Website Maintenance Plan: Packages a Web Agency Can Add With AI

A website maintenance plan should cover uptime monitoring, tested backups, scheduled updates with a way to roll back, security scans, a small bucket of content-edit time and a monthly report. AI speeds up the report, changelog reading and sorting client requests. Applying updates, restoring backups and fixing security problems still need a person.

The three published care-plan ladders I checked for one WordPress site run from $69 to $500 a month, and what separates the rungs is edit hours, backup frequency and response time, not the tools underneath. The agency below sells three tiers priced from its own costs. The sums show AI protecting margin rather than creating the business.

Follow me on Instagram@sagnikteaches

Twenty-eight sites and no plan: where this agency starts

Take a three-person web agency with 28 live client sites, all on WordPress, five of them small WooCommerce shops. There is no recurring plan. Updates happen when someone remembers, fixes are billed at $85 an hour when a client rings, and nobody can say which sites have a restore-tested backup. The clients include a yoga studio, a print shop with an online shop, a wedding planner and an IT support firm's brochure site, and each needs a slightly different check after an update.

Connect on LinkedInSagnik Bhattacharya

Everything about the agency, its minutes and its margins is illustrative. The tool prices and the three published plan ladders are real list prices, read from each provider's own page in early November 2026. The job, in order: stop surprise outages, put updates on a schedule, and turn unbilled goodwill into a monthly line. Hosting-company guides often frame maintenance as what the host provides. For an agency it is a promise about what you check, how fast you answer and what evidence the client sees each month.

Subscribe on YouTube@sagnikteaches

Three tiers: tasks, price bands and what published plans charge

The tiers are named for what the client gets. Prices are bands, because a shop or a plugin-heavy site belongs at the top of its band.

To see where those bands sit, here are three providers' published ladders for a single site. They are list prices from each provider's own page, not market averages.

My bands land close to those ladders: Steady near the $99 entry rungs, Managed between $169 and $249, Priority just under the $500 tops. The shared pattern is that updates, backups and monitoring appear from the entry rung, and what the upgrades sell is edit hours, backup frequency and response speed. Two design ideas are worth borrowing from FixRunner's page: a three-month minimum term, and unused support time that carries over, calculated quarterly. For the wider pricing logic behind packages and retainers, the guide to agency retainers and packages after AI covers how to explain deliverables rather than hours.

What each site costs to run, with and without AI-assisted routines

Start with the tooling, because it is the smallest line. WP Umbrella lists $2.19 per site per month, with backups, bulk safe updates with rollback, uptime and other monitoring and white-label client reports in the base price, and a $2 security add-on. For 28 sites that is $61 a month, or $117 with security. ManageWP prices each add-on per site: $2 for backups and $1 each for the uptime monitor, security check, performance check, link monitor and advanced client reports, which is $196 a month across 28 sites. Its page also lists bundles for agencies with more than 25 sites, including an all-in-one package at $150 a month covering up to 100 sites. MainWP Pro covers unlimited sites for $29 a month, or a yearly price listed at $199 that its page showed reduced to $149 when I checked in November 2026.

Uptime checks can sit inside the dashboard or outside it. UptimeRobot's free plan gives 50 monitors at 5-minute intervals, and its page says the free plan suits commercial projects too. Its Team plan is $35 a month ($30 on annual billing) for 100 monitors at 30-second intervals. The sums below use $5.50 per site per month, a planning figure between those lists.

Labour is the real cost. The first table shows minutes per site per month in the example, with the lines AI changes shown as before then after. Staff time is costed at $45 an hour.

Edits are the biggest line and AI does not touch them: the client is paying for a person to make a change. The second table turns the minutes into margin at the middle of each price band.

Now suppose 13 of the 28 clients sign: six on Steady, five on Managed, two on Priority. The plans bring in $2,637 a month, or $31,644 a year. With AI-assisted routines the cost is $1,356.25 and the margin $1,280.75 (48.6%); without them the margin is $1,024.25 (38.8%). The gap is 342 minutes, 5.7 hours a month, worth $256.50 at $45 an hour. A cautious case with only six signing (four Steady, two Managed) brings in $854 against $421.50 of cost, a 50.6% margin. The signed clients are the business; the AI hours are margin protection, and that is how to describe them to yourself.

