What to include in a website care plan (with a checklist)
A usable website care plan checklist covering monitoring, security, updates, backups, reporting and support, so you can scope a plan clients trust.
A care plan is only as good as its scope. Too vague and the client argues about what is covered. Too thin and something important falls through. Here is a checklist you can use to scope a plan that clients trust, grouped the way a client thinks about it.
The website care plan checklist
Monitoring and uptime
- Uptime monitoring, so you know the moment a site goes down
- SSL certificate validity and expiry warnings
- Domain registration expiry, tracked independently of the registrar
- DNS change detection, so a wrong record is caught fast
- HTTP to HTTPS redirect, so visitors always land on the secure version
Security
- Security headers checked and kept in place
- Mixed content flagged, so the padlock stays intact
- A check for exposed platform and version information
- Form spam protection in place and working
SEO and discoverability
- Broken internal links found and fixed
- robots.txt and sitemap valid and current
- Canonical tags and meta tags present and sensible
- Social sharing metadata so shared links look right
- Server errors and bad responses caught
Email and deliverability
- SPF, DKIM and DMARC records present and healthy
- A check that the domain is not drifting towards the spam folder
Updates and backups
- Software, plugin and theme updates, where the stack needs them
- Regular backups, tested so they actually restore
- A staging step for risky updates
Privacy and compliance
- Cookie consent banner present where it is needed
- Tracking scripts gated behind consent, with the UK GDPR angle in mind
Reporting and support
- A branded monthly report with a health score and the fixes that mattered
- A clear response time for urgent issues
- A named point of contact
How to use the checklist
Not every plan needs every line. A small brochure site does not need the update and backup workflow a busy ecommerce site does. Use the checklist to decide what each tier covers, then write it into the plan in plain language so there is no argument later about what is included.
A few notes on scope. Updates and backups usually mean a maintenance tool tuned to the platform, so for WordPress sites that might be a dedicated tool sitting alongside your monitoring. Monitoring, security, SEO, email and reporting are stack-agnostic and can be covered by one tool across every client.
Janitor covers the monitoring, security, SEO, email, privacy and reporting lines on this list across any stack, and turns the result into the branded report that the reporting line asks for. Pair it with a maintenance tool if your plans include updates and backups.
Turn the checklist into a report
The last group, reporting, is the one that keeps the plan sold. Every item you monitor should show up in a monthly report the client can read, which is the subject of the next article: what to include in a website maintenance report, with a template.