Web & Apps · Care & security
WordPress maintenance and security, with the hardening this site runs.
Sites don't break. They get forgotten.
Updates, backups that get tested, hardening, Wordfence, and someone who looks at your site before your visitors do. From €49/month.
Why now
In 2026, the holes were in WordPress core itself.
In 2026, WordPress core needed two critical fixes: 7.0.2 in July and 7.1.2 in September, for holes someone could exploit without even having an account on the site.
WordPress 7.0.2 and 7.1.2 release notes · official project source
The free version of Wordfence receives new firewall rules 30 days late. So the first line of defence isn't a plugin. It's updates, the same day, and as few plugins as possible.
Wordfence, plugin page on wordpress.org A figure published by a company that sells the solution. We show it, but with this label.
We know, because we do it to our own site first.
Plans
Choose how much peace of mind you want.
| What each plan includes | Care from €49/month For a site that simply has to stay up to date and never get lost. | The minimum for e-shops Secure from €129/month The hardening this site runs. For any site with forms, logins or sales. | Growth from €390/month For a site that has to bring in work: speed, SEO and AI visibility, every month. |
|---|---|---|---|
| Core, theme and plugin updates, with a backup before each one | Included | Included | Included |
| Off-site backup | weekly | daily | daily |
| Restore test on a separate copy of the site | Not included | quarterly | quarterly |
| Uptime monitoring | Included | Included | Included |
| Hardening: XML-RPC off, user enumeration closed, security headers | Not included | Included | Included |
| Wordfence: firewall, brute-force protection, malware scans | Not included | Included | Included |
| Two-factor sign-in or passkeys for every admin | Not included | Included | Included |
| Security incident response | Not included | Included | Included |
| Monthly report | Included | Included | Included |
| Small content changes | 30 minutes a month | 1 hour a month | 3 hours a month |
| Core Web Vitals and accessibility, monthly | Not included | Not included | Included |
| Technical SEO and structured data | Not included | Not included | Included |
| How often AI answers mention you, across 10 prompts | Not included | Not included | Included |
| Quarterly review with recommendations | Not included | Not included | Included |
| Prices exclude VAT. | Choose the Care plan | Choose the Secure plan | Choose the Growth plan |
The approach
What "hardening" means, without handing out the map.
We describe the approach, not the settings. Admin paths, limits and usernames aren't published, here or anywhere else.
-
Less surface
As few plugins as possible. XML-RPC is shut at three levels: the server, the code and the settings.
-
No user directory
Usernames don't leak through the REST API, the sitemaps, author pages or embeds.
-
The browser as a guard
A strict nonce-based CSP and security headers: the browser runs only what we signed.
-
Logins that can't be guessed
A Wordfence firewall, a limit on failed attempts, and two-factor sign-in or passkeys for every admin.
-
Nothing executable in uploads
Uploaded files can't run as code.
-
Backups that restore
A backup that's never been restored is a hope, not a backup. So we restore it on a separate copy of the site.
Someone else built it? We look first.
Before we take it on, we check: versions, plugins without updates, users who shouldn't be there, backups, headers, anything outstanding. We tell you in writing what we found, and whether it's worth caring for or rebuilding.
Request a checkQuestions
Do you have to have built the site?
No. It goes through a check first, then onto a plan.
What happens if my site gets hacked?
We isolate it, clean it, close the way in and restore it from a clean backup. Then we explain in writing what happened.
Can I cancel?
Yes, with one month's notice. The backups and credentials are yours, and we hand them over.
Do I need Wordfence Premium as well?
For most sites, the free version plus same-day updates is enough. For a busy e-shop, Premium or a firewall in front of the server closes the 30-day gap. We'll tell you if you need it.
Will you publish how my site is configured?
Never. As with our own, we only ever describe the approach in public.