DNS. This is the single most common gap in maintenance contracts. Hosting is included, the domain sits in an account nobody can find, and DNS belongs to no one.
3. Pages that are live but not indexed
On another site we run, 29 of 188 known pages are indexed. The rest are mostly “discovered, currently not indexed”. Nothing is broken in any way a person clicking around would notice — the pages load fine. They simply earn nothing, and had no one been reading the coverage report they would have gone on earning nothing indefinitely.
What catches it: somebody reading Search Console monthly and reporting what it says, including when it says something unflattering.
The checklist worth demanding
- Hosting, with the plan and region stated — not “premium hosting”.
- Domain and DNS management, explicitly, including who holds the registrar login.
- SSL renewal AND expiry monitoring. These are two separate commitments.
- Backups with a stated frequency, retention, and — the part nobody tests — a restore that has actually been performed.
- Security and dependency patching, with a stated cadence.
- Uptime monitoring that alerts a human, not a dashboard nobody opens.
- A defined quantity of content-edit time per month, and whether it rolls over.
- A written response time. “Best effort” is a real answer, but it should be on paper.
- Search Console and analytics access in your name, not the agency’s.
What it costs, including ours
| Plan | Price | What it is for |
|---|---|---|
| Care | $79/month | Hosting, domain, SSL, backups, patching, uptime monitoring, content edits up to 2 hours a month rolling to a 6-hour cap |
| Care+ | $149/month | As Care, with priority response and larger monthly changes |
| Elixir Presence | $599/month | The bundle: website built at no upfront cost, plus hosting, maintenance and search + AI visibility |
We publish these because a maintenance quote that requires a phone call is usually a quote that varies by how wealthy you sound. Whatever you end up paying, the useful test is whether the list above is written down anywhere.
The parts that are usually missing
In our experience the gaps cluster in three places, and none of them are the ones people ask about.
- DNS. Included in almost no maintenance contract and responsible for a disproportionate share of total outages.
- Alerting. Plenty of setups measure uptime and certificates. Far fewer deliver that measurement to a human who will act on it. Monitoring that writes to a log nobody reads is not monitoring.
- Reporting that can say bad news. If every monthly report says everything is fine, it is not a report.
We are not neutral here — we sell these plans. But every failure described above happened on infrastructure we are responsible for, and we have written each one up in our own error log rather than quietly fixing it. That is the standard worth holding any supplier to, including us.