What care actually means
Care turns that risk into a steady schedule, with a report from every review. Engine, theme and plugins get their fixes in time, so bots cannot exploit the holes in older versions. A site left to itself can look perfectly fine right up to the break-in. By then it is too late to update.
What happens in every cycle
Monitoring and detection
Constant insight into site availability and file integrity. I know about a problem before your customer sees it.
Updates without risk
Core, plugins and theme go to a development copy first, with a visual before-and-after comparison. Only a verified change reaches production.
Backups
Database and files secured before every change on production. Every backup is test-restored right after it is made, not just declared to work.
Audit and hardening
A security review with a recorded baseline of accounts, permissions, keys, passwords and attack surface. Every following review catches any change since then, be it a new account, a plugin or a permission.
A report after every review
Scope of work, site condition, recommendations. You always know what is happening with your site and what you pay for.
Three levels, one procedure
The level comes from what happens when the site goes down, or when data leaks out of it. Not from the address, and not from the list of installed plugins.
- Level 01
Basic
60 EURMonthly retainerWhat kind of siteA brochure or information site, with a contact form at most.
What that meansA backup once a week, kept for at least 30 days, a test of the form after updates, updates through the regular review path.
Onboarding setup120 EUR
- Level 02
Elevated
90 EURMonthly retainerWhat kind of siteA site with user accounts, event sign-ups, content behind a login or a database holding personal data.
What that meansA backup every other day, kept for at least 30 days, the test also covers logging in, plugins relevant to accounts and data are checked before they go in.
Onboarding setup190 EUR
- Level 03
Critical
140 EURMonthly retainerWhat kind of siteA shop, payments, a site that is part of a sales or recruitment process, a site run for an end client.
What that meansA backup once a day, kept for at least 30 days, a full user-journey test, major releases only after a check on a copy, priority in urgent mode.
Onboarding setup280 EUR
- Net prices, per site per month. List prices; I confirm the amount for a specific site after the site inventory.
- Onboarding setup is a one-off, per site.
- The level changes with the function of the site, for example when sales go live. The new rate applies from the next month, announced in advance.
What the price covers, and what it does not
Automatic engine security fixes, with verification that they actually went through.
A monthly review of plugins, theme, major releases, licences and user accounts.
A test of the key function. The form reaches your inbox, the shop takes an order, the login works.
A before-and-after visual comparison of the key pages at two screen sizes.
Hardening the installation and keeping it that way.
Backups with trial restores. A backup never restored is a hope, not a backup.
Uptime monitoring and file integrity checks, which catch changes nobody made.
A review report. Date, versions before and after, security fixes, test result, anything found.
A data processing agreement if the site handles personal data. No extra fee.
Development work, new features, changes to content and design, rebuilds and migrations. Project-based, quoted up front.
Cleaning up after a successful break-in. A separate job, billed for the time it takes.
Paid plugin licences. I flag them before they expire; the decision and the cost are yours.
Backup storage outside the production server, if it turns out to be needed. The backups themselves are in the retainer.
Coordination with the hosting provider and reviews after third-party changes. Hourly.
Content, campaigns, SEO and anything not in the retainer.
The scope list is closed. Work outside it is agreed and quoted before it is done, never added quietly.
Urgent mode, when it cannot wait
working hours at most from your report to my response
A disclosed vulnerability that can be exploited without logging in, or an outage that blocks the key function of the site, does not wait for the monthly schedule.
Keeping watch is my duty, not yours. I assess scanner alerts and published reports on new WordPress vulnerabilities without being asked, and start securing the site as soon as I have.
That watch covers what is published. It is a commitment to keep watch and respond according to the procedure, not a promise that an incident will never happen.
By e-mail or by a monitoring alert.
Diagnosis and the decision on what comes next. Working days 09:00-17:00 CET, no round-the-clock standby.
The fix installed or the function restored. Up to 3 hours per event and 6 hours per month in the retainer.
How it works, from the first message
Three steps from your message to steady care. First the site inventory, then the onboarding setup of each site, and from there a monthly schedule with a report.
Site inventory
A list of addresses with the owner, the host and the level for each. Drawn up together and attached to the contract.
Onboarding setup
One site at a time. Inventory, hardening, backups, monitoring and a recorded baseline.
Monthly schedule
Once the setup is complete, the site is covered. A review once a month, and you get the report without having to ask.
What I need from you
- Access
- An administrator account created separately for me, without sharing your own password.
- Notice of changes
- Everyday work in the WordPress admin needs no notice. A new plugin, a theme change, a new administrator account or another contractor on the site does.
- Decisions in urgent mode
- A named person who decides, or standing consent to the necessary actions, with a hard cap on additional hours.
Who this is not for
A site still being built, or one that needs a rebuild
Care keeps a site running. It does not build one. A new site, a rebuild and a migration are a project with a quote up front.
A shop that has outgrown WooCommerce
If updates are only a symptom and the shop itself is the problem, the answer is a rebuild on a headless stack, not a retainer.
A site on a website builder or on Shopify
The vendor updates the engine there. That leaves accounts, integrations, third-party scripts and backups, a different scope at a different price, agreed after a conversation.
Let's start with a conversation.
Every project starts with a first conversation. We sign a contract only once both sides know this collaboration makes sense.
Your data is secure and will not be shared with third parties