Start with an audit
Before any ongoing commitment, you get a clear picture of what you own: risks, abandoned plugins, backup reality, and what it would take to make the site boring.
On this page
What a care plan covers
| Area | What actually happens |
|---|---|
| Updates | Core, plugins and themes applied on staging first, checked against your critical pages, then deployed. Rolled back if they misbehave. |
| Backups | Off-site, on a schedule that matches how often your content changes — and periodically test-restored, because that's the only way to know they work. |
| Monitoring | Uptime, plus file-integrity and unexpected-admin-user checks. You want to hear it from me, not from a customer. |
| Security | Hardening, credential hygiene, plugin vulnerability tracking against known CVEs, and removal of abandoned plugins. |
| Performance | Periodic Core Web Vitals checks so the site doesn't silently degrade as content and plugins accumulate. |
| Reporting | A short monthly written report: what changed, what I found, what I recommend. In plain language. |
| Priority response | Plan clients go to the front of the queue when something does break — and I already know the site. |
Why "just update everything" breaks sites
Updating is necessary — unpatched plugins are the single most common way WordPress sites get compromised. But updating carelessly is its own outage. The failure modes are boringly consistent:
- The plugin author changed something. A major version renames a function your theme calls, and the site fatals on the next page load.
- PHP moved underneath you. Your host upgrades PHP, and a plugin using removed syntax dies instantly — from your side nothing changed at all.
- The abandoned plugin. No update in three years, and one day it stops working with current WordPress. There's no patch coming; it needs replacing, which takes planning.
- The premium plugin whose licence lapsed. It keeps working but stops receiving security updates — and nobody notices until it's the entry point.
Staging exists precisely so you find these on a copy instead of on your storefront. That's the whole difference between maintenance and pressing "update all" and hoping.
Your backup probably doesn't work
I say this to nearly every new client, and I'm right more often than I'd like. Three ways backups fail at the exact moment you need them:
- It's on the same server as the site. Which is fine for a bad plugin update, and worthless if the account gets suspended, the disk fails, or the attacker deletes it — which good ones do first.
- Retention is shorter than your detection time. Seven days of backups doesn't help with a compromise that started three weeks ago. Every restore point you have is already infected. This is the single most common reason a hack becomes unrecoverable.
- Nobody has ever restored it. Truncated database dumps, missing uploads, a backup that silently stopped running months ago. Until a restore has been performed, you don't have a backup — you have a belief.
Custom development
Maintenance and building are the same discipline seen at two points in time — a site built carelessly is expensive to maintain forever. What I build:
- Custom themes and blocks — built on the block editor properly, so your team can edit content without needing a developer, and without a page-builder's runtime tax on every visitor.
- WooCommerce — stores that stay fast past a few thousand orders, which is where most builds fall over.
- Membership and gated platforms — where correctness around access control actually matters.
- Migrations — host to host, staging workflows, domain changes, HTTP to HTTPS, without losing your search rankings in the process.
- Untangling — replacing the twelve plugins doing what three should, which is usually both a speed and a security win.
No lock-in, by design
Everything is handed over documented: what's custom, why, and how to change it. If you want to move to another developer or in-house team later, you can — without a rebuild. A client who stays because leaving is painful isn't a client I want.
Inheriting someone else's site
The most common situation I'm brought into: the person who built it is gone, there's no documentation, the theme is custom, and nobody's confident touching anything. That's a normal Tuesday.
It starts with an audit, not a contract. You get a written picture of what you own: what's custom versus plugin, what's abandoned, what's a security risk, whether the backups are real, and what it would cost to make the whole thing boring and predictable. Then you decide what you want to do about it — including nothing.
FAQ
Why pay for maintenance when WordPress updates itself?
Automatic updates cause a large share of the emergencies I'm called about. WordPress will happily apply an update that breaks your theme, and nobody notices until a customer complains. Maintenance means updates are staged, checked against the pages that make you money, and rolled back if they misbehave.
Isn't my host already backing up my site?
Usually yes — on the same infrastructure as the site, with retention measured in days. That doesn't help if the account is suspended, the compromise went unnoticed for three weeks, or the restore has never been tested. A backup nobody has restored is a hypothesis.
What does a care plan include?
Staged and tested updates, uptime and integrity monitoring, verified off-site backups, security hardening and review, periodic performance checks, a monthly written report, and priority response when something breaks.
Can you take over a site built by someone else?
Yes — that's most of the work. I start with an audit so you know what you actually own before committing to anything ongoing.
Do you build new sites, or only maintain existing ones?
Both. Custom themes and blocks, WooCommerce, membership platforms, migrations. Builds are handed over documented, so you're never locked in.
What if I only need occasional help?
That's fine — ad-hoc work is billed hourly with no plan required. The plan exists because prevention is cheaper than emergencies, not because it's the only way to work with me.
Get started
Tell me about the site. Audit first, decisions after.