Website Maintenance

Managed updates, patching and security for WordPress and other websites — audited first, fixed before it is maintained, then kept current on a schedule measured in hours rather than months.

A hardened server protects the platform a website runs on. It does not patch the website's own code. That job belongs to somebody, and on most of the sites we are asked to look at, it has quietly belonged to nobody for a year or more.

The cost of that changed in 2026. Vulnerabilities in plugins and themes are now found by machines rather than people, published in volume, and exploited at scale within hours. The compromise that follows is designed to stay hidden: the site keeps working, the owner sees nothing wrong, and the attacker reads the database or uses the server for months. We wrote about how that shift happened, and what it means, in our articles.

How we work

We do not put a neglected site straight onto a maintenance plan. It gets audited, then repaired, then maintained — three separate pieces of work, so you can see exactly what you are paying for at each stage.

1. Audit — £295, credited against remediation

   A fixed-fee assessment of what you are actually running: core, plugin and theme versions and which of them are abandoned, PHP branch and how long it remains supported, bespoke and legacy code, forgotten staging copies and subdomains, administrator accounts, backups, and the security posture of the server underneath. We also check for the signs of a compromise that has already happened. You receive a written report with findings, risks and a fixed quote for the work needed. It is yours whether or not you proceed with us.

2. Remediation — quoted from the audit

   Bringing the site up to date without breaking it: staged core, plugin and theme updates tested before they go live, abandoned plugins replaced rather than merely updated, unused themes and dead code removed from disk, PHP upgraded where the version is out of support, security and backup systems installed and configured properly. For a neglected but clean site this is typically £450 to £1,200. Sites with substantial bespoke code, or an active compromise, cost more. Every figure on this page is indicative — the exact price comes from the audit, because until somebody has looked, nobody can tell you honestly what it takes.

3. Maintenance — from £85 a month

   Once the site is clean and current, keeping it that way is a routine rather than a project. Choose the plan that matches what the site is worth to the business.

Maintenance plans

Prices are per website. Plans include the licences and tooling needed to deliver them. Sites hosted with us and sites hosted elsewhere are both welcome, though we can do more, and respond faster, where we control the server as well — see managed website hosting.

If the audit finds you have already been compromised

It happens more often than owners expect, because a modern intrusion is built not to be noticed. If we find one, we stop and talk to you before touching anything: evidence needs preserving, credentials need treating as known to somebody else, and the question of whether the server itself is affected has to be answered before the website is cleaned.

Clean-up is charged at our standard rate rather than as a fixed quote, for the simple reason that nobody can scope it before they know what is in there. Deleting the visible malware and declaring the job done is how sites end up being cleaned three times.

Related: managed website hosting, cyber security services and IT support services.