The arithmetic nobody does
A care plan costs a fixed amount per month. Not having one costs nothing per month, right up until it costs a great deal in one go. Because the two costs arrive so differently, one as a small recurring line and the other as an occasional crisis, they are rarely compared. Here are three sites where we can compare them, because we did the rescue and know what it cost.
Details are changed. The numbers are representative.
Site one: the physiotherapy clinic
The site. A WordPress site built in 2021 by a freelancer who then moved abroad. Booking through an embedded tool. Around twenty plugins, a premium theme, on shared hosting at a few dollars a month. Untouched since launch except for content edits.
What went wrong. In year three the host upgraded PHP without warning. The theme, two versions behind and never updated, threw a fatal error. The site was a white screen for four days before anyone at the clinic checked it; they found out from a patient. The freelancer was unreachable. Restoring the host's backup put back the same broken theme.
The recovery. A diagnosis, an emergency fix to get the site up on an older PHP version, then a project to update the theme (which required a child theme to preserve the customisations that had been made to the parent), update or replace nine plugins, three of them abandoned, and move to managed hosting with staging. The booking embed also needed re-doing because the tool had changed its code.
Cost. Four days offline for a clinic that books most new patients through the site: at their volume, roughly fifteen lost new-patient bookings, each worth several visits. Plus the recovery work at around two and a half days of developer time. Plus the owner's time and stress.
What a care plan would have cost. Three years on the entry tier: roughly a third of the recovery cost, with the PHP change caught on staging, the theme kept current and the outage never happening.
Site two: the wedding venue
The site. A page-builder site with a large photo gallery, built by an agency the venue stopped paying after launch. The agency kept the hosting and domain in its own name.
What went wrong. Nothing dramatic for two years, except drift: the gallery grew to several hundred uncompressed photos, the site slowed to six seconds on mobile, and enquiries fell steadily while the owner blamed the market. Then the agency closed. The domain renewal, on the agency's card, failed. The site and the venue's email went offline eleven days before the peak enquiry season.
The recovery. Recovering the domain from the registrar's grace period, which required proving ownership without the account holder, took a week and a redemption fee several times the normal renewal. New hosting, a full rebuild of the site from a crawl because no backup existed, compression of every image, and a new email setup.
Cost. Eleven days offline in the run-up to the season, with email down, which the owner estimates cost several bookings at a venue where each booking is a five-figure sum. Plus the domain redemption fee. Plus roughly a week of developer time.
What a care plan would have cost. Two years on a mid tier: a small fraction of a single lost booking. The domain would have been in the venue's name from onboarding, the renewals on a calendar, the images compressed as they were uploaded, and the slow decline in enquiries flagged by the speed monitoring in month three.
Site three: the accountancy practice
The site. A small, tidy WordPress site. Contact form, services, team page. Built by a competent developer, on decent hosting, and left alone for four years because "it just works".
What went wrong. It was hacked. A contact form plugin with a known vulnerability, unpatched for eighteen months, was exploited. The attackers added hidden pages selling counterfeit goods and a redirect that sent mobile visitors from search to a scam site. Google flagged the site as hacked in search results. The practice found out when a client asked why their website was selling handbags.
The recovery. Clean-up of the injected files and database entries, removal of the backdoor, a full security review, updates of everything, a request to Google to review and lift the warning, and two weeks of watching to confirm it was clean. The redirect had been live for an estimated five weeks before discovery.
Cost. Five weeks of mobile visitors from search being sent to a scam, with the practice's name attached. The Google "this site may be hacked" label in results for about three weeks. Two days of developer time. And a reputational cost that does not have a number, at a firm whose business is trust.
What a care plan would have cost. Four years on the entry tier: comparable to the clean-up alone, before counting the five weeks. The vulnerable plugin would have been updated within days of the patch, the daily scan would have caught the injection within a day rather than five weeks, and the firewall would likely have blocked the exploit attempt in the first place.
The pattern
In all three, the site was fine for a long time, and then it was not, and the moment it was not was expensive in a way that had nothing to do with the cost of the fix. The offline days, the lost enquiries, the scam redirect: those are the real costs, and they scale with how long the problem runs unnoticed.
A care plan is not mostly about the updates. It is about someone noticing on day one instead of day thirty. That is what the monthly fee buys, and across these three sites, the fee for the whole period was less than the recovery on each of them. If your site "just works" and nobody has looked at it for a year, that is the conversation to have before it stops working, not after.