Update runs: what the tools automate and what they miss

Dashboards have already automated the risky mechanics, without AI. ManageWP's Safe Updates, for example, creates a restore point, checks that your chosen page returns a normal HTTP status, takes a before screenshot, applies the updates, checks the status again, rolls back automatically on a 4xx or 5xx error and shows a side-by-side after screenshot. Its page says Safe Updates comes free with the premium Backup add-on. WP Umbrella lists bulk safe updates with rollback in its base price.

What those checks cannot tell you is whether the page still does its job. A page can return a normal status and a matching screenshot while the contact form stops sending mail. So the update run in the plan includes a two-minute functional test, chosen per site.

Before a Managed or Priority run, an assistant earns its keep reading the changelogs. The risk is a summary that sounds right and is not in the text, so the prompt demands the exact line for every claim. Illustrative prompt, with made-up version numbers:

Below is the changelog text for versions 4.8.2 to 4.9.1 of a booking plugin.
For each category, quote the exact line that supports your answer:
1. Breaking changes or removed features
2. Required PHP or WordPress version changes
3. Database changes or migrations
4. Anything described as a security fix
If a category has no matching line, write "none stated". Use nothing outside the text.

[paste the changelog here]

An illustrative reply, after the fixes described below:

• Breaking changes: "Removed the legacy shortcode for class lists; use the block instead." Check which pages still use the shortcode before updating.
• Required versions: "Requires PHP 8.1 or higher." Check the host's PHP version first.
• Database: "Adds a new table for booking metadata on first load after update." The restore point covers it, but expect the first page load after the update to be slow.
• Security fixes: none stated.

In the first run the model listed "performance improvements" under security fixes because the line mentioned loading sanitised data. The fix was the quote requirement and the "none stated" option; a claim without a quoted line is not evidence. The reply is only as good as the changelog, and some plugins write terse ones, in which case the run takes the full 25 minutes with no saving. Weekly Priority runs that include a major version bump also get a staging copy, which no summary replaces. For where else this kind of reading helps and where it misleads, the piece on which agency tasks AI handles well draws the line.

A monthly report drafted from real exports, then checked

The report is where AI pays back most reliably, because the facts already exist as logs. The agency pastes a data block assembled from the dashboard, the uptime monitor and the edit log, and the assistant only writes the sentences. Here is an illustrative block for the yoga studio on the Managed tier:

Client: yoga studio (Managed tier). Period: October.
Uptime: 99.96%. One incident, 18 Oct 02:10 to 02:24 (14 minutes). Cause not recorded.
Updates applied: 3 plugins (booking, forms, SEO), 1 theme, 1 core minor update. No rollbacks.
Backups: 31 daily copies. Restore test on 1 Oct passed.
Security: 31 daily scans, no findings.
Edits: 1h20m of 2h used (new timetable page 50 min, teacher bio 30 min). 40 min rolls over.
Mobile speed: Largest Contentful Paint 2.4 s (good is 2.5 s or less).
Search Console clicks: 612 (September: 540).
Incidents logged: 1.

Write a client report from the data block. Plain English, under 180 words, three headings: What we did, What we saw, What we suggest next month.
Use only numbers that appear in the data block and calculate nothing yourself. If a cause is not in the data, write "cause not recorded".
Do not praise results, predict outcomes or name software.
Suggest at most two actions for next month and mark each "for staff to confirm".

What we did. All updates ran on schedule: three plugins, the theme and a minor WordPress update, with no rollbacks. We added the new timetable page and updated one teacher bio, using 1 hour 20 minutes of your 2 hours. The other 40 minutes roll over to November.

What we saw. The site was available 99.96% of the time, with one 14-minute outage on 18 October from 02:10; cause not recorded. All 31 daily backups completed and our 1 October restore test passed. Security scans found nothing. Mobile loading time was 2.4 seconds on the main measure, inside the 2.5-second target. Search clicks were 612, against 540 in September.

What we suggest next month. Ask the host what caused the 18 October outage (for staff to confirm). Add a page for the autumn workshop dates (for staff to confirm).

