Agencies invoice the cleanup: a day of a senior developer, sometimes two. The larger costs of a hacked client site never appear on an invoice, and they are the reason care plans exist in the first place. This is an attempt to name them, from having paid them.
The cost you can invoice
Someone drops what they were doing. The site goes offline, gets cleaned, gets restored, gets checked, gets delisted from Google's warning. A day, sometimes two, of a senior person's time at the worst possible moment. If the site is a shop, every hour offline is revenue the client can count to the euro, and will.
The costs you cannot
| Cost | How it shows up |
|---|---|
| The night | Break-ins are found at 23:47 by a client's customer, not at 09:00 by you. The first message sets the tone for everything after it, and it was not yours. |
| The trust | A client who found out first now wonders what else you did not see. Every future conversation about the retainer starts from there. |
| The retainer | Care plans are sold on "nothing breaks without us knowing". One visible break is the moment that sentence gets renegotiated, often downward. |
| The other 39 sites | If one site had an outdated plugin, the client assumes they all did. So do you, and now you are checking forty sites by hand on a Sunday. |
| The referral that does not happen | Agencies grow on referrals between business owners. A hacked site is a story that gets told at the same dinner tables. |
How care plans price against that
Most agencies sell a care plan per site per month; what it costs varies with the market and with what is bundled. The client is not paying for updates. They are paying for the agency to find out first, act first and be able to show what it did. Watching, checking and updating look the same on every site. Deciding what a finding means for this client, and what to tell them, is what the agency gets paid for.
The arithmetic only works if watching and updating cost the agency far less than the plan is worth. That is why the tooling underneath a care plan is priced per site in cents per day, and why an agency's margin lives in the gap between the tooling and the retainer.
What "knowing first" has to mean in practice
No tool can promise a site never gets hacked, and an agency that promises it will one day have to explain why the promise did not hold. What can be promised, and checked:
- Every site requested from outside around the clock, so downtime is a message to you within minutes.
- A continuous comparison of core files against the release, a list of administrator accounts, and every plugin version matched against known vulnerabilities.
- Updates applied from one place with a restore point first and the code difference kept, so a bad update has a trail.
- The first message about any of it coming from you, before the client notices, in your own words.
A care plan is a promise to find out first. Everything else in it exists to keep that promise.
Put your own numbers on it
Take an agency with forty client sites and a developer at €85 an hour. Checking a site by hand, reading the updates, running them, clicking through the site afterwards, takes about half an hour a month if nothing goes wrong. That is twenty hours a month, or €1,700 of developer time, for the routine alone. A single incident like the one above adds one to two days on top, at the worst moment, and it does not respect the plan.
Tooling that watches and updates the same forty sites costs, at WebCrew's launch price, €78 a month. The point of that comparison is not that the tool replaces the developer. The developer still decides what a finding means and talks to the client. The point is that the twenty hours become two, and the incident becomes a message on a Tuesday morning instead of a phone call on a Saturday night. The agency page has this calculation with fields for your own rate, minutes and sites.
What a care plan should promise, in writing
Most care plan disputes come from a promise that was never written down and that both sides remember differently. Four lines cover most of it.
- What is watched, and how often. "Uptime around the clock; security and version checks several times a day." Not "we monitor your site".
- What happens when something is found. Who is told, within what time, and what the agency does on its own versus what it asks about first.
- What is not promised. That the site never goes down and never gets hacked. Nobody can promise that; the plan promises to find out first and act first.
- What happens after an incident. Whether cleanup is inside the plan or billed separately, and what the client does on their side.
Three numbers worth tracking per client
- Time to know. How long between a site going down or a rogue administrator appearing and the moment you knew. The plan is worth what this number is.
- Updates behind. How many plugins on the client's sites run a version with a published fix. Zero most days is what "kept up to date" means.
- What you told them. How many messages the client received from you this month that said what ran and what was found. A quiet month with one summary is a care plan; a quiet month with silence is a cost the client will question.
Sources
- CloudLinux, "State of WordPress Agencies 2026"65% of agencies name plugin updates a top security challenge; 45% of 100+-site agencies still update site by site
- Rapid7 Labs and Check Point Research on the ClickFix campaignMarch and August 2026; most affected sites had an exposed wp-admin and outdated components
Rik Smeets