# What a monthly website plan should include By [Patrick Colton](/about/#patrick). Published October 17, 2026. A fair monthly plan keeps your site running in accounts you own, with software updates, tested backups and edits when you ask. You get a written record of the work and a short report in plain words on a set schedule. You can leave any month and keep everything. ## What are you paying for each month? A website is not finished the day it goes live. The software under it gets security fixes. Your prices change. Your phone number changes. You add a service or a second truck. Somebody has to keep up with all of that. A monthly plan pays someone to do it. Plans differ a lot. Some are mostly hosting with a markup. Some include real work every month. Either one can be honest. What matters is that the terms say which one you are buying and that you can check the work got done. ## What should every plan include? Seven things. If a plan leaves one out, ask why. Sometimes there is a good reason. ### 1. Hosting in your name The hosting account should be yours. Ideally that means your login and your card on file. At minimum it means an account you can sign in to and take over without asking anyone. The person you pay gets added as a user. If they built the site inside their own account, ask what happens to it the day you cancel. Get the answer in writing. The same goes for the accounts around the site. In Google Search Console an owner has full control and can add and remove users. On a Google Business Profile a manager cannot add or remove users or remove the profile. An owner can. You should be the owner of both. The person you pay should be a user or a manager. ### 2. Software and security updates A site built on WordPress or a similar platform runs on software that needs updating: the platform itself plus its plugins and themes. WordPress's own security guide says to always run the latest version. It also says older versions are not maintained with security updates. A plan should say what gets updated and how often. It should also say that someone checks the site still works after each update. If your site is on a builder that updates its own software, there is less to do here. The price should reflect that. ### 3. Backups that have been tested A plan should say where backups are kept and how they are tested. CISA, the federal cybersecurity agency, tells organizations to test backup procedures on a regular basis. WordPress's backup guide says to keep copies in different locations. For your website that means two things. The backups should live somewhere other than the server the site runs on. And someone should restore one to a test copy often enough to know it works. Ask when they last restored a backup for a client. A good answer includes a date and what came back. ### 4. Edits when you need them A new price. A new photo. A staff change. A service you started offering this spring. The plan should say how you ask for an edit (an email should be enough) and whether there is a monthly limit. A limit is fair when it is written down before you sign. ### 5. A written record of the work Every change, listed: what changed, the old value, the new value and the date. This is how you know the monthly fee bought something. Google's own guide to hiring an SEO tells owners to ask, before they hire anyone, whether the SEO will share every change made to the site. The same question works for anyone you pay to run your website. ### 6. A plain report One page in plain words: what was done, what the numbers show and what comes next. The numbers should come from somewhere you can open yourself. Google Search Console shows how many times your site appeared in Google results and how many clicks it got. If that account is in your name, you can check every number in the report against it. ### 7. Easy cancellation You should be able to cancel by email and stop paying at the end of the month you already paid for. Nothing should renew on its own. Because the accounts were in your name from the start, nothing needs to be handed back. The site keeps running. ## What should you ask before you sign? Ask these in writing and keep the answers: - Whose account is the hosting in, and can I log in to it today? - Who is the owner on my Search Console and my Google Business Profile? - What gets updated each month, and will you tell me what you updated? - Where are the backups stored, and when did you last restore one? - How do I ask for an edit, and is there a monthly limit? - Will I get a written record of every change? - What is in the report, and where do the numbers come from? - How do I cancel, and what happens to my site when I do? Google's hiring guide suggests two more. Ask what results they expect and by when. Ask how they measure success. A careful vendor can answer both without promising you a position. ## What are the red flags? None of these prove a vendor is dishonest. They are reasons to read the terms closely before you sign. **The site lives in the vendor's account.** Some companies build your site inside their own product. That can be a fair deal if they said so up front and the price reflects it. The trouble comes on the day you try to leave and learn there is nothing to take with you. A site built inside someone else's product usually cannot be moved out of it. If that is where you are now, the fix is a [rebuild](/full-rebuild/) on hosting bought in your name. **The contract renews on its own.** Some plans run a year at a time and renew for another year unless you cancel inside a short window. Ask for month to month. If you sign a yearly plan anyway, put the renewal date and the last day to cancel on your calendar the day you sign. **Reports with no record of work.** Traffic moves for a lot of reasons, including the season. A chart going up is not proof that anyone did anything. Ask for the list of changes. **Promised rankings.** Google's guide to hiring an SEO says, "No one can guarantee a #1 ranking on Google." Google also says it does not guarantee it will crawl, index or show a page, even one that follows its rules. It does not take payment to rank a site higher either. No one can promise your business will be named in an AI answer. Google's advice, if someone promises you first place, is to find someone else. **You are a manager on your own Google profile.** If someone else is the owner of your Google Business Profile, they can remove you and you cannot remove them. Owners can also remove the profile. Ask to be made the owner, with the vendor as a manager, before you pay anything. ## Where does GEObros fit? Ours is called [Monthly support](/monthly-plans/). It runs $500 to $1,000 a month depending on the site and starts after a [Tune-Up](/tune-up/) or a [Full Rebuild](/full-rebuild/). There is no contract. You can cancel any month by email. Ask us every question on this page before you sign. **Sources.** Google Search Central, "Do you need an SEO?" [developers.google.com/search/docs/fundamentals/do-i-need-seo](https://developers.google.com/search/docs/fundamentals/do-i-need-seo). Google Search Central, "In-depth guide to how Google Search works," [developers.google.com/search/docs/fundamentals/how-search-works](https://developers.google.com/search/docs/fundamentals/how-search-works). Search Console Help, "Managing owners, users, and permissions," [support.google.com/webmasters/answer/7687615](https://support.google.com/webmasters/answer/7687615). Google Business Profile Help, "Manage your Business Profile owners & managers," [support.google.com/business/answer/3403100](https://support.google.com/business/answer/3403100). Search Console Help, "Performance report (Search results): Overview and basic setup," [support.google.com/webmasters/answer/7576553](https://support.google.com/webmasters/answer/7576553). WordPress Developer Resources, "Hardening WordPress," [developer.wordpress.org/advanced-administration/security/hardening](https://developer.wordpress.org/advanced-administration/security/hardening/). WordPress Developer Resources, "Backups," [developer.wordpress.org/advanced-administration/security/backup](https://developer.wordpress.org/advanced-administration/security/backup/). CISA, "#StopRansomware Guide," [cisa.gov/stopransomware/ransomware-guide](https://www.cisa.gov/stopransomware/ransomware-guide).