Deliver
Onboarding and the site-takeover audit, then running the operation week after week — the five components you’re really delivering, and the tool layer underneath.
Client onboarding and site takeover
The first days with a new care plan client decide everything that follows. Done well, the client feels relieved and confident from week one. Done poorly, you spend the next year fighting the impression they got in the first week.
A note on terms. Onboarding is bringing a new client into your system. Site takeover is the technical part — getting access, learning how it’s set up, and putting your tools in place. The two happen at the same time.
The four-stage process
Onboarding should be a defined process with a clear end. If you promise one week, deliver in one week.
Welcome and credentials
A warm welcome email, a link to your credentials request, and a recommended deadline. Use a secure password manager — never ask for passwords by email.
The site takeover audit
Run a complete audit. Know everything about this site before the kickoff call.
The found-issues conversation
The audit surfaces problems. Outdated plugins, no backups, a weak admin password. Communicate them clearly.
Setup
Put your stack in place. Connect the site to your management platform and configure the details.
CREDENTIALS WE NEED FROM YOU Please send these via [your secure password manager link]. Do not email passwords. WORDPRESS · A WordPress admin account in YOUR name (not a generic shared login) · We'll create our own admin account from yours after we receive access HOSTING · Hosting provider name (e.g., SiteGround, WP Engine, Kinsta) · Hosting account login (or a sub-account/team invite if available) · Server access: SFTP, SSH, or hosting panel — whichever your host provides DOMAIN · Domain registrar (GoDaddy, Namecheap, etc.) · Login, or confirmation that you'll handle DNS changes when needed CONNECTED SERVICES · Google Analytics — admin access to your property · Google Search Console — owner-level access · Email service if integrated (Mailchimp, ConvertKit, etc.) · E-commerce platform if applicable (WooCommerce, Stripe, payment processors) OTHER · A list of premium plugins/themes you've purchased, with license keys · Anyone else who has access we should know about WHY WE'RE PARTICULAR Each item protects you. Hosting access lets us recover quickly. Analytics access lets us spot performance problems. License keys let us keep premium tools updated. If you don't have something, that's fine — we'll work with what's available.
The takeover audit
This is your chance to learn the site as deeply as if you’d built it. Spend real time here — two to four hours per typical site is normal.
- WordPress core: version, PHP version, multisite or single?
- Theme: name, version, parent/child theme, last update, where it’s from
- Plugins: count, what each does, last updated, abandoned ones, premium licenses
- Users: how many admins, who, last login, inactive accounts to remove
- Backups: does anything exist, where, how often, last successful one
- Security: vulnerabilities, malware, suspicious files, weak passwords, 2FA
- Performance: page speed, core web vitals, caching, image optimization
- Hosting: provider, plan, PHP version, SSL, server resource use
- Forms and integrations: contact forms, payment forms, third-party tools — do they work?
- Custom code: custom plugins, snippets, functions.php, cron jobs
Optional but good: SEO basics (sitemap, robots.txt, redirects) and email deliverability (SPF/DKIM). Write a one-page audit summary for yourself (technical) and a separate one for the client (plain English).
The found-issues conversation
Almost every site has problems. The way you raise them sets the tone for the whole relationship.
Never blame the previous provider. The client chose them, and criticizing the choice criticizes the client.
Frame issues as opportunities, not crises. “I found a few things we should clean up” beats “your site is a security nightmare.”
Subject: Your site audit results (a few things to clean up) Hi [First Name], I've finished going through your site as part of onboarding. The good news is, there's nothing on fire. Your site is online, doing its job, and most of the basics are in place. That said, here are the things I'd like to clean up over the first month or two. None are emergencies — but addressing them now will save us all headaches later. INCLUDED IN YOUR PLAN (handled in the first 30 days at no extra cost): · [Item 1] · [Item 2] · [Item 3] OUT OF SCOPE (bigger; quoted as small projects if you want them): · [Item 1] · [Item 2] Reply with any questions, or we can talk it through on a call next week. I just wanted you to see the list before we hop on so it's not a surprise. Best, [Your name]
The welcome packet
A short PDF you send around day 11. The client reads it once, files it, and refers to it later when they wonder “how do I reach them again?”
