Service Maintenance
Updates done right. Backups that actually restore. Security monitored. Performance watched. Uptime alerts that wake the right person. Built for sites that cannot go down.
Why maintenance
The site works. Until WordPress 6.5 ships and the auto-updater pushes it live and three plugins were not tested against trunk and now the admin is a white screen at 3pm on a Friday. Or until a vulnerability in a plugin you forgot you installed gets exploited. Or until backups stop running and nobody notices for six months.
Maintenance is the thing that keeps the site you spent money building from quietly degrading. We do it the way we run our own production sites: staged updates, tested backups, monitored uptime, and a response SLA that does not depend on the customer noticing first.
What we cover
Updates, backups, security, performance, uptime, reporting. Done the way our own production stack runs, with the same tooling and the same response SLAs.
01
Core, plugin, and theme updates rolled out on a staging environment first. Visual regression check against the live site. Production deploy in a low-traffic window. No surprise white screens on Monday morning.
Updates ship without breaking the site.
02
Daily incremental backups to S3 or B2 in a region separate from your host. Quarterly restore drills to verify backups actually work. Documented restore procedure, tested on real data, not just hoped to work.
Recovery time objective measured in hours, not days.
03
File integrity monitoring active. Failed login alerts. Vulnerability scans against the active plugin list every 24 hours. Critical vulnerabilities patched within the SLA, not whenever we get to it.
Vulnerabilities closed before exploitation.
04
Real User Monitoring on Core Web Vitals. PageSpeed scores tracked monthly. Slow query log reviewed for regressions. Performance regressions investigated and fixed under the retainer.
Site stays fast as plugins update and content grows.
05
External uptime monitoring from multiple regions. Alerts to Slack, email, or PagerDuty depending on tier. We respond, not just notify. Outages investigated and root-caused, not just acknowledged.
Mean time to detect under five minutes.
06
What was updated, what was patched, what changed in performance, what we recommend next. Written for the person paying the invoice, not for a developer audience. Trends visible across months.
Stakeholders see the value every month.
13 years
running WordPress production stacks for ourselves and clients
Same operational discipline applied to every retainer site.
Tiers
Scoped
Updates staggered, daily backups, vulnerability scans, uptime monitoring, monthly report, two hours of dev time. Business hours response.
Right for marketing sites and content sites.
Scoped
Everything in Standard plus 24/7 uptime alerts, four hours dev time, ecommerce-aware monitoring, custom plugin compatibility checks before updates.
Right for WooCommerce and lead-gen sites.
Scoped
Everything in Business plus 24/7 response SLA, 8 hours dev time, multisite network coverage, dedicated Slack channel, quarterly architecture review.
Right for revenue-critical and high-traffic sites.
Common questions
Updates (core, plugins, themes) on a staggered rollout. Daily backups with quarterly restore drills. Vulnerability scans every 24 hours. Uptime monitoring with response SLA. Performance monitoring with monthly review. Monthly report. Two hours of dev time per month for small fixes.
New features, design changes, plugin development, content work, marketing, SEO. Those are separate scopes, quoted separately. The retainer is purely operations and maintenance. Larger requests get scoped as projects.
External uptime monitoring detects within five minutes. We acknowledge within fifteen minutes during business hours, sixty minutes outside. Investigation starts immediately, root cause documented within 24 hours. Higher tier retainers include 24/7 response.
Yes. Both are within scope. WooCommerce sites get extra QA on plugin updates because of the ecommerce surface area. BuddyPress sites get monitoring on the activity stream and notification surfaces. We have shipped and maintained both for years.
Your host stays your host. We work with WP Engine, Kinsta, Pressable, Pantheon, Cloudways, Rocket.net, and managed VPS hosts. We will recommend a host change if the current one is the bottleneck, but we do not force a migration.
Standard retainer is scoped per site. Higher tiers (24/7 response, ecommerce SLAs, multisite networks) are scoped per project. Network maintenance for multisite quoted per network. Six month minimum commitment to capture setup cost.
Ready to stop worrying about updates?
Discovery call is free. Retainers are scope-dependent. Six month minimum.
