WordPress security service
Ongoing security for a WordPress site through a care plan, with weekly updates, security scanning and daily offsite backups. If the site is already hacked, a one-time malware removal cleans it first.
In short
- Ongoing security is part of every care plan, not a product sold alone. A plan keeps the site updated, scanned and backed up offsite.
- The Care, Business and Store plans include malware cleanup. Essential scans but does not clean.
- A hacked site can be cleaned as a one-time job, with a 30-day re-clean guarantee.
- No service can promise a site will never be attacked.
- The guides linked on this page cover the same work, if you would rather do it yourself.
Most of what keeps a WordPress site secure is routine. An out-of-date plugin or theme with a known hole is a common way in, so the software has to be kept current. Someone has to look for signs of trouble. And there has to be a clean backup, stored away from the site, for the day something gets through.
There are two situations. If your site is healthy and you want to keep it that way, a care plan does the routine work. If your site is already hacked, a one-time malware removal cleans it.
Ongoing security is not sold as a product of its own. It is part of every care plan: the weekly updates, the security scanning and the daily offsite backups come together, with uptime monitoring and a monthly report. Malware removal is sold separately, as a one-time job. The prices of the Essential and Care plans and of malware removal are on this page, and all four plans are on the pricing page.
Who it is for
- Your site is healthy, and you want the updates, the scanning and the backups to be somebody's job.
- Nobody can say when the plugins were last updated.
- The site was cleaned once already, and you do not want to go through that again.
- The site is hacked now. Visitors are sent to a site you have never heard of, a browser shows a red warning, or your host has suspended the account. That is the one-time malware removal.
Who it is not for
- Someone who wants a guarantee. No service can promise that a site will never be hacked, and we do not.
- Someone who will do the routine themselves. WordPress security: what to do, in order of what matters most sets the work out. Updates, strong passwords with two-factor login, and a backup you have restored do most of it.
- Someone who is not sure the site is hacked. Check first. The hacked site check reads the site from outside, and how to check whether your WordPress site has been hacked goes through the checks from outside and then from inside.
- Someone who needs their email or their hosting account secured. This service is for the WordPress site.
What is included
On every care plan, starting with Essential:
- Known holes get closed. WordPress core, plugins and themes are updated weekly, with a visual check and a rollback if something is wrong.
- Signs of malware are looked for. Security scanning is part of every plan.
- There is a copy away from the site. Backups are taken daily and stored offsite. Essential keeps them for 30 days.
- Outages are looked for. Uptime monitoring is part of every plan.
- You get a report every month.
The Care plan adds:
- Malware cleanup, included in the plan.
- Backups kept for 90 days.
- 90 minutes a month of fixes and small edits.
Malware removal is a one-time service and does not need a plan. It includes:
- A full clean-up of the site.
- Hardening.
- A blacklist removal request.
- A written report.
- A 30-day re-clean guarantee.
Which plan does what:
| Essential | Care | Business | Store | |
|---|---|---|---|---|
| Weekly updates, with a visual check and rollback | Yes | Yes | Yes | Yes |
| Security scanning | Yes | Yes | Yes | Yes |
| Malware cleanup | No | Yes | Yes | Yes |
| Daily offsite backups, kept for | 30 days | 90 days | 90 days | 90 days |
| Uptime monitoring | Yes | Yes | Yes | Yes |
| Updates tested on a staging copy first | No | No | Yes | Yes |
| Monthly report | Yes | Yes | Yes | Yes |
WordPress maintenance sets the plans out in full.
What we need from you to start
The free diagnosis form asks for your name, an email address, your site's address if you can share it, and what is happening. If the site may be hacked, say what you and your visitors see, and paste in any warning or email from your host. We reply in writing to the address you give. The diagnosis is free, and you owe nothing after it. Whether to go ahead is up to you.
How it works
Step 1: Ask for a free diagnosis
Describe what you see on the free diagnosis page. You get a written cause and a fixed quote.
