Care plans
Five hours.
That is the weighted median time between a WordPress vulnerability being disclosed and the first attacks against it, according to Patchstack’s State of WordPress Security in 2026. About half of high-impact vulnerabilities are exploited within 24 hours. A site that is updated “when someone gets to it” is not maintained; it is exposed.
What maintenance actually is
A routine, not a click.
Most sites are “maintained” by pressing Update when the orange badge appears, or by ignoring it until something breaks. Both end the same way: a plugin conflict on a Friday, a checkout that stopped working two weeks ago, a site running a version with a known hole.
Maintenance done properly is a routine: a backup, then the updates, then a check of the things that matter on your site (forms, checkout, translations, login), then a note that says it was done. Every month, by someone who knows what to look at when the check fails.
Stability
Updates fix conflicts between plugins, themes and WordPress itself. Skipping them lets those conflicts pile up until one update breaks three things at once.
Security
Outdated software is the most common way WordPress sites get compromised. Regular updates remove most of that risk; nothing removes all of it.
Function
Forms, shops and bookings should keep working after an update. Someone has to check, every time.
Three plans
Pick by how much the site changes.
Monthly, cancel any time. Yearly billing: eleven months for the price of twelve.
Starter
EUR 45 / month
Small sites and landing pages that rarely change.
A monthly update round for WordPress core, themes and plugins, and straight away when there is an urgent security release. A backup before every update round, a monthly security check, and a confirmation email when it is done.
Nothing else, on purpose.
Basic
EUR 79 / month
Company sites and blogs with regular changes.
Everything in Starter, plus: weekly updates, daily backups, a weekly security check, uptime monitoring, a monthly report, 15 minutes a month for small changes.
Business
EUR 129 / month
Shops and large sites that change daily.
Everything in Basic, plus: backups every 12 hours, a daily security check, performance monitoring, 30 minutes a month, same-business-day reply, a short check-in every quarter. For WooCommerce: weekly updates tested against the checkout and payment plugins.
Every plan starts with a takeover check: versions, known vulnerabilities, backup state and access. Individual plans for sites with their own requirements: agreed response times, several environments, quarterly check-ins with your team, an agency in between. Repairs and changes beyond your plan are quoted before they start. White label for agencies on every plan. Every website I build includes three months of Basic.
Security
Not an add-on.
Security is not something you book later. It is part of running the site: current software, backups that have been restored at least once, a host with sensible defaults, and someone looking at the logs.
There is no absolute security on the web. There is a large difference between a site nobody looks at and a site somebody does.
Not covered
What a plan does not include.
Hosting, domains and premium plugin licences stay in your name and on your invoice. Redesigns, new features and debugging beyond the included minutes are quoted separately as a fixed price before they start.
If your site is already broken, start with a Diagnosis, not a plan.
Which one?
Tell me what kind of site you have and I will say honestly which plan makes sense, and whether you need one at all.
All prices net, excluding VAT. Monthly plans can be cancelled at any time; yearly plans run for twelve months. Response times apply on business days, Vienna time.