MaintenanceWatch · Maintain · Manage · Operate

Site maintenance and management.

Daily monitoring that stays quiet on healthy days, with a dated report and a ready remediation handoff when something drifts. Month-to-month, U.S.-based, owner-operated. Platform-agnostic at the top; the deep-check layer is proven on WordPress.

Request a quote

01 · Tiers

Maintenance tiers.

Four rungs. The first three are operations: they watch a site and keep it patched. Operate adds build capacity and a protected staging environment, which is a different promise, so it is a different tier rather than a wider Manage. Layer 2 (authenticated deep checks) is WP-CLI and SSH today; non-WordPress stacks get external monitoring and advisory coverage, and deep checks are rebuilt per platform when scoped.

Included across tiers
Contact	Owner-operator, not a ticket queue
Agreement	Month-to-month, 30-day cancel
Alerting	Silent on healthy days; report on drift
Location	All work performed in the U.S.
Under management	3 sitesas of August 2026

Out of scope (quoted separately)
Redesigns	Full or partial site redesigns
New features	Net-new product development
Content	Original copy, photo, or video production
Ads	Campaign management

Monitoring layers · daily, 7am CT
External	Uptime, response baseline, SSL and domain expiry, DNS, MX/SPF/DMARC, backdoor-path probes, content integrity, blocklist reputation
Authenticated deep	User and role baseline diffs, file integrity, plugin and theme inventory, cron persistence, pending updates, backup age
Update policy	Minor and security core updates apply automatically. Plugin, theme, and custom-code updates never run unattended. Majors are tested on staging first, and a page-builder family is treated as one compatibility batch.
Weekly	A read-only crawl diffed against a captured baseline. It makes no changes to the site; it reports what moved.

02 · Change control

How a change reaches your site.

The question behind every maintenance conversation is whether the person with the keys can break the thing that brings in work. This is the answer: nine steps, no shortcut from a local edit to production, and a named human approving the promotion.

01
Inspect
02
Classify
03
Implement locally
04
Test
05
Protected staging
06
Screenshots
07
Client approval
08
Exact production promotion
09
Verify and record

Nothing is edited on a live site. Work is built locally, tested, and published to a password-protected staging copy for review. What reaches production is the exact thing that was approved, and it is verified and written down afterwards. Operate engagements get that staging environment and a written service and site operations record each month, delivered through a private client link rather than an email attachment.

03 · Proof

Proof in the field.

A live engagement, told without naming the client. A public account of a security incident on someone else’s site needs their written sign-off, and we do not have it yet.

Industrial construction contractor · inherited site

Took over a WordPress site mid-migration from a previous vendor and moved it to a plan that has both staging and downloadable backups, handling DNS cutover, SSL and platform config. The inherited site was already compromised: the host’s scanner flagged 21 malicious files, and the estate carried a plugin dressed as a beta build of a well-known caching plugin, staging folders seeded with search spam, and two rogue administrator accounts. One of those used an address one character away from the owner’s own. An admin list scanned quickly reads it as legitimate.

A migration copies the compromise, so the source has to be cleaned before cutover. The cleanup ran first: rogue accounts and the backdoor removed, persistence checked, credentials rotated, core reinstalled from official sources. Assessing an inherited estate is a first-class task on every takeover we do, not cleanup work discovered later.

Email was never on the web host. At cutover only the web address record changed, the mail records were left untouched, and client email kept working straight through the outage that preceded the move.

Read the full case study

Ongoing: three-layer monitoring at 7am CT, silent unless drift, with a dated report and remediation handoff when something trips. Maintenance ops cover plugin, theme, and core updates, backup verification, and access management.

What that engagement covered
Migration	Vendor cutover, DNS, SSL, hosting config
Incident	21 flagged files, backdoor plugin, spam folders, rogue admins
Sequence	Cleaned at the source before cutover, not after
Monitoring	Daily three-layer checks · 7am CT
Ops	Updates, backup verification, access control

04 · Quote

Request a quote.

Tell us your site stack and what needs attention, and we will scope a month-to-month plan.

Need a net-new build instead? See custom development.