Website Maintenance, Support & Hosting.
A website without maintenance is a countdown. Themes update, plugins rot, a malware scanner starts flagging a file that wasn't there yesterday, and the first person who notices is a customer. We run monitored maintenance on WordPress and static sites — uptime, backups, security patches, performance hygiene, and a monthly report a non-technical person can read. Paired with security and malware removal and website speed optimization when the site needs more than upkeep.
What's watched,
and what isn't.
Maintenance retainers go wrong when the scope is a one-line 'we'll look after your site'. Here's what's actually included, grouped by what it protects against, and — further down — what sits outside this retainer so there's no surprise on month three.
Uptime and monitoring
So you're the first to know, not the last.
- 24/7 uptime monitoringOne-minute checks from three regions. An outage pages us before a customer emails you.
- SSL, domain, and DNS expiry alertsHeads-up 60, 30, and 7 days before anything expires. No 'forgot to renew the certificate' Mondays.
- Real-user performance monitoringCrUX and RUM data tracked against a baseline. If LCP slips past 2.5s for a week, you hear about it.
- Error and 404 monitoringPHP errors, JS errors, and broken internal links surfaced in the monthly report with fix priority.
Security and backups
Boring on purpose — the boring ones work.
- Daily encrypted off-site backupsFull site + database, stored on DigitalOcean Spaces, kept 30 days rolling. Tested restore once a quarter.
- Malware scans and file-integrity checksDaily scan with Wordfence or ImunifyAV. Unexpected file changes in core or themes trigger a manual review.
- WAF and firewall rules maintainedCloudflare or server-level rules kept in sync with active threat lists. Bad bots and brute-force attempts auto-blocked.
- Login hardening and 2FA enforcedAdmin 2FA on, XML-RPC locked down, wp-admin rate-limited. We review active users monthly and revoke stale accounts.
WordPress and CMS upkeep
Patched on staging first, every time.
- Core, theme, and plugin updatesApplied on a staging mirror weekly, smoke-tested, then promoted to production. Nothing gets auto-updated to break on a Friday night.
- Plugin audit and pruningQuarterly review of active plugins — unused ones removed, abandoned ones replaced, licenses tracked centrally.
- PHP, MySQL, and host compatibilityWe keep the stack on a currently-supported PHP version, migrate ahead of EOL, and monitor host-side deprecation notices.
- Database optimisationMonthly cleanup of revisions, transients, expired sessions, and orphan postmeta. Keeps the DB lean and admin snappy.
Performance hygiene
So the site doesn't slowly gain weight.
- Image optimisation sweepNew uploads converted to WebP/AVIF and sized responsibly. Quarterly sweep of the media library to catch drift.
- Cache and CDN healthPage cache, object cache, and CDN rules reviewed monthly. Purge schedules aligned with publishing cadence.
- Script and tag auditEvery new GTM tag, pixel, or embed is reviewed for performance impact before it ships. No silent script bloat.
Content edits and support
A predictable monthly pot of hours.
- Included edit hoursTwo to six hours per month depending on plan — copy changes, image swaps, new pages from existing templates, small CSS tweaks.
- Email support with response SLAsSame-business-day response on standard requests, one-hour response on flagged outages. No ticket queue maze.
- Monthly report in plain EnglishUptime, updates applied, backups taken, edits done, performance trend, flagged risks. Two pages, not twenty.
These are real work and we do all of them — just not inside a maintenance retainer, because bundling them makes the retainer cost unpredictable and the scope meaningless. We scope them separately so the monthly invoice stays honest.
- New feature development or custom plugin work
- Full redesigns or new page templates from scratch
- Complex plugin debugging or conflict resolution beyond two hours per incident
- Content writing, design, or SEO strategy work
- Migrations to a new host or platform
- Active malware cleanup on a currently-compromised site
- E-commerce catalog, order, or fulfilment operations
- Paid-ads or campaign-specific landing-page builds
Four principles.
No slogans.
Proactive, not reactive
We find the broken plugin before you find the broken page. Monitoring surfaces problems, the retainer pays us to fix them before they turn into a support ticket — not after.
Runbooks, not tribal knowledge
Every site we maintain has a written runbook — hosts, DNS, plugin list, credential vault, recovery steps. If we get hit by a bus, the next team can keep the site up with what we left behind.
A clear escalation path
A regular support email is one lane; a site-down page is another. You know which channel gets a response in an hour, which in a day, and which in a week — and we don't blur those to make the retainer feel bigger than it is.
Honest monthly reports
Two pages, written in English, including the months when nothing interesting happened. A maintenance retainer where the report always looks heroic is a retainer that's either inventing work or hiding something.
How we work, start to finish.
- 01Onboarding
We audit the site, document the stack, set up monitoring, take a baseline backup, and write the runbook. Output at end of week one: a current-state report and a list of anything that needs a one-time fix before we can cleanly maintain it.
- 02Stabilise
Month one is usually heavier — clearing the backlog of deferred updates, tightening security, and getting the site into a known-good state. Any larger fixes that fall outside retainer hours are quoted separately before they start.
- 03Steady state
Weekly updates on staging, monthly reports, quarterly plugin audit and restore test. Edits land within the SLA, emergencies get paged. Most months are quiet — that's the point.
- 04Review and adjust
Every quarter we review usage — are you hitting the edit-hour cap, are there recurring incidents, is the plan still the right shape. Plans can move up, down, or pause month-to-month.
Numbers we stand behind.
Written into the agreement, not aspirational. If we miss the uptime SLA in a given month, the retainer is credited pro-rata — no arguing about 'planned maintenance'.
Before you
ask us.
Someone watching the site.
Send the URL and a quick note on how the site is run today. You'll get a honest read on what the retainer would cover, what it wouldn't, and whether it's even the right call for a site your size.
or email hello@genvoid.com