WORDPRESS MAINTENANCE & CARE

WordPress maintenance that
prevents the emergency

Most people call a developer the day the site is already down. A maintenance plan is the boring alternative: updates tested before they break things, daily backups, and someone watching so you hear about problems first.

Start a Care Plan Ask a question first

No lock-in contract Cancel any time Updates tested first Real person, same day

Why it matters

What quietly goes wrong on an unmaintained site

Nothing happens for months — and then several things happen at once, usually on a weekend. These are the four I get called about most.

🔓

Out-of-date plugins get exploited

Plugins get broken into through vulnerabilities that were already public, and often already fixed. The patch existed — nobody applied it.

💥

An auto-update breaks the layout

Hosts happily push updates straight to your live site. When two plugins disagree, you find out from a customer, not a test.

🗄️

Backups that were never tested

Plenty of sites have backups. Far fewer have backups that actually restore. You only discover which kind you have on the worst day.

⏳

Licences silently expire

A premium plugin quietly stops updating when its licence lapses — so it sits there, unpatched, looking like it works fine.

The numbers

Where the risk actually comes from

Maintenance gets sold on vague fear, so here is the actual data. It is worth reading even if you never hire anyone — because it says something specific about what to watch.

11,334

new vulnerabilities found across the WordPress ecosystem in 2025 — a 42% increase on the year before.

91%

of them were in plugins. Another 9% were in themes. WordPress core itself had six, all low risk.

5 hours

median time from a vulnerability becoming public to it being exploited at scale. Roughly half of the high-impact ones are hit within a day.

46%

had no patch available on the day they were disclosed — the flaw was public before the fix existed.

Figures from Patchstack’s State of WordPress Security in 2026, covering calendar year 2025.

WordPress itself is not your problem

Six core vulnerabilities against more than ten thousand in plugins and themes. If someone tries to sell you maintenance on the basis that WordPress is inherently insecure, they are selling the wrong thing. The risk lives in the twenty or thirty add-ons sitting on top of it — which is precisely what nobody keeps track of.

Five hours is why “I’ll do it at the weekend” fails

The gap between a flaw becoming public and bots sweeping the internet for it is measured in hours, not weeks. That is not a window you can cover by logging in when you remember to. It is the entire argument for someone else watching the update feed on your behalf.

Nearly half have no fix when they go public

Updating promptly is necessary but not sufficient — for close to half of these, there is nothing to update to on day one. That is when it matters whether anyone is actually monitoring the site, ready to disable a plugin or put a rule in front of it until a patch lands.

None of this requires a care plan to act on. If you would rather do it yourself, the takeaway is simple: watch your plugins, not WordPress.

Plans

Pick the level your site needs

Same care either way — the difference is how much is at stake if the site goes down, and how much editing you want included.

🌱

Essential

$39/mo

brochure & business sites

Tested core, theme & plugin updates
Weekly off-site backups
Security scanning & hardening
Uptime monitoring
30 min of edits per month
Licence renewal tracking

Start Essential

Store

$69/mo

WooCommerce & booking sites

Everything in Essential
Daily off-site backups
Checkout monitoring & test orders
Staging-first updates
1 hour of edits per month
Extension licence management

Start Store care

🚨

Priority

$129/mo

high-traffic & revenue-critical

Everything in Store
Same-day priority response
Emergency fixes included
Monthly speed & health report
3 hours of edits per month
Direct line for urgent issues

Start Priority

Free for the first 30 days on any site I build. Multiple sites? Message me for agency pricing.

Every plan

What you get regardless of tier

✓Updates tested before they go live

✓Backups stored off your server

✓Restore tested, not just scheduled

✓Malware scanning and cleanup

✓A human who replies the same day

✓Cancel whenever — no contract

Each month

What actually happens on your plan

Backup & snapshot

A full copy is taken and verified before anything is touched, so there’s always a clean point to roll back to.

Update on staging

Core, theme and plugin updates go onto a copy first. If something conflicts, it breaks there — not in front of your customers.

Check & push live

Key pages, forms and checkout are checked, then the updates go live. Anything that can’t be updated safely gets flagged to you with options.

Your edits & a summary

I run through your requested changes and send a short plain-English note of what was done and anything worth knowing.

Questions

Frequently asked questions

My host says it does automatic updates. Isn’t that enough?

Not really. Hosts apply updates straight to your live site with nothing testing whether your particular combination of theme and plugins still works afterwards. That’s how a site goes down at 2am with nobody watching. The difference here is staging, checking, and a person who notices.

Does this include hosting?

No — and that’s deliberate. You keep your own hosting in your own name so you’re never locked to me. If your host is the actual problem I’ll say so and help you move, but I’d rather not be your landlord and your handyman.

What counts as “edits”?

Content and small visual changes: text, images, prices, adding a page, swapping a banner, updating opening hours. New features or design work are quoted separately — I’ll always tell you which one something is before doing it.

What if my site gets hacked while on a plan?

On Priority the cleanup is included. On Essential and Store I’ll restore from the most recent clean backup at no charge; a full forensic cleanup, if one is needed, is quoted separately. Either way you won’t be left dealing with it alone.

Can you maintain a site you didn’t build?

Yes. I’ll do a free look over it first and tell you honestly whether it’s in a fit state to maintain, or whether something needs fixing before a plan makes sense. I won’t take a monthly fee for babysitting a site I know is about to fall over.