One platform, nothing else
WordPress Only, 10+ Years: What Backs Every Number We Publish
10+ years on WordPress and no other platform, 100+ sites under management, 500+ hacked sites recovered and 150+ malware removals. Every figure comes from our own service records, and the criteria below let you verify any of it - what each number counts, the response window in hours, the last restore-test date, the exit terms. Then send a site address and get a written assessment.
- 10+ years on WordPress, and no general web development
- 100+ client sites under management right now, worldwide
- 500+ hacked sites recovered, 150+ malware removals
- Plans from $39 a month, no contract, 30-day money back
WordPress Maintenance Service is a remote, WordPress-only maintenance team working worldwide on one platform for 10+ years. It manages 100+ client sites, has recovered 500+ hacked installations and removed malware from 150+, on plans from $39 a month.
Everything we handle
- Update managementCore, plugins and themes on a staging copy first, then the checks that earn money - checkout, forms, login - then promotion. Anything that fails stays on the old version and you are told which and why.
- Security and hardeningLogin lockdown, two-factor, a unique login URL, XML-RPC closed, user enumeration blocked, security headers, file and database permissions, and daily scanning.
- Backups and restoreOff-site copies on infrastructure separate from the host, so a host failure cannot take both. Restored on request, and tested rather than assumed.
- PerformanceImage optimisation, server-level caching, database work and origin response time, measured against field data rather than a lab score.
- Malware removal and hack recoveryCleanup, the entry route, whatever persisted, and blacklist clearance. Included from Professional; unlimited on Business.
- MigrationWix, Squarespace, Shopify, Drupal, Weebly, Webflow, Magento, Umbraco and Sitecore, plus host-to-host moves, with the redirect map built before anything switches.
- WooCommerceCheckout, payment gateways, subscriptions and the release testing a store needs and a brochure site does not.
- Build workCustom plugins, membership, multilingual, events and job boards. Quoted separately from maintenance rather than absorbed into a monthly fee.
Why one platform and nothing else
Most companies offering WordPress maintenance also build on Shopify, Webflow and whatever the client asked for last. That is a reasonable business and it is a different business from this one.
The argument for specialising is not that WordPress is harder. It is that maintenance is a recognition problem. A plugin conflict, a fatal after a PHP bump, a Japanese keyword injection, a checkout that stops completing after a WooCommerce release – each one is either something you have seen before or something you research from scratch while the site is down. A decade and more on one platform is that much recognition accumulated, and none of it transfers from another platform.
The cost is real and worth stating. We decline work on other platforms, and where a site should not be on WordPress at all, the honest answer is that we are the wrong supplier. What we do take on, month to month, is the whole of WordPress maintenance: patching, hardening, backups, monitoring and repair.
What the numbers prove, and what they do not
Every provider in this market publishes round figures. Ours are on this page because leaving them off would be strange, not because a figure settles anything.
- 100+ sites under management is a current count, and it is the only figure here that can go down. It is the one worth asking about.
- 500+ recoveries and 150+ malware removals are cumulative over the whole 10+ years. Read as an annual rate they would be wrong by an order of magnitude.
- 1,000+ sites built is build work. It says where the platform knowledge came from and it says nothing about maintenance.
- 50+ plugins worked with is a floor, not a limit, and it exists because plugin familiarity is what makes an update decision fast.
None of that is auditable by you, which is the point of the criteria above. Response windows, staging, restore-test dates, report contents and exit terms are all checkable before you pay anybody, including us. The fastest check on this one is to request a free site review and read what comes back.
Where the 24/7 actually applies
Three different things get sold as 24/7 and this site keeps them apart.
- Monitoring, scanning and backups run continuously because they are software. Every provider has this and none of them should charge for the phrase.
- An outage or an active compromise is answered at any hour, nights and weekends included, on every plan. That is a person, and it is the half most providers leave undefined.
- Plan support is business hours at 48, 24 or 8 by tier. Questions, edits and planned work wait for a working day, and pretending otherwise would make the first two claims worth nothing.
What we do not claim
There is no office you can visit, no phone number that reaches a desk, and no case study on this page. The team is remote and the client work is under agreement.
Where a provider does publish named case studies, ask whether the client agreed to it, because the ones who did are the ones worth calling. The same test applies to a team page: names and photographs are easy to produce and prove nothing on their own.
How the work runs
- OnboardingAn inventory first: versions, plugins, theme, PHP, host, current backup position and current exposure. You get it in writing before we change anything.
- Every weekUpdates go to a staging copy, get tested against what the site earns money from, and promote only on a pass. A release that breaks something stays back and is named in the report.
- ContinuouslyUptime checks every minute from three regions, malware scanning, and backups on their own schedule. These run through nights, weekends and holidays because they are automated rather than staffed.
- Every monthA report naming version numbers, what was deferred and why, incidents, uptime and load timings. Green ticks are not a report.
- When something breaksRoll back to the last good state, then find the cause. The order matters, and you hear it from us before a customer tells you.
- When you leaveCancel any month. No notice period, no exit fee, and the backups are yours. A provider holding your backups is holding your site.
What to judge it on
- Ask for the response window in hours, and what bypasses itOurs is 48 on Starter, 24 on Professional and 8 on Business, in business hours - and an outage or active compromise bypasses all three and is answered at any hour. A provider advertising 24/7 that cannot draw that line is advertising its monitoring, which is a machine.
- Ask which tier includes malware cleanupOurs includes it from Professional and makes it unlimited on Business. The tier where a capability first appears is the real price of the plan, not the headline figure.
- Ask when a restore was last testedAn untested backup is a hypothesis. Ask for the date of the last restore test and how long the restore took.
- Ask whether updates are stagedUnstaged updates are the single largest cause of a site breaking while on a maintenance plan. Staging is the difference between maintenance and automation.
- Ask what the monthly report containsVersion numbers, incidents and deferred work, or a page of green ticks. Ask for a sample before signing anything.
- Ask what leaving costsNo contract, no notice, no exit fee, and you keep the backups. Every one of those is a question with a yes or no answer.
- Ask what a figure counts100+ is sites under management today. 500+ recoveries and 150+ malware removals are cumulative across 10+ years, not annual. 1,000+ is sites built, which is separate work from maintaining them. A number with no denominator is decoration.
Questions people ask before calling
Who actually does the work?
A small remote team working on WordPress and nothing else. There is no ticket queue routing you to whoever is free and no handoff to a third party - the people who onboard your site are the people who patch it.
Where are you based?
The team is remote and clients are worldwide, which is what makes round-the-clock outage cover possible without a night shift in one city. Plan support runs in business hours; outages and active compromises are answered at any hour.
How long have you been doing this?
10+ years, on WordPress only. That is a deliberate constraint rather than a limitation - one platform's release cycle, plugin ecosystem and attack surface is enough to fill the attention.
Where do the figures on this page come from?
Figures are our own service records to 3 September 2026, not industry estimates. 100+ is sites under management today. 500+ recoveries and 150+ malware removals are cumulative. 1,000+ is sites built, which is build work rather than maintenance.
Do you work with agencies?
Yes, through a white-label programme. The work is delivered under your brand and your reporting, and we have no contact with your clients at any point.
What happens on the day something breaks?
Rollback to the last good state first, cause second. You are told what happened and what we did, in writing, before your customers find it.
Can I cancel?
Any month, with no notice period and no exit fee. You keep your backups, and the first month carries a 30-day money-back guarantee.
Want someone to look at it?
Send the address. You get a written assessment, not a sales call.
Related pages