Vulnerability exposure
Review relevant disclosures affecting installed WordPress core, plugins, themes, PHP, and agreed server components.
Managed WordPress security
Managed WordPress Security: keep controls from drifting after the audit.
Ongoing security care tracks vulnerability exposure, update decisions, material configuration changes, administrative access, and recovery readiness. It begins with a known baseline and keeps ownership visible when the environment changes.
Never send credentials, private keys, backup archives, or confidential source code through this website.
- Best for
- Business-critical WordPress sites needing continuing security oversight
- Baseline
- Begins after an audit, cleanup, or documented onboarding review
- Focus
- Vulnerabilities, updates, access, drift, backups, and response readiness
- Reporting
- Open risks, completed actions, exceptions, and next decisions
- Typical fee
- From $75 per site per month · fleet pricing below single-site rates
Coverage
What ongoing security care can include
Update decisions
Assess urgency, compatibility risk, ownership, testing requirements, and exceptions instead of treating every update identically.
Configuration drift
Track material changes to administrative access, security controls, exposed services, and the agreed baseline.
Account oversight
Review administrative users, stale access, privilege changes, and the lifecycle of temporary accounts.
Recovery readiness
Check backup signals and schedule appropriate restoration evidence rather than assuming a successful backup job is recoverable.
Incident readiness
Keep escalation contacts, safe access procedures, evidence expectations, and response ownership current.
Operating model
Monitoring must lead to an owned decision
An alert without context or an owner is not a security outcome. Reports distinguish urgent exposure, scheduled remediation, accepted exceptions, provider-owned work, and observations that require more evidence.
The exact service boundary is documented: who applies updates, who validates compatibility, who owns the host, what constitutes an emergency, and whether remediation time is included or separately approved.
Maintenance plan or managed security
A maintenance plan keeps the site running. Managed security keeps it defensible.
Most “WordPress maintenance” plans include a security line item. This table shows what that line usually covers and what security care adds.
| Activity | Typical maintenance plan | Managed WordPress security |
|---|---|---|
| Plugin, theme, and core updates | Applied on a schedule | Triaged by exploitability, tested where the risk warrants, exceptions recorded |
| Vulnerability disclosures | Whatever the security plugin flags | Reviewed against the installed versions, with an owner and a deadline for each |
| Configuration drift | Not tracked | Administrative access, exposed services, and security settings compared to the audited baseline |
| Administrator and access review | Rarely | Monthly review of users, roles, stale access, API keys, and temporary accounts |
| Backups | Backup job runs | Restore evidence: a backup is only counted once it has been restored |
| Edge and server layer | Out of scope | Cloudflare rules, origin exposure, and agreed host controls reviewed for drift |
| Incident response | Best effort, often billed separately | Escalation path, evidence expectations, and response ownership defined in advance |
| Monthly report | Uptime and update log | Open risks, completed actions, accepted exceptions, and the next decisions |
| Content edits and feature work | Included | Not included — kept separate so security work is never displaced |
The monthly report
What arrives every month
- Open risks with severity, owner, and the decision still needed
- Vulnerability disclosures matched against installed components, with action taken
- Updates applied, deferred, or excepted — and why
- Administrative access changes and stale-access removals
- Configuration drift against the audited baseline, including edge and host controls
- Backup and restore evidence for the period
- Incidents or anomalies, how they were handled, and what changed afterwards
- Recommended next actions with an estimate of effort
Not general maintenance
Security care has a defined purpose
Routine content editing, design changes, SEO publishing, feature development, and unlimited technical support are not implied by this service. Keeping that boundary clear prevents important security work from disappearing into a generic maintenance plan.
- Security-relevant vulnerability and configuration oversight
- Risk-based update and exception tracking
- Administrative access and recovery-control review
- Security reporting and escalation
- Optional remediation and incident support when explicitly included
Common questions
Questions about this engagement
Does this replace a security plugin or managed host?
No. Existing platform and plugin controls can supply useful signals. The service adds independent review, ownership, and decisions around those signals.
Are updates installed automatically?
Only if that responsibility and workflow are explicitly included. Higher-risk sites may require staging, backups, compatibility checks, and an agreed maintenance window.
Is malware cleanup included?
Incident response is included only when stated in the service agreement. The monitoring plan defines what happens when compromise is suspected.
Can an agency use this across client sites?
Yes, after defining which party owns client communication, hosting access, updates, remediation approval, and incident escalation.
How much does managed WordPress security cost?
From $75 per site per month for a single business-critical site, with fleet pricing below single-site rates once several sites or servers share one baseline and reporting cadence. The fee follows fleet size, update ownership, included remediation time, and response expectations; the written proposal fixes it.
Is this the same as a WordPress maintenance plan?
No. A maintenance plan keeps the site running and usually applies updates on a schedule. Managed security tracks vulnerability exposure, configuration drift, access, and recovery evidence against an audited baseline, and defines what happens in an incident. The comparison table above sets out the difference line by line.