Everything a WordPress site needs to stay healthy
Old sites made safe
If whoever built your site has moved on, I work out what's holding it together first. Then I bring out-of-date WordPress, PHP (the language WordPress runs on) or servers up to date without losing what works.
Maintenance
WordPress and plugin updates, tested on a copy of your site before they go live.
Security
A security plugin (Wordfence) set up properly, security holes fixed, and hacked sites cleaned and closed off.
Speed
Slow or heavy sites tuned so they load quickly and use less.
Servers
Advice on hosting and upgrades, or a new server (the computer your site runs on) set up in your own account.
Training and advice
Learning to run your shop or members' area, or talking through your options before adding one.
Nothing reaches your live site untested
I learned this the hard way. Years ago, a raft of plugin updates on a client's live site set off a clash. Working out which plugin was clashing with which, and which versions would stop it, took me two days under pressure while the client lost business. It wasn't good for either of us. It hasn't happened since, because I changed how I work.
Every site on my setup now has a full change history: every change is recorded and can be undone. Updates go first to a staging site, a private copy of your site that the public never sees. If a plugin clashes, I find and fix it there, and your visitors never know. Only tested changes go live, in one step.
You still edit pages, posts and images in the WordPress admin, exactly as before. Plugins, updates and code are the changes that can break a site, so I look after those and test each one before it reaches yours. Want a new plugin? Tell me what you'd like it to do. Before anything new goes on your site, I check that it's safe, actively looked after and the right tool for the job, and if there's a better one, I'll suggest it. The choice is still yours.
| Topic | The usual way | My way |
|---|---|---|
| Updates | Clicked in the live site and hoped for the best | Tested on a copy, then put live |
| If something breaks | Restore a backup, if there is one | One step puts the last working version back |
| Record of changes | None | Every change logged |
| Editing pages and posts | In the admin | In the admin, exactly as before |
| Installing plugins and updates | Anyone with admin access | Done by me, or another developer |
| If you change developer | Anyone can pick it up | I hand over every login, the full history and a note on how it fits together, or switch updates back to the admin |
You won't need to do updates at all, because that's my job. The trade-off is that plugins and updates go through a developer, not a button in the admin. That button is the risky part: plugins do clash, and on a live site there's often no easy way back. If you ever want it back, I can switch it on in a few minutes and your site keeps working, but the change history no longer applies, so you'd be back to the usual way, with its risks. Either way, everything stays in your name (more on ownership and your data).
If you'd rather keep your current hosting, that's fine. I'll use your host's staging copy if it has one, back up before every update and check your site afterwards, but the change history and the one-step way back need my setup.
Shops, bookings and memberships
Shops, bookings and membership sites need extra care, because orders, bookings and logins keep coming in while I work. I move them to a new server in your name at a quiet time. If your busy season is close, I'll look after your site where it is until it's over, then move it, and what you paid for the health check comes off the cost of the move.
Before an update goes live, automated tests work through your site on the staging copy, checking that pages load and work as they should and that the parts your site earns from still do their job: a test order through checkout, a test booking or donation, a member login, a message through your contact form. I look over the results and sign off every update myself before it goes live.
When updates go live
Updates go live on a Monday to Thursday morning, while I'm at my desk to check them, and never on a Friday, so there's always a working day after an update to put anything right. Tell me your busy weeks and I'll keep routine updates clear of them. Only a fix for a security hole that's being exploited breaks these rules.
What you hear from me
As soon as an update is live, you get an email saying what changed and what was tested. If anything fails on the staging copy, that update is held back until I've looked at it. If you'd like to check the staging copy yourself first, say so. I'll email you the changes and the test results, and nothing goes live until you've approved it. The one exception is a fix for a security hole that's being exploited: if I haven't heard from you by the end of that working day, it goes live. See a sample report. I tell you my holidays in advance, and no routine updates go live in the week before I'm away.
