Why plugin updates alone are not a care plan

“We have a care plan — they update our plugins every month.”

We hear this constantly on emergency intakes. The site is down, admin is white-screening, or checkout broke after an automatic update — and the owner believed they were covered because someone had been clicking Update All on a schedule.

Plugin updates are necessary. They are not sufficient. Treating them as the whole maintenance program is how small businesses end up paying for emergency repair while still paying a monthly “maintenance” fee.

What “updates only” actually covers

A typical updates-only arrangement includes some combination of:

• Logging into WordPress on a calendar reminder.
• Updating plugins, sometimes themes and core.
• Maybe a quick glance at the home page.
• An invoice marked “website maintenance.”

That is a single task in a longer system. It does not prove backups work, does not catch checkout failures, does not document what changed, and does not give you a human when the update itself causes the outage.

If your vendor’s scope ends at “plugins updated successfully,” you have update service — not a care plan.

What breaks when updates are the whole plan

No rollback story

Plugins fail in production. PHP version shifts expose abandoned code. Two plugins that both worked last month conflict today. Without a recent backup you have tested restoring, the fix path is often “disable plugins via FTP and guess” — or rebuild.

Updates-only vendors rarely restore; they notify you that the site broke. Restore verification is the difference between a twenty-minute rollback and a multi-day rebuild.

No supervision on automatic updates

WordPress and many hosts now push automatic core and plugin updates. That can be good — but only if someone reviews logs, checks critical paths after changes, and holds risky plugins back until tested.

Unsupervised automatic updates are a common source of silent breakage: forms stop sending, SEO plugin changes schema, a WooCommerce extension alters tax logic. The site “loads fine” while revenue leaks.

No monitoring between visits

Monthly updates mean 29 days where checkout could fail, SSL could expire, or disk could fill — with nobody alerted until the next login. Uptime monitors are cheap; assuming a monthly plugin pass catches emergencies is not.

For stores, the gap is worse. See what should be monitored on an ecommerce website for signals a plugin schedule will never touch.

No accountability when the update causes the problem

The cruelest version of updates-only: the same person who updated plugins is unavailable when the site breaks, or blames “the plugin author” while the business loses a week of leads. A care plan includes response when maintenance activity triggers failure — not just the activity itself.

What a real care plan adds

Think of updates as one layer in a stack:

Supervised change management

• Updates on a defined cadence with notes (versions, date, who).
• Risk-based ordering: backup first, staging when available, production in a window you accept downtime risk.
• Hold list for plugins with known breakage until patched or replaced.
• Smoke tests on login, forms, and revenue paths after bulk updates.

Checked backups and restore discipline

Backups before updates are table stakes. So is proving those backups restore. A care plan treats “backup failed” or “restore never tested” as a blocking issue — not a footnote.

Monitoring and alerting

Someone gets pinged when the site is down, SSL is expiring, or a synthetic checkout test fails — not only when the calendar says “update day.”

Human help when something breaks

Care is not “we updated plugins; good luck.” It is access to a team that can diagnose plugin conflicts, roll back, patch theme PHP issues, and talk to the host — within agreed response expectations.

That response piece is why what website maintenance should include lists owners, reporting, and access — not just a plugin list.

How to tell what you are actually buying

Ask your current provider (or yourself, if DIY):

1. When did you last restore a backup to a test environment and log in? If the answer is “never” or “I assume the host has them,” updates are not a care plan.
2. What happens if an update whitescreens the site tonight? Named person, response time, rollback method — or silence?
3. What is monitored 24/7 vs checked monthly? SSL, uptime, forms, checkout — which are which?
4. What is in writing? Scope that only mentions “WordPress updates” is updates-only, regardless of the product name on the invoice.

Honest update service is fine for low-risk brochure sites with good backups and monitoring elsewhere. Calling it full care without restores and alerts is what creates angry surprises.

DIY is valid — if you run the full checklist

Many owners maintain their own sites. That can work when you personally run the whole maintenance checklist: supervised updates, off-site backups, quarterly restore tests, monitoring, security hygiene, and documented access.

Where DIY fails is treating “I update plugins when I remember” as equivalent to professional care. You might be fine — until one abandoned plugin meets a PHP upgrade and you discover the backup plugin has been failing silently for six months.

The practical takeaway

Plugin updates keep known vulnerabilities closed and compatibility moving forward. They do not replace backups you have proven, monitoring that reaches a human, or help when the change goes wrong.

If your maintenance contract fits on a sticky note that says “update plugins monthly,” rename it accurately — then decide whether to add the missing layers or accept the emergency risk.

Updates are part of care. They are not care by themselves.