Overview
Most websites are not attacked because someone targeted the business. They are attacked because an automated scanner found a plugin that has been out of date for eight months. Maintenance is unglamorous and it is the cheapest insurance you will buy.
It is also where most agencies quietly stop caring once a project is signed off. We treat support as an ongoing engagement with defined response times, not a favour we do when we have spare capacity.
What a maintenance plan covers
- Updates, applied safely. Core, plugin, theme and dependency updates applied on staging first, checked, then released — never straight onto the live site on a Friday afternoon.
- Security patching prioritised by severity, with critical vulnerabilities handled out of the normal cycle.
- Backups that are tested. Automated, off-site, encrypted, and periodically restored to prove they work. An untested backup is a hope.
- Uptime and performance monitoring from outside your own infrastructure, with alerts to us before your customers notice.
- Security monitoring for file changes, malware and unexpected administrator accounts.
- SSL, domain and renewal tracking, so nothing expires quietly over a weekend.
- Included development hours each month for content changes, small features and fixes, so routine requests do not need a quote every time.
- A monthly report covering what was updated, what was blocked, uptime, performance and the hours used.
Response times
Severity decides the response, and the targets are written into your agreement rather than left vague. A site down or a live security incident is treated as the priority and worked continuously until it is resolved. A broken feature affecting customers is next. Content changes and small improvements are scheduled into the normal cycle. You always know which category your request is in.
Taking over someone else's site
Most support engagements start with a site we did not build. That is normal, and the first month looks different:
- A full audit — platform and PHP versions, plugin and dependency health, known vulnerabilities, backup status, performance and hosting setup.
- Access consolidated and documented, because the single most common problem we inherit is that nobody knows who holds the domain or the hosting login.
- Version control and a staging environment put in place if they do not exist.
- The urgent security and stability issues fixed first, with anything else priced separately so there are no surprises.
Hosting
We can work with your existing host or move you somewhere better suited. Where we manage hosting, that covers server hardening, PHP and database tuning, caching, CDN configuration and capacity for traffic peaks. Where we do not, we will still tell you plainly when the host is the reason the site is slow.
What you get
- A named point of contact and defined response times by severity.
- Updates applied on staging before production, with a rollback path.
- Off-site backups that have been restored in a test.
- Monitoring and alerting, with us notified before you are.
- Included hours each month for real work, not just watching.
- A monthly report in plain language.
Nobody notices maintenance until the month it is missing. That month costs more than a year of it.