That is the reply after two fixes. The first draft said clicks were "up 14%", which was the model's own arithmetic, and the true figure is 13.3%, so the prompt now says to calculate nothing; if the client report should carry a percentage, a person adds it from a spreadsheet. It also wrote that the outage "was caused by a routine host restart", a cause that appeared nowhere in the data, which is why the "cause not recorded" rule exists. Models fill gaps with plausible reasons, and a client who reads a wrong reason in your report will quote it back to you.

The check before sending takes three minutes: every number in the report matches the data block, every incident has a time and a cause or "cause not recorded", and no sentence promises or predicts anything. Put your name on the report only after that. For SEO-heavy retainers where the report includes rankings and content work, the tutorial on drafting monthly SEO reports with ChatGPT or Claude goes further than this maintenance version needs to.

Turning a rambling client email into tickets and minutes

Edit allowances only work if each request is scoped before anyone starts. Clients write one email with three jobs in it, one of which is not an edit at all. Here is an illustrative message to the yoga studio's inbox:

Hi, can you move Saturday's class to 9:30, put the new teacher photo on the About page (attached) and also the booking button sometimes doesn't work on my phone?? A couple of people have said. Thanks, [first name]

Split this client email into separate tickets. For each give: type (edit, fault or project), what the client asked for in one line, and a minutes estimate for staff to confirm.
For faults, list what we still need to ask. Do not guess a cause.

For the fault, the assistant lists what to ask: which phone and browser, roughly when it happened, a screenshot, and whether the button is ours or a third-party embed. In the first run it guessed that a caching plugin was to blame, and the "do not guess a cause" line stopped that. The client's reply to your first message should carry those questions, not a theory. After this email, 30 of the 120 minutes are used, and the ticket log shows 90 left. Staff, not the assistant, decide whether a fault counts against the allowance, because that is a contract decision. Clients who never use their hours, or never open the report, are the early sign of a cancelled plan, which the guide to spotting at-risk retainers turns into a monthly check.

Four weeks to launch the plans with the clients you already have

1. Week one: audit all 28 sites. One row per site: host, who owns the domain, active plugin count, premium licences and their expiry dates, admin accounts, whether a backup exists and whether a restore has ever been tested. The sites with no tested backup go first, whatever the client decides.
2. Week two: write the tiers and the terms. Fix the three price points, set up the dashboard, the uptime monitors and a shared edit log, and draft the scope wording below.
3. Week three: offer the plans. Email each client with a recommended tier. Phone the five shops, because they need the most explaining.
4. Week four: onboard and dry-run. Start the first signed clients, and run the report routine on three sites before billing the first month.

The email names a tier for the client's own site and gives the reason. Illustrative wording for the print shop:

Subject: Keeping [site name] updated and backed up from next month

Hi [first name], until now we have looked after your site when something needed fixing. From next month we are offering monthly care plans, so updates, backups and checks happen on a schedule and you get a short report each month.

For [site name] I suggest Managed at $229 a month: daily backups, fortnightly updates with a basket and checkout test, 2 hours of edits, and a reply within 4 working hours. Because your shop takes orders, a broken update costs you sales, which is why I would not suggest the $99 Steady plan. Reply "Managed" and I will send the agreement. Happy to talk it through first.

[your name]

Two things that went wrong in month two

Both of these are illustrative, and both are common enough to plan for. In the first, an update to the print shop's shipping plugin broke rate calculation at the basket. The safe-update screenshot of the home page matched, the status check passed, and the first sign was a customer's email two days later. The fix was the basket test in the table above, plus a rule that every shop sits on Managed at least. The second was a report that said "no incidents" because the incident line was missing from the data block, and the assistant filled the silence. The block template now carries an "Incidents logged:" line that must read a number or "none logged", and the report check starts there.

Neither failure was an AI failure in the sense of a clever model going wrong. Both were gaps in what the routine checked, which is the reason to write the routine down per site before automating any part of it.

Scope terms that keep a plan from becoming unpaid support

A maintenance plan fails commercially when the edge of it is vague. Decide these points before the first agreement goes out.

• Edit versus project. An edit changes content or settings on existing pages. A new page type, a redesign, a new plugin or a new integration is a project, quoted separately or billed at the hourly rate (the example uses $85).
• Rollover and minimum term. One month of rollover at most, and a three-month minimum, then 30 days' notice. Both ideas appear on published plan pages from other providers.
• What a response time means. First reply by a person, not a fix. State the working hours it runs in.
• Third-party costs. Premium plugin licences, domain renewals and hosting are the client's, passed through or billed by their own suppliers.
• Inherited problems. A site that arrives hacked, neglected or built by someone else gets a priced audit first. The plan starts once the site is in a known state.
• How AI is used. Say so in plain words, below.

