WordPress care plans
WordPress maintenance, handled every single week.
Updates checked page by page, daily off-site backups, uptime and security monitoring, and a plain report every month — so you can publish instead of babysitting plugins.
Daily off-site backups
Uptime and SSL alerts
Monthly report
PHP 8.2 stops getting security fixes on 31 December 2026. PHP 8.1 and older already get none. WordPress recommends PHP 8.4 or later for production — we test and handle the upgrade as part of onboarding.
PHP.net — Supported versions · Make WordPress Hosting — Server environment
Why monthly WordPress maintenance matters
WordPress itself is solid. The risk lives in everything around it.
Patchstack counted just six vulnerabilities in WordPress core in 2025 — and over eleven thousand in the plugins and themes sites run on top of it. Keeping those current, fast, is the whole job.
6
vulnerabilities in WordPress core in 2025, against 11,334 across plugins and themes
5 h
weighted median from disclosure to first exploit for heavily targeted flaws
46%
of 2025’s vulnerabilities had no patch when they were disclosed
76%
of flaws found in premium plugins and themes were exploitable in real attacks
What happens in a month
A WordPress care plan, day by day.
Onboarding takes about three days. After that the routine runs on its own clock — and you only hear from us when something needs a decision, plus once a month with the report.
-
Get the site to a known-good state
You share access to the site and hosting; we take a first backup and fix anything urgent we find.
- First full backup
- Plugin, theme and PHP version review
- Urgent fixes before routine work
-
Switch on the alarms
Backups, uptime, SSL and security monitoring are connected, so problems reach us before they reach your readers.
- Uptime checks every few minutes
- SSL expiry alerts
- Security and malware scans scheduled
-
Back up everything, off-site
A full backup of files and database, stored away from your server and kept for 30 days.
- Daily off-site backup
- 30 days of restore points
- Restores included
-
Update — then look at the pages
Core, theme and plugin updates, with screenshots compared before and after to catch broken layouts.
- Core, plugin and theme updates
- Before/after visual checks
- Roll back and fix if anything breaks
-
A report you can actually read
One plain summary of updates, backups, uptime, security and speed for the month.
- Updates applied
- Uptime and incidents
- Security scan and speed check results
Updates without the fear
Auto-updates update. We also check what they changed.
Since WordPress 5.5 you can switch on plugin and theme auto-updates, which run twice a day through WP-Cron. They’re useful — but nobody looks at the page afterwards. That’s the part we add.
- Visual checks on every updateScreenshots of the pages we monitor, compared before and after, so a broken header doesn’t sit there for a week.
- A backup before every changeWordPress’s own upgrade guide says to back up first and confirm the backup is usable. We do both.
- Rollback and fix includedIf an update breaks something, we restore and fix the cause at no extra cost.
WordPress.org — Plugin and themes auto-updates · WordPress Developer Resources — Upgrading WordPress
Self-check
How exposed is your WordPress site right now?
Tick what’s true today. Each item is weighted by how often it turns a small problem into a long weekend. No email needed.
The cost of “we’ll do it later”
What an outage costs your business.
Use your own numbers. The model spreads monthly revenue across the 730 hours in an average month, then adds the staff time it takes to get back online.
It leaves out what’s hardest to count — lost rankings, ad impressions and trust — so treat the result as a floor, not a ceiling.
If the site goes down like this
$729Estimated cost of downtime per year
- Revenue lost per incident
- $164
- Recovery time per year
- 8h
Assumes revenue is spread evenly across the month (730 hours). Real losses are usually higher at peak times. A model, not a promise.
Backups that actually save you
Three backup rules from WordPress’s own handbook.
A backup only helps if it lives off the server, is recent and actually restores. WordPress’s documentation is specific about what good looks like, and every care plan follows it.
01
Keep several copies
WordPress recommends at least 3–5 recent backups, stored in different locations — never only on the hosting server. Ours are off-site and kept for 30 days.
02
Match the schedule to the site
Weekly is enough for small, quiet sites; WordPress advises daily backups for busy sites with lots of posts. We back up every site daily.
03
Prove they restore
The upgrade guide calls verifying that backups are there and usable “essential”. Restores are included, and we check them before risky changes.
Security monitoring
Updates close the door. Scans tell you if anyone got in.
With nearly half of new flaws unpatched at disclosure, updating alone can’t cover every gap. Regular scans catch what slipped through, while it’s still small.
- Malware and vulnerability scansRegular scans of files and plugins against known vulnerabilities, with fixes for anything found.
- Plugins nobody uses, removedFewer plugins means fewer doors. We flag anything inactive, abandoned or out of licence.
- A clear path if the worst happensAlready hacked? We clean it first through malware removal, then bring the site into care.
Estimate your care plan
Monthly WordPress maintenance, sized to your site.
A blog and a busy store don’t need the same care. Pick what fits for a yearly ballpark — the quote you receive is a fixed monthly figure you can cancel any time.
WordPress support service
Real people who already know your site.
A care plan looks after your whole site, whichever theme you use — it isn’t theme support. And when you need a small change, you ask the same team.
- Edit time for small jobsContent tweaks, a new section, a broken form — included on plans with edit time, reset each month.
- One report, every monthUpdates, backups, uptime, security and speed in plain language — easy to forward to your boss or client.
- Room to growNeed regular development time? Pair care with a developer retainer, so routine upkeep never eats into build hours.
Questions, answered
Can’t I just switch on WordPress auto-updates?
You can, and for many plugins it’s sensible. But auto-updates rely on WP-Cron, run twice a day and don’t look at your pages afterwards. A care plan adds the backup before, the visual check after and a person to fix it if something breaks.
My host already backs up the site. Isn’t that enough?
WordPress’s own guidance is to keep several recent backups in different locations, not only on the hosting server. If the server or account has a problem, a host-only backup can go down with it. Ours are stored off-site.
Do you upgrade PHP as well?
Yes. We check your PHP version during onboarding and plan the upgrade with your host, testing the site first. PHP 8.2 loses security support on 31 December 2026, and WordPress recommends 8.4 or later.
What happens if an update breaks my site?
We check every page we monitor after updates. If something breaks, we roll back from the backup and fix the cause, at no extra cost.
Does unused edit time roll over?
No. Edit time resets each month. If you need more regular development time, see developer hours and retainers.
Can I cancel any time?
Yes. Monthly plans can be cancelled at any time. Annual plans renew yearly and are billed up front.
What if my site is already hacked?
We clean it first through malware removal, then add it to a care plan.
Is this the same as theme support?
No. Theme support helps with our themes. A care plan looks after your whole site, whichever theme you use.
Get a free quote
Let’s build something great.
Tell us about your project and goals. A WordPress engineer — not a salesperson — will reply within one business day with a plan and a fixed price.
- Free, no-obligation quote within 24 hours
- NDA available on request
- Fixed price — you approve the scope before work starts