You own everything
I work inside your accounts. You can take it all elsewhere whenever you like.
- Hosting
Your hosting account is in your name. I have access, and you can remove it at any time.
- Backups
Your backups are kept in your hosting account.
- Email
Your mailboxes stay where they are now, even if they come with your hosting. On my setup, emails your site sends, such as form messages, go through a sending account in your name, which I set up for you. It's free for most sites.
- Code
On my setup, your site's code and its full history of changes are stored in an account you own, such as GitHub. I set it up for you.
- Your customers' data
Before I have access to your site, we both sign a data processing agreement, as UK data protection law requires. It says what I can see, what I do with it, which services handle it and where, and what happens if anything goes wrong. You can read it before you decide.
- Leaving
You get every login, the full history of changes, and a short note on how it all fits together. Then I remove my access.
Where AI fits in
I avoided AI tools for a long time. Slowly I've come round to them, for the parts of the job where they help: getting through routine code faster, and testing more thoroughly than I'd have time to by hand.
The decisions stay mine. I read and check everything before it goes near your site, and nothing goes live untested. Your passwords and keys never go into an AI tool.
The human parts stay human: talking with you, understanding what your site is for, and anything creative. When you email me, you get me.
WordPress care from £65 a month
Two ways I can look after your site. For most sites the first is safer and, even with the move, costs less from the first year. You pay monthly by Direct Debit or card, or quarterly by invoice if you prefer. I'm not VAT registered, so there's no VAT to add.
Care on my setup
£65 a month
Best for most sites, and any site that earns money.
I move your site onto its own server, in your name, set up so every change is tested first, recorded and reversible. Nothing on it can update itself.
- Every update tested on a private copy first, checkout, bookings and forms included
- Change history, and one step back if anything's wrong
- Security holes that are being exploited fixed the same working day
- If your site is hacked while I look after it, I clean it up at no charge. I trust the setup enough to promise that.
- Server upgrades every few years, at no extra cost
- New plugins checked for safety and fit, then added when you ask
- Move to my setup, once
- £450
- Care, each month
- £65
- Your first payment
- £515
- First year
- £1,230
- Each year after
- £780
Paying by Direct Debit or card? You can spread the move: your first nine payments are £115, then £65. Paying by invoice? Your first invoice is £645, the move plus your first quarter, then £195 a quarter. The move includes the health check, and your old hosting stays on until you're happy. Your server costs from about £5 a month (busy shops usually £20 to £40), paid to the host in place of your current hosting, plus a pound or two a month for the test copy I check updates on. Already on a server I set up? Nothing to move: £65 a month from the start.
Care where it is
£95 a month
Best for sites on managed hosting, where the host looks after the server, with a staging copy.
I look after your site where it is and switch off automatic updates on day one. If your host has no staging copy, as most low-cost hosting doesn't, updates go onto your live site after a backup, and if one breaks something, your visitors may see it before I've fixed it. On that kind of hosting, my setup is the safer choice.
- Updates tested on your host's staging copy if it has one, otherwise backed up first and checked afterwards
- Urgent security fixes between updates
- Health check, once
- £195
- Care, each month
- £95
- Your first payment
- £290
- First year
- £1,335
- Each year after
- £1,140
Paying by invoice? Your first invoice is £480, the health check plus your first quarter, then £285 a quarter. No change history or one-step way back, and server upgrades are left to your host.
Both plans include
- Updates every month, signed off by me before they go live
- An email whenever an update goes live, saying what changed and what was tested
- If an update I make causes a problem, I fix it at no charge
- A check-up every quarter: plugins, PHP, speed, and a test restore of your backup, with a short report
- Small fixes of up to half an hour
- I'm alerted if your site goes down or comes under attack
- Urgent help at £65 an hour instead of my usual £100, and you go first
Monthly by Direct Debit or card, or quarterly in advance by invoice, due within 30 days · three months minimum, then one month's notice · if you spread the move and leave before your ninth payment, the rest of the £450 is due, nothing more · no VAT
Not sure yet? Start with a health check on its own, £195. You get a written report on your site to keep, and if you start a plan within 30 days, you won't pay for it again.
