# EMAIL-TEMPLATES · Notes to existing clients (drafts only)

Drafted Thu Oct 22, 2026 (PT). **Draft text only. Nothing has been sent.** json reviews and sends each one himself (or asks the parent to stage it for approval). Critic checks tone first.

Rules: no urgency or scare words, no "act now", no guarantees, no deal copy, no stats. Fill every `{}`. Send one template per client, based on the crew's check of that client's site. Don't send template 2 or 3 until the crew has actually looked at the site.

Tag links with `client_reference_id` per STRIPE-PLAN.md (`em1`, `em2`, `em3`) only when a payment link is included; these templates don't include one by default.

---

## Template 1: CARE-hosted clients (no PHP on the site)

**Send to:** clients on CARE Hosted, Cared For or Growth whose site the crew confirmed is static (no PHP serving it).
**Subject:** About this week's PHP security news and {site}

Hi {first name},

You may have seen news this week about two security flaws in PHP, the language WordPress runs on. I wanted you to hear it from me: {site} doesn't run on PHP. It's hosted on our care plan as a static site, with no login page and no database, so this one doesn't reach it.

We checked on {date}, and there's nothing you need to do.

If you have another site somewhere else, a WordPress site, a booking system or an old landing page, send me the address and I'll take a free look.

{json}
JKCA Studio, Seal Beach

---

## Template 2: Clients with a WordPress/PHP site JKCA doesn't host

**Send to:** clients JKCA built or helps, whose site runs WordPress or PHP on their own host.
**Subject:** {site} and the October PHP update

Hi {first name},

On Oct 21 the PHP project released fixes for two serious flaws in PHP, which is what WordPress runs on. The fix is a PHP update on the server, not a WordPress update, so it's usually your host who installs it.

Here's what we could see from outside on {date}: {one line, e.g. "your PHP version isn't shown publicly, which is normal" / "your site shows PHP 8.3.30, which is before the fixed 8.3.36"}. What we can't see from outside is whether {host} has installed the fix and restarted PHP.

Two easy options:
1. Ask {host} which PHP build is serving your site and whether it includes the October 21 fix. {If 8.1/8.0/7.4: On your version the number doesn't change, so ask for the build date; it should be Oct 21, 2026 or later.} I'm happy to send you the exact wording.
2. Or we can do it for you: check, patch or chase the host in writing, confirm it from the live site, and send you a short note. {price, DECISION D1}

Either way, just reply and let me know.

{json}
JKCA Studio, Seal Beach

---

## Template 3: Introducing the monthly plans (after a check, or to clients who asked)

**Send to:** clients whose site has had a one-time patch check, or who asked about ongoing help. Not a cold blast.
**Subject:** Keeping {site} up to date each month

Hi {first name},

Thanks for letting us look after {site} this week. {One line on the result, e.g. "PHP is now on 8.3.36 and we confirmed it from the live site on Oct 23."}

If you'd like us to keep doing this every month, we've put it into three plans:
- **Watch:** we keep an eye on the site and tell you what needs updating. {price, D3}
- **Patch:** we do the updates each week, keep daily backups, and test a restore every quarter. {price, D3}
- **Harden:** Patch, plus tighter settings, daily log checks and a monthly restore test. {price, D3}

Each one comes with a short report every month in plain English, says what we couldn't check, and runs month to month with 30 days notice. For {site}, I'd suggest {tier}, because {one honest reason}. If you'd rather keep handling updates yourself, that's fine too.

The details are here: {page link, once live}. Reply with any questions.

{json}
JKCA Studio, Seal Beach