Illustrative wording for the last point, which also answers the question a careful client will ask:

Monthly reports are drafted with software assistance from the monitoring and edit logs, then checked and sent by a named member of our team. We do not enter client passwords or visitor data into that software.

Have a qualified adviser read the final agreement, since liability, data-handling and cancellation wording differ between businesses. The accessibility spot-check in the Priority tier needs its own method; the tutorial on accessibility checks before handover gives one that reuses the same assistant routine.

Questions agencies ask before selling maintenance plans

Should a maintenance plan include hosting?

Usually not. Hosting is a separate bill with its own provider, uptime promise and backups. Keep the plan about the site: monitoring, updates, security, edits and reports. If you resell hosting, price it as its own line and still keep an off-host backup, because a host failure can take the host's own backups with it.

How do I price a WooCommerce shop on the same tiers?

Shops need a test order after every update run and more careful timing, so start them one tier up or add a fixed shop surcharge. In the example above the shops sit on Managed or Priority. Track your minutes for two months before setting the surcharge, because the right figure depends on your own update routine.

Can AI apply the updates for me?

The tools I checked automate updates without AI. ManageWP's Safe Updates takes a restore point, applies the update, checks the chosen page's HTTP status and compares before and after screenshots, rolling back on errors. AI helps before and after that, reading changelogs and drafting the report. Deciding to update a live shop stays with a person.

How many edit hours should each tier include?

Published plans I checked run from none or 30 minutes on entry rungs to 8 or 12 hours on the top ones. Pick allowances you can deliver inside the price. The example uses 30 minutes, 2 hours and 4 hours, with unused time rolling over one month at most. Check your logged minutes after a quarter and adjust.

What should I tell clients about AI in their reports?

Say it plainly in the plan terms: reports are drafted with software assistance and checked by a named person before they go out, and client passwords and visitor data are never entered into it. That avoids a surprise later. Check your contracts for subcontractor and data-handling wording, and ask a qualified adviser if unsure.

Further reads

• AI Content Management Platform: How a Web Agency Picks One for Clients — Pick the CMS before you promise to maintain it for clients.
• AI Website Builder or Web Designer: What Each Really Costs — What clients compare your build and care fees against.
• ChatGPT for Freelancers: Turn One-Off Clients Into Monthly Retainers — Wording for turning a finished project into a monthly plan.
• How Marketing Agencies Use AI to Automate Client Reporting — Reporting patterns from a neighbouring agency type.
• AI Maintenance Costs: What You Pay After an Automation Goes Live — The same after-launch cost question for AI automations.
• How to Audit Your Website's SEO With AI in One Afternoon — An audit routine for the Priority tier's technical checks.
• AI Wireframe Generator for Web Designers: From Brief to Clickable Draft — Move from client answers to a tested clickable flow without mistaking generated screens for an approved site.
• Figma Make for Web Designers: Client Prototypes and Where It Breaks — How a web designer can turn a brief into a clickable Figma Make prototype, which plan to check, and the places it tends to fall short on real client work.
• Web Design Client Questionnaire: Collect Content and Goals With AI Help — Twenty questions to ask a new web design client, then prompts that turn the answers into a brief, sitemap and content plan.
• Web Design Proposal Template: Draft Scope, Fees and Timeline With AI — A filled-in web design proposal: scope, phases, payment schedule, assumptions and revision limits, drafted with AI and checked by you.
• Website Development by AI: What Agencies Can Ship and What Needs Review — A review checklist for AI-built client sites: what an agency can ship quickly and where a human check is mandatory.
• Can ChatGPT Design a Website for a Client? What It Gets Right and Wrong — A web agency's practical review of AI wireframes, page copy, responsive code and client-ready handover.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: vendor pages for ManageWP (pricing and Safe Updates), MainWP, WP Umbrella and UptimeRobot; published plan pages from Websults, FixRunner and c-istudios; the Core Web Vitals thresholds on web.dev. All read in early November 2026.