WordPress maintenance
Your WordPress site, kept current and running
A backup before every update. Tested on a staging copy when your host supports it. Someone who notices when it goes down.
I build WordPress for a living: plugins on WordPress.org, 30+ custom Gutenberg blocks, multilingual sites. So when an update breaks something, I fix the cause instead of rolling back and hoping. One person, fix time included, no ticket queue.
Hacked?
Posts you didn't write. Start here.
The usual signs: posts or pages nobody on your team wrote, often casino or gambling spam; links hidden in the page; admin users you don't recognise; a warning from Google or from your host. It is common on WordPress, and it usually comes in through a stolen password or an out-of-date plugin.
- Two things you can do today, whoever does them: delete any users you don't recognise, and change every admin password.
- What the cleanup does: I work out how they most likely got in, remove what they left behind, close those ways in, and bring everything current, with a backup taken first.
- How it runs: a one-time cleanup after I've looked at the site, then the monthly plan keeps it that way and makes a repeat far less likely.
Deleting the spam posts does not close the way in. Send me the address and I'll tell you what I see on the public pages before you decide anything.
Every month
What's included
Updates, done safely
WordPress core, plugins and theme. Backed up first, tested on a staging copy when your host provides one, then applied to the live site and checked. Major versions (a big Elementor or WooCommerce jump) get extra care, and I tell you before I start.
Backups you can restore
Regular automatic backups stored off your server, plus one before every change I make. I test that backups restore, not just that they ran.
Uptime & security
Monitoring that tells me when the site is down, SSL kept valid, security scanning, removal of plugins and admin accounts that shouldn't be there anymore, and the load time on a phone checked every month.
Fix time
Up to 3 hours a month for the small things: a broken form, a layout glitch after an update, a slow page. Anything bigger is quoted first, and you decide.
A short monthly report
What was updated, what I found, what I fixed, and anything you should know about. One email a month.
One person who knows your site
Not a rotating support desk. The same developer every month, who remembers why that plugin is there.
Catch-up
Before and after the first month
Most sites arrive somewhere on the left. The one-time catch-up gets them to the right, and the monthly plan keeps them there.
- WordPress two versions behind
- 14 plugin updates waiting, one no longer maintained
- Spam pages nobody on the team wrote
- Homepage takes 20+ seconds on a phone
- "Not secure" in the browser
- Last backup: unknown
- Nobody is told when it goes down
- Core, plugins and theme current, tested on staging first
- Spam removed, unknown admin accounts gone, likely ways in closed
- Images and plugins trimmed, checked on a phone
- SSL valid and renewing, HTTP redirects to HTTPS
- Nightly off-server backups, restore tested
- Uptime and SSL monitored, I get the alert
- One email a month
Slow on phones?
When the homepage takes twenty seconds in front of your bookings.
Most slow WordPress sites are slow for ordinary reasons: oversized images, too many plugins doing the same job, no caching, or hosting that has been outgrown. I measure the page weight and the load time on a phone first, then fix the causes in order of size.
- Small fixes, like compressing images or removing a plugin that duplicates another, come out of the monthly fix time.
- Bigger work, like a theme that loads everything on every page, is quoted first, and you decide.
- No numbers promised before I've measured. After the first month the report shows the load time on a phone, every month.
Advocacy and crisis organisations
For nonprofits whose visitors need privacy and a fast way out.
- A quick exit that works. Built the safer way: it replaces the page instead of linking away, so the Back button does not return to your site. Tested on phones, where most of your visitors are.
- No tracking on survivor-facing pages. No analytics, no third-party scripts, nothing that leaves a record on a shared device.
- Private chat, if you want one. GhostChat, which I make, has a privacy mode that leaves no trace of the chat on the visitor's device. A domestic-violence centre uses it on its crisis chat.
- Fast on a phone, because someone in a hurry on an old phone should still reach your hotline number.
- Same plan as everyone else, month to month.
Write to the office address rather than the hotline, and I will do the same.
Why me
A developer doing the upkeep
Most maintenance services are good at clicking "update" and bad at what happens when it breaks. I've been on the building side of WordPress for years:
- Two plugins on WordPress.org, one of them a WooCommerce payment gateway, so I know how plugins behave when WordPress or WooCommerce changes underneath them.
- 30+ custom Gutenberg blocks for enterprise clients at a digital agency, plus Elementor sites and WPML multilingual builds with Hebrew RTL and English LTR.
- Looked after three independent clients' sites: kept WordPress, Elementor and plugins current, managed DNS, SSL and caching across cPanel and Cloudflare, and ran the Search Console side.
- A broken Elementor site rebuilt end to end for a freelance client, with new pages designed on it.
If an update breaks something, it's on me. Because every change starts with a backup, the worst case is a quick restore, and fixing what the update broke comes out of my time, not your fix hours.
Our company relies on the systems he built for our day to day business operations.
The small print
What stays yours, and what happens if I'm not around.
- If I'm unavailable
- Your logins stay yours and your backups live outside my infrastructure, so little depends on me being reachable. If I can't answer for more than two business days, a backup developer who holds your documentation steps in. Published here so you never have to ask.
- Ownership
- Your site, your hosting, your domain. Custom code is yours when the job is done. If you leave, you get your latest backup.
- No lock-in
- Month to month, cancel with a month's notice. A short service agreement covers liability and ownership, so both sides know where they stand.
Questions
Common questions
How does it start?
Send me the address. I look at the public pages, tell you what shape the site is in and what the first month would involve, and you decide. Nothing changes on your site until you say so.
My site has been hacked. Can you clean it up?
Yes. Posts or pages you didn't write, admin users you don't recognise, a warning from Google or from your host: those are the usual signs. I look into how they got in, remove what they left behind, close the likely ways in, and bring everything up to date to make a repeat far less likely. Cleanup is a one-time job, quoted after I look at the site. The monthly plan then keeps it that way.
The browser says "Not secure", or the certificate expired. What now?
Either the SSL certificate has run out, or the site still answers on plain HTTP without redirecting to HTTPS. Both are fixed by renewing the certificate, setting it to renew itself, redirecting HTTP to HTTPS, and cleaning up anything on the page still loading insecurely. It is a one-off fix if you don't want a plan, and part of the plan if you do.
Do I have to move hosting?
No. I work with the hosting you already have. If it's causing problems (slow or unreliable), I'll tell you and suggest options, but moving is your call.
What access do you need?
An administrator login for WordPress, your hosting panel, read access to your domain/DNS settings, and Cloudflare if you use it. You keep ownership of everything: your site, your hosting, your domain.
Can I cancel?
Anytime, with a month's notice. No minimum term. If you leave, you get your latest backup and everything stays yours.
Want your site looked after?
Send me the address. I'll take a look and tell you what shape it's in and what the first month would involve.
- Send me your site's address
- I look and tell you what I find
- The first month starts when you say go