WordPress Maintenance Services With a Rollback Plan and a Human on Alerts

The cheapest WordPress maintenance services click "Update all" and email you a green report. That works right up until an update breaks the checkout page at 9 p.m., and the plan has no way back except "restore last week's backup and lose this week's orders."

My plan is built around three things that report skips: an update you can undo in minutes, security settings that get tested after they're applied, and a person who reads the alerts instead of filtering them to a folder.

If you'd like WordPress to become someone else's job, tell me about your site in a short questionnaire. I reply with a plan and a fixed quote within one business day. No pressure either way.

Starting at $150 a month. That covers updates with backups and a rollback plan, security monitoring, uptime monitoring, and small fixes, for one WordPress site.

What's in my WordPress maintenance services

Here's what happens every month, in plain terms:

• Updates with a rollback plan. WordPress core, plugins and themes, each update preceded by a fresh backup and a record of the exact version it replaced.
• Backups stored off the server. If the hosting account itself gets hacked or suspended, backups that live inside it go down with it.
• Security monitoring. Malware scans, file-change alerts, new admin user alerts and login-attempt patterns, read by me.
• Uptime monitoring. Your site gets checked around the clock, and if it goes down, I hear about it before your customers mention it.
• Tested hardening. Server and WordPress security settings applied and then checked from the outside, so you know they work (details below).
• Small fixes. A broken contact form, a plugin conflict, a PHP warning, a page that needs a quick change. The kind of thing that's too small to hire someone for and too annoying to leave.
• Plain-English updates from me. If something got rolled back, needs a decision, or looks off in the scans, you hear about it in an email you can read in a minute.

How it works

1. You fill in the questionnaire. Your host, rough plugin count, and anything that's bugging you right now.
2. I reply with a plan and a fixed monthly price. Typically within one business day.
3. Onboarding check. In the first week I take a full backup, list every plugin and theme with its last update date, and flag the abandoned ones. I also check your PHP version and existing security settings. Sites with years of skipped updates take longer, and I'll say so up front.
4. Monthly rhythm. Security updates go in as soon as I see them. Everything else follows a regular update window, one plugin at a time, with a check after each.
5. Staying in touch. Anything urgent, you hear about the same day. Anything that needs your decision, like replacing an abandoned plugin, comes with my recommendation attached.

The rollback plan: why updates are where sites break

Skipping updates isn't an option, and the numbers show why. Patchstack's State of WordPress Security in 2026 found that 46% of vulnerabilities (security holes) didn't have a fix from the developer by the time they were made public. It also found that about half of high-impact vulnerabilities get exploited within 24 hours. So when a patch does arrive, it needs to go in quickly.

But fast updates break things. WordPress has a built-in safety net: since version 6.6, a plugin auto-update that causes a fatal error is rolled back automatically. It's a good feature with a narrow scope. It catches PHP fatal errors found by checking the homepage. It doesn't catch a checkout page that renders blank, a form that stops sending, or a layout that falls apart on phones.

So I don't rely on it. Every update follows this pattern, using WP-CLI (WordPress's command-line tool):

## Before: back up the database and record every plugin's current version.
## Safe to run. It reads the site and writes two files to the backup folder.
wp db export ~/backups/db-before-update.sql
wp plugin list --fields=name,version,update_version --format=csv > ~/backups/plugin-versions.csv

## Preview what would change, then update one plugin at a time and check the site after each.
wp plugin update --all --dry-run
wp plugin update contact-form-7

## If that update broke something: reinstall the exact previous version from the record above.
wp plugin install contact-form-7 --version=PREVIOUS_VERSION --force

The database export matters because some plugin updates change the database too, and swapping the files back doesn't undo that. With both the files and the database snapshot, a bad update is a 10-minute problem instead of a lost evening. Premium plugins that aren't on wordpress.org need their previous zip file kept on hand, so I keep it.

PHP itself needs updating too. As of October 2026, PHP 8.2 gets security fixes only until December 31, 2026, and WordPress recommends PHP 8.3 or newer. I test a PHP upgrade on a staging copy (a private test version of your site) before switching the live site.

Hardening that's tested, not just applied

Security plugins and old tutorials hand out settings that look protective and sometimes do nothing. A rule written in Apache 2.2 syntax can silently fail on a modern server. Or it can take the whole site down with a 500 error (the server's generic "something broke" response). So every change gets tested from the outside.