Over a year, care on my setup costs about £1,230 including the move, against £1,335 for care where it is. After that it's £360 a year less, not counting hosting.
The details: what's not included, busy shops, email and the rest
- Not included. Fix-ups longer than half an hour, content edits and new features are billed at £65 an hour. If a server upgrade means an old theme or plugin needs code changes, I'll quote first.
- Busy shops. On my setup, a busy shop or membership site needs a bigger server than the £5 one, usually about £20 to £40 a month, paid to the host. I'll tell you the size and price before you commit. If you've paid your current host for the year ahead, we can time the move for when it runs out.
- Email. Your mailboxes don't move. If they come with your old hosting, keep that account open for them, or I can move them, quoted separately.
- Multisite (several sites run from one WordPress). £65 a month plus £20 for each additional site.
- Price changes. Prices are reviewed once a year, with two months' notice.
Not ready for a plan?
One-off work, for sites not on a plan or for anything a plan doesn't cover.
- Site health check
- £195
- A written report on your site's files, plugins, speed and server, yours to keep, including anything that won't run on a current, well-supported version of PHP, with a price to fix it. Not needed if I built your site or already look after it.
- One-off maintenance session
- £195
- For sites not on a plan.
- Hourly work, training and advice
- £65/hour
- One hour minimum.
- Urgent work
- £100/hour
- Two-hour minimum.
- Hacked-site recovery
- quoted
- Priced after a first look.
Something unclear, or not sitting right?
Tell me. A question, or a worry about any of this. I read every note, and it helps me make this page clearer.
A WordPress and server specialist on call
I work as a subcontractor or under your brand: WordPress, Bedrock and Trellis, server work and security clean-ups.
£65/hour · £390/day
White-label care is also available on either plan, with reports under your agency's name. Servers and accounts go in your client's name unless you'd rather hold them. For five or more sites, care on my setup is £45 a month a site, because you look after your clients and I look after their sites. For larger groups, get in touch.
For developers
Sites run on Bedrock, with WordPress and plugins managed by Composer. Servers are provisioned and deployed with Trellis. Everything is in Git. These tools from the Roots team changed how I work with WordPress, and I'm grateful to them. A change travels like this:
- 1 · Local
My copy
A virtual machine matching the live server.
- 2 · Git
Your repository
Every change committed, in your account.
- 3 · Staging
Test server
The update is checked on a full copy of the site.
- 4 · Live
Your site
Deployed in one step, on your hosting.
Rob Record
I spent eight years at a WordPress agency before going freelance. I also have a background in sound engineering. I live and work in Midhurst, West Sussex. Fairly decent human being.
Recent work
- An artist's portfolio siteIts server had stopped getting security updates in 2023, the site's email had been failing for eight months, and logging in to the admin timed out after two minutes. I moved it to a fresh, supported server, upgraded PHP and brought WordPress and its plugins up to date, testing each step on a staging copy first. 138 known security holes are now closed, 10 of them critical. Logging in takes under two seconds, the site's email works again, and attacks on the login page are blocked before they reach WordPress.
- Ian BailieAn artist's portfolio site. Its server had stopped getting security updates in 2023, the site's email had been failing for eight months, and logging in to the admin timed out after two minutes. I moved it to a fresh, supported server, upgraded PHP and brought WordPress and its plugins up to date, testing each step on a staging copy first. 138 known security holes are now closed, 10 of them critical. Logging in takes under two seconds, the site's email works again, and attacks on the login page are blocked before they reach WordPress.
- Site name and linkOne line on what was done.
- Site name and linkOne line on what was done.
Tell me about your site
Answer what you can. "Don't know" is a fine answer. If you'd rather talk first, say so and leave a number, and I'll ring you.