Updates done with care
WordPress, the theme and plugins receive frequent updates. Someone has to apply them, check afterwards that the site looks the same and that the forms work, and roll back to a backup if something has broken. Automatic updates without checks are behind many sites that have shown a blank page for months.
Backups that can actually be restored
A backup on the same server as the site disappears along with the server. A useful backup is daily, stored elsewhere (another account, external storage) and tested at least once: someone has actually restored it on a copy and confirmed that it works.
Monitoring, not waiting
A monitoring service checks the site every few minutes and alerts you when it doesn't respond, when the certificate is about to expire or when load time goes up. The difference is between hearing about it from a customer three days later and finding out within five minutes.
Basic security
Limiting login attempts, hiding the admin username, deleting default files (readme.html), an HSTS header, correct file permissions. None of these are sophisticated measures, but they are missing from many of the sites we check.
Hours for changes included
You change a price, add a service, put up a banner for a promotion. A good plan includes a few hours a month for this, with an agreed response time. Without them, every small change becomes a negotiation.
What to ask before you sign
Where is the backup kept, and for how long? How quickly do you respond to a problem? What happens to the access details and the site if I cancel? Do I get a monthly report? If the answers are vague, the plan is just an invoice.