Here's an example, written in modern Apache 2.4 syntax:

## Root .htaccess, above "# BEGIN WordPress". Blocks direct web access to the config file
## and to XML-RPC, an old remote-publishing door that bots love to hammer.
## Could break: Jetpack and the WordPress mobile app, which need xmlrpc.php. Skip that block if you use them.
<Files wp-config.php>
    Require all denied
</Files>
<Files xmlrpc.php>
    Require all denied
</Files>
Options -Indexes

And here's the test that proves it worked:

## Read-only: both should answer 403 Forbidden. A 200 means the rule isn't running.
curl -sI https://example.com/wp-config.php | head -1
curl -sI https://example.com/xmlrpc.php | head -1

The Options -Indexes line stops your server from listing the contents of folders that have no index page. Without it, anyone can browse your uploads folder like a file cabinet. I also set DISALLOW_FILE_EDIT in wp-config.php, which the official WordPress hardening guide recommends because it turns off the dashboard's built-in code editor. That editor is the first thing an attacker reaches for after stealing an admin password. My guide to securing WordPress with .htaccess has the full template.

A human who reads the alerts

Alerts are only useful if someone reads them. Most security plugins send so many emails that owners create a filter and stop looking, and that's exactly when the one that matters arrives.

I read them. "New admin user created" at 3 a.m. gets looked at that morning. A file change in a plugin folder that didn't just update gets compared against the official copy. A scanner warning about a harmless readme file gets dismissed, so the noise doesn't bury the next real one.

If something does get through, you're not starting from zero. You already have someone with backups, version records and server access. For an active infection, I quote the malware cleanup and Google warning removal work separately, because a full cleanup is a different job from monthly upkeep.

Who this is for (and who it isn't)

This plan is a good fit if:

• Your WordPress site brings in leads, bookings or sales, so a broken form costs money
• You have 15 or more plugins, or a page builder, or WooCommerce
• Nobody on your team wants to touch updates (or the person who did has left)
• Your site was hacked before and you'd rather not repeat it

I work with contractors, clinics, law firms, local retailers and SaaS startups across the US and Canada, all remotely.

It isn't for you if your site is a five-page brochure with a handful of well-known plugins, auto-updates switched on, and a host that keeps daily backups. That setup can run safely with a monthly 15-minute check by you. My WordPress maintenance checklist lists what to look at. It also isn't for Shopify, Wix or Squarespace sites, since those platforms handle updates themselves.

WordPress maintenance pricing

Care plan prices range widely. Codeable's WordPress maintenance pricing guide lists its own Basic plan at $240 a month. It also notes that plans around $30 to $50 a month exist but typically lack staging tests, offsite backups and human review. Here's mine, as of October 2026:

WooCommerce stores, multisite networks and sites with heavy custom code may cost more, and I'll tell you in the quote. Prices are in USD, and Canadian clients can pay in CAD at the day's exchange rate. See the full price list for everything else.

Why hand it to me

I've spent 20+ years in search marketing, much of it inside the servers that WordPress sites run on: hack cleanups and hardening, cPanel/WHM, Plesk, Cloudflare and Linux setups, caching, and plenty of .htaccess work. That matters for maintenance, because the problems that hurt small sites usually live below the WordPress dashboard.

Cleaning hacked sites has also shaped how I maintain healthy ones. I've seen what the attackers go for, so I watch those spots first. And you deal with the same person every month. No ticket queue.

WordPress maintenance FAQ

How much do WordPress maintenance services cost?

At BigRed, maintenance starts at $150 a month for one site, covering updates with backups and rollback, security monitoring, uptime monitoring and small fixes. Across the market, bare-bones plans start around $30 to $50 a month, and Codeable's own plans with staging-tested updates start at $240. The difference is usually whether a person tests updates and reads alerts or a script does it all.

Can't I just turn on WordPress auto-updates?

For a small, simple site, auto-updates plus host backups can be enough. Since WordPress 6.6, a plugin auto-update that triggers a fatal error rolls back automatically. That safety net only catches fatal errors found from the homepage, though. Broken forms, checkout problems and layout issues slip through. If your site makes money, someone should check it after updates.

How often should WordPress be updated?

Security updates should go in within a day or two of release, because many vulnerabilities get exploited within hours of disclosure. Routine updates can follow a weekly or monthly window. Each update should be backed up first and checked afterward. PHP needs attention too, roughly once a year, as older versions stop getting security fixes.

What's the difference between a WordPress care plan and hosting?

Hosting keeps the server running. A care plan keeps WordPress itself healthy: plugin and theme updates, backups you can restore, security monitoring, and fixes when something breaks. Some managed hosts include a few of these, like automatic updates or daily backups. Check what yours actually covers before paying for overlap.

Is malware cleanup included in the maintenance plan?

Monitoring is included, and so is anything that keeps your site from getting hacked in the first place. If a site does get infected, a full cleanup is a bigger job, so I quote it separately. Having maintenance in place makes the cleanup faster, because backups, version records and access are already sorted.

Next step

If you'd like updates, backups and security handled by someone who checks the work, send me a few details through the maintenance questionnaire. You'll get a plan and a fixed monthly price, and your evenings back.