Vulnerability exposure
Review relevant disclosures affecting installed WordPress core, plugins, themes, PHP, and agreed server components.
Managed WordPress security
Managed WordPress Security: keep controls from drifting after the audit.
Ongoing security care tracks vulnerability exposure, update decisions, material configuration changes, administrative access, and recovery readiness. It begins with a known baseline and keeps ownership visible when the environment changes.
Never send credentials, private keys, backup archives, or confidential source code through this website.
- Best for
- Business-critical WordPress sites needing continuing security oversight
- Baseline
- Begins after an audit, cleanup, or documented onboarding review
- Focus
- Vulnerabilities, updates, access, drift, backups, and response readiness
- Reporting
- Open risks, completed actions, exceptions, and next decisions
- Typical fee
- From $75 per site per month · fleet pricing below single-site rates
Coverage
What ongoing security care can include
Update decisions
Assess urgency, compatibility risk, ownership, testing requirements, and exceptions instead of treating every update identically.
Configuration drift
Track material changes to administrative access, security controls, exposed services, and the agreed baseline.
Account oversight
Review administrative users, stale access, privilege changes, and the lifecycle of temporary accounts.
Recovery readiness
Check backup signals and schedule appropriate restoration evidence rather than assuming a successful backup job is recoverable.
Incident readiness
Keep escalation contacts, safe access procedures, evidence expectations, and response ownership current.
Operating model
Monitoring must lead to an owned decision
An alert without context or an owner is not a security outcome. Reports distinguish urgent exposure, scheduled remediation, accepted exceptions, provider-owned work, and observations that require more evidence.
The exact service boundary is documented: who applies updates, who validates compatibility, who owns the host, what constitutes an emergency, and whether remediation time is included or separately approved.
Why ongoing
What a yearly audit cannot do: keep up with what changes in between
An audit is a photograph. The value of a recurring service is that the four things which decay fastest after the photograph are reviewed every month by someone who knows the baseline.
The service is priced per site per month because that is how the work arrives: a steady flow of small decisions, each cheap to take on time and expensive to take late.
New disclosures every week
Plugin and theme vulnerabilities are published continuously. Each one is matched against what is actually installed, rated for exploitability on this site, and given an owner and a deadline, instead of waiting for the next audit or the next incident.
Drift after every change
A new plugin, a developer handover, or a “temporary” setting moves the site away from the audited baseline. The monthly review compares the current state against it, so drift is caught in weeks rather than discovered during a breach.
Access that accumulates
Agencies, freelancers, and application passwords are added and rarely removed. A monthly access review removes stale accounts and keys before they become the entry path.
Backups that stop working quietly
A backup job that still runs can still fail to restore. Restore evidence is collected on a schedule, so the first restore attempt is never during an incident.
Maintenance plan or managed security
A maintenance plan keeps the site running. Managed security keeps it defensible.
Most “WordPress maintenance” plans include a security line item. This table shows what that line usually covers and what security care adds.
| Activity | Typical maintenance plan | Managed WordPress security |
|---|---|---|
| Plugin, theme, and core updates | Applied on a schedule | Triaged by exploitability, tested where the risk warrants, exceptions recorded |
| Vulnerability disclosures | Whatever the security plugin flags | Reviewed against the installed versions, with an owner and a deadline for each |
| Configuration drift | Not tracked | Administrative access, exposed services, and security settings compared to the audited baseline |
| Administrator and access review | Rarely | Monthly review of users, roles, stale access, API keys, and temporary accounts |
| Backups | Backup job runs | Restore evidence: a backup is only counted once it has been restored |
| Edge and server layer | Out of scope | Cloudflare rules, origin exposure, and agreed host controls reviewed for drift |
| Incident response | Best effort, often billed separately | Escalation path, evidence expectations, and response ownership defined in advance |
| Monthly report | Uptime and update log | Open risks, completed actions, accepted exceptions, and the next decisions |
| Content edits and feature work | Included | Not included — kept separate so security work is never displaced |
Wordfence, MalCare, Sucuri, Patchstack
Managed security vs a security-plugin subscription
A paid Wordfence, MalCare, Sucuri or Patchstack subscription automates detection and protection. Managed security keeps those tools and adds a named person who reviews what they report and decides what happens next.
Keep the subscription. Managed security uses its signals rather than replacing them — the difference is that every alert ends in a decision someone owns.
| Activity | Security-plugin subscription | Managed WordPress security |
|---|---|---|
| Firewall rules and malware signatures | Delivered and updated automatically by the vendor | Kept — the plugin’s signals feed the monthly review |
| Vulnerability alerts | Automatic notice when an installed version matches a known vulnerability | Each alert assessed for exploitability on this site, with an owner and a deadline |
| Scan findings | Emailed or shown in a dashboard | Triaged by a person; nothing is allowlisted without a recorded reason |
| Updates and virtual patches | Auto-updates or virtual patches where the product offers them | Decided by risk, tested where it matters, exceptions recorded |
| Access | Enforces login rules such as 2FA and lockouts | Reviews who has access — WordPress, hosting, keys and tokens — and removes what is stale |
| Server, edge and hosting account | Outside the plugin’s reach | Agreed host and Cloudflare controls reviewed for drift |
| When something gets through | Vendor cleanup where the plan includes it | Escalation path, evidence expectations and ownership agreed in advance |
The monthly report
What arrives every month
- Open risks with severity, owner, and the decision still needed
- Vulnerability disclosures matched against installed components, with action taken
- Updates applied, deferred, or excepted — and why
- Administrative access changes and stale-access removals
- Configuration drift against the audited baseline, including edge and host controls
- Backup and restore evidence for the period
- Incidents or anomalies, how they were handled, and what changed afterwards
- Recommended next actions with an estimate of effort
Not general maintenance
Security care has a defined purpose
Routine content editing, design changes, SEO publishing, feature development, and unlimited technical support are not implied by this service. Keeping that boundary clear prevents important security work from disappearing into a generic maintenance plan.
- Security-relevant vulnerability and configuration oversight
- Risk-based update and exception tracking
- Administrative access and recovery-control review
- Security reporting and escalation
- Optional remediation and incident support when explicitly included
Common questions
Questions about this engagement
Does this replace a security plugin or managed host?
No. Existing platform and plugin controls can supply useful signals. The service adds independent review, ownership, and decisions around those signals.
Are updates installed automatically?
Only if that responsibility and workflow are explicitly included. Higher-risk sites may require staging, backups, compatibility checks, and an agreed maintenance window.
Is malware cleanup included?
Incident response is included only when stated in the service agreement. The monitoring plan defines what happens when compromise is suspected.
Can an agency use this across client sites?
Yes, after defining which party owns client communication, hosting access, updates, remediation approval, and incident escalation.
How much does managed WordPress security cost?
From $75 per site per month for a single business-critical site, with fleet pricing below single-site rates once several sites or servers share one baseline and reporting cadence. The fee follows fleet size, update ownership, included remediation time, and response expectations; the written proposal fixes it.
Is this the same as a WordPress maintenance plan?
No. A maintenance plan keeps the site running and usually applies updates on a schedule. Managed security tracks vulnerability exposure, configuration drift, access, and recovery evidence against an audited baseline, and defines what happens in an incident. The comparison table above sets out the difference line by line.