WELCOME TO YOUR CARE PLAN [Client business] × [Your business] WHO TO CONTACT Your main contact is [Your name], at [email]. For urgent issues, put "URGENT" in the subject. Response time: [24] business hours, weekdays. WHAT WE DO EVERY MONTH · Run all WordPress, plugin, and theme updates safely · Take a full off-site backup every day · Watch your site 24/7 for uptime · Scan for vulnerabilities every day · Send you a monthly report (around the 5th) · Stay available for [60 minutes] of small content edits WHAT'S NOT INCLUDED Bigger projects (redesigns, new features, migrations) are quoted separately at $[X]/hour. We'll always confirm scope and price in writing before we start. YOUR MONTHLY REPORT covers: uptime %, updates run, security issues resolved, performance summary, backups completed, and recommendations for next month. WHEN SOMETHING GOES WRONG Email us. We respond within [24] business hours. REFERRAL THANK-YOU Refer someone who signs up, and we'll credit your account with one free month. THANK YOU We're glad to be your team for this site. If anything here is unclear, just tell us.
Running the operation and using the right tools
Onboarding is over. The work begins. A care plan is a rhythm — set the rhythm and it runs itself; skip it and you’ll feel like you’re firefighting forever. When you use a platform like WP Umbrella, most maintenance tasks are fully automated.
The cadence
- Daily Check overnight alerts (sites down, security flags). Glance at your support inbox. Quick triage of the past 24 hours.
- Weekly Run scheduled updates (automated). Review flagged updates. Process the week’s small content changes.
- Monthly Generate and send client reports. Review your MRR, churn, and pipeline. One outreach to a past project client.
- Quarterly Review every site’s plugin list. Strategy calls with premium clients. Review uptime/performance trends. Check broken links.
- Yearly Check tool pricing; raise client prices if costs moved. Review your three tiers — add, remove, or rename.
The five components you’re really delivering
Behind every care plan are five jobs you’ve quietly committed to: keeping the site updated without breaking it, backing it up so you can come back from anything, watching for security threats before they become incidents, knowing the moment something goes wrong, and showing the client every month that the work is happening.
Component 1 · Safe updates
Updates are the most common cause of broken WordPress sites — and the work clients can’t see. Three decisions shape how you run them: frequency (weekly or biweekly suits most agencies), by hand or with a tool (manual is impossible past ~15 sites), and how to protect yourself — visual regression takes before/after screenshots and catches most update bugs.
Component 2 · Reliable backups
The one thing you’ll almost never need, until you need it desperately. Five things matter: encryption (in transit and at rest), incremental methodology, the 3-2-1 rule (3 copies, 2 storage types, 1 off-site), one-click restoration, and compliance. There’s a sixth we treat as key: transparent verification — a backup you can’t test is a backup you don’t have.
Component 3 · Proactive security
Reactive security waits until something happens; proactive security catches the problem before it becomes one. A care plan that only does reactive security is charging for an apology service. The biggest source of vulnerabilities isn’t core — it’s the plugins and themes on top. The job is knowing the moment a vulnerability is detected, so you can update, patch, or replace before it’s exploited.
Component 4 · Uptime and performance monitoring
The point of monitoring is that something else does the staring for you. Uptime is binary — set a monitor every few minutes so you (not the client) are first to know. Performance is a gradient — page speed and Core Web Vitals drift as content grows; a monthly check catches real trends. Set the alerts up once, trust them, and stop refreshing dashboards.
Component 5 · Professional client reports
The report is the only thing the client sees consistently — make it count. Clients need to know: was my site up, did anyone try to hack it, is it up-to-date, is it fast, did anything need attention? Easy for one site; hours by hand across many.
Picking the right WordPress management tool
One of the most important infrastructure decisions you’ll make. Five things to check before you commit:
- Is the interface intuitive? You should want to open it every morning.
- Is the team trustworthy? One you trust to still be here in three years, shipping improvements.
- Is the pricing right? Transparent and scaling predictably — flat per-site is easier to forecast than tiered plans that punish you for adding sites.
- What do public reviews say about support? There will be times you need an extra hand.
- Are they compliant with data regulations? Know where your data travels before connecting a site.
Building SOPs your future team can run
Past 30 to 50 sites, you’ll either hire help or burn out. SOPs make hiring possible. A good SOP has four parts: what the procedure is for (one sentence), when to run it (trigger, frequency), the numbered steps, and what to do if something goes wrong. Start with your client onboarding SOP.