Step 2: If the site is infected, it is cleaned first
Malware removal covers the clean-up, hardening, a blacklist removal request and a written report.
Step 3: A care plan keeps it maintained
Updates go on weekly, the site is scanned, and backups are taken daily and stored offsite.
Step 4: If malware comes back
Within 30 days of a malware removal, the re-clean guarantee applies. On the Care plan, cleanup is included for as long as the plan runs.
What it does not cover
- A promise that your site will never be hacked. Updates, scanning and backups lower the risk and shorten the recovery. They do not remove the risk.
- Cleanup on the Essential plan. Essential scans. Cleaning an infection is part of Care, Business and Store, or a one-time malware removal.
- The outcome of a blacklist request. We send the request. The company that runs the list decides when to lift the warning.
- Security for anything other than the WordPress site, such as your email or your hosting account.
- Updates on the day of release. The update schedule is weekly.
Before you buy: do it yourself, or check first
Most of this work can be done by a site's owner. These pages show how, and how to find out where your site stands today.
- WordPress security: what to do, in order of what matters most is the whole routine, from updates and passwords to file hardening and a firewall.
- How to set up two-factor authentication and how to protect WordPress from brute force attacks cover the login page.
- WordPress security plugins compared and WordPress firewalls compared say what each kind of tool does and does not do.
- How to audit a WordPress site for security weaknesses is a written inventory you can make of your own site.
- The hacked site check shows the signs of a break-in that are visible from outside. The end-of-life checker shows whether your PHP and WordPress versions still get security fixes.
- If the site is hacked, the first-hour runbook says what to do before any cleaning, and how to remove malware from a hacked WordPress site is the cleanup itself.
- What WordPress malware removal costs explains how a cleanup is priced and what a complete one includes, for comparing quotes.
Everything on the subject is listed under WordPress security and hacked sites.
What it costs
Essential
$39 a month, per siteor $390 a year
Updates, backups, monitoring and security scanning. No edit time.
- Weekly core, plugin and theme updates with a visual check and rollback
- Daily offsite backups kept 30 days
- Uptime monitoring
- Security scanning
- Restore if an update breaks the site
- Monthly report
Care
Recommended$79 a month, per siteor $790 a year
Everything in Essential, plus 90 minutes of fixes and small edits a month.
- Everything in Essential
- 90 minutes of fixes and small edits a month
- Malware cleanup included
- Backups kept 90 days
Malware removal
$99
Start with a free diagnosis
Common questions
My site is already hacked. What should I do?
Ask for a diagnosis and say what you are seeing. Malware removal is the one-time service for this. It ends with a written report and carries a 30-day re-clean guarantee. Until then, the first-hour runbook lists what to do, in order.
Can I buy security on its own?
Not as a monthly product. Security scanning comes with every care plan, alongside the weekly updates, the backups and the monitoring. Essential is the smallest plan. The one security service sold by itself is malware removal, which is a one-time job.
What is the difference between scanning and cleanup?
Scanning looks for signs of malware. Cleanup removes it. Essential includes scanning only, so cleanup on that plan is a separate one-time job. Care, Business and Store include both.
Will a care plan stop every attack?
No. A plan closes known holes through weekly updates, looks for trouble, and keeps offsite backups so there is a copy to return to.
I already run a security plugin. Do I need this?
They do different jobs. WordPress security plugins compared says what such a plugin does, and that it does not replace updates, backups or good passwords. Updates and backups are the part a care plan does.
My host says it scans for malware. Is that enough?
Read what the host says it does when a scan finds something. Does your web host maintain your WordPress site? found that where a host cleans a hacked site, it does so on conditions, and those are worth reading before you need them.
Should I buy malware removal or a care plan?
If the site is infected now and you only want it cleaned, malware removal is the one-time route. If you also want updates, backups and scanning from here on, the Care plan includes malware cleanup. The price of each is on this page.
Is there a contract?
No. Care plans are month to month with no minimum term, and you can cancel any time. Your first payment for a care plan is refunded if you ask within 30 days. Plans are compared on the pricing page.