Layer 1 — Core protection checklist
These are the basics every business site should expect. They are necessary but, on their own, not sufficient.
- WordPress core, theme, and plugin updates — tested, not blindly auto-applied.
- Off-site backups with a tested restore path.
- Uptime monitoring with a real response when alerts fire.
- Security scanning, hardening, and malware cleanup support.
- Emergency rollback for a broken update.
Layer 2 — Business-path checklist
This is the layer cheap plans skip. The provider should understand how your site actually creates value and protect those paths specifically.
- Lead forms submit and the emails actually deliver.
- Checkout keeps working after plugin and theme changes.
- Booking or membership access stays reliable.
- Transactional emails are tested when something changes.
- Money pages stay fast enough that customers do not bounce.
Layer 3 — Support scope checklist
Look for plain scope language. You should know, before buying, whether content edits, plugin setup, layout fixes, WooCommerce support, and urgent repairs are included — and how fast urgent, customer-impacting issues are handled. Vague “unlimited support” usually means undefined support. The plan should read like a clear support retainer, not a marketing promise.
Thin plan vs serious plan
Run any plan through the three layers. This is where the difference shows.
| Layer | Thin plan | Serious plan |
|---|---|---|
| Core protection | Auto-updates, backups exist. | Tested updates, restore-tested backups, rollback. |
| Customer paths | Not mentioned. | Forms, checkout, login, email explicitly covered. |
| Support | “Unlimited” but undefined. | Plain scope + urgent response terms. |
| Security | A scanner plugin. | Hardening, monitoring, cleanup that fixes the cause. |
| When it shows | Looks fine until an incident. | Catches problems before customers do. |
How to use this checklist
Score any plan you are considering against the three layers, then decide.
If a plan only passes Layer 1, keep looking
Updates and backups alone are not a care plan for a business site. If the customer-path and support layers are missing, you have bought monitoring, not protection.
Match the depth to your site
A brochure site can lean on Layers 1 and a light Layer 3; a store needs all three plus explicit WooCommerce coverage. See care plan examples for site-type guidance.
Get the scope in writing before you buy
Backup frequency, restore testing, what counts as a covered task, and urgent response times should be written down — not implied in a sales call.
Checklist mistakes buyers make
- Stopping at Layer 1 and assuming updates plus backups equal a care plan.
- Accepting “unlimited support” without a written scope.
- Not asking whether backups are restore-tested.
- Ignoring whether the plan names your specific customer paths.
- Comparing on monthly price instead of on coverage and response.
What we’d check first
In our experience, the fastest way to judge a care plan is to ignore the feature list and ask two questions: “What happens to my checkout/forms after an update?” and “Who fixes the site at 1am, how fast?” A plan that answers those plainly has the customer-path and support layers covered; one that retreats into generic feature-speak does not. The boring Layer-1 stuff is necessary, but the answer to those two questions is what actually predicts whether the site survives a bad day.
- Judge plans on all three layers, not just updates and backups.
- Insist the customer paths are named explicitly.
- Confirm backups are restore-tested and scope is written down.
- Weight response time on urgent issues heavily.
Frequently asked questions.
What is missing from most cheap care plans?
Usually the second and third layers: real human support, restore testing, malware cleanup that fixes the cause, tested updates, and checks for the actual customer paths. Cheap plans tend to automate Layer 1 and quietly skip the parts that matter in a crisis.
Can this checklist be used by agencies?
Yes. Agencies can use the same three-layer checklist to decide what to deliver in-house, what to white-label, and how to scope client plans — see agency care-plan pricing.
How do I know if a plan covers my customer paths?
Ask directly: does it test my checkout after updates, confirm my forms deliver, protect my member logins or bookings? If the plan only talks about updates, backups, and uptime, assume the customer-path layer is not covered.
Should everything be in writing?
Yes. Backup frequency and restore testing, what counts as a covered task versus project work, and response times for urgent issues should all be written into the plan. Anything left to a verbal promise tends to evaporate during an incident.
Research sources.
This guide was checked against current platform and search documentation before publication.