Monthly WordPress maintenance for any business that wants its site to stay fast, secure, and online without a developer on staff.
Currently maintaining: M.L. Campbell Training Centre (ongoing since launch) · a portfolio of Niagara businesses · selected Sherwin-Williams brand properties
WordPress maintenance that does the boring work that keeps your site fast, secure, and online — so the leads keep arriving and the rushed Friday-night call doesn’t happen. Monthly retainers, predictable scope, named human attached to your site. No “managed hosting plus” branding around what is actually neglect.
Who this is for
- ✅ Service businesses with a WordPress site that generates leads or revenue, where downtime or a slow homepage costs measurable money.
- ✅ Teams that have a developer somewhere in their history but no one currently watching the site week-to-week — the gap that quietly becomes an outage.
- ❌ Sites where nothing on the homepage has changed in three years and the business hasn’t either — your maintenance is fine, you just need a relaunch.
What this solves
- Plugin and core updates happen on a predictable cadence, with a staging-test pass before production so the update doesn’t break the conversion form.
- Backups exist, are off-site, and have been restore-tested. The first time you find out a backup doesn’t restore is the worst time. We test quarterly.
- Performance regressions get caught early. Quarterly Core Web Vitals review surfaces the plugin update that quietly added 200ms to LCP before search rankings notice.
- Security incidents have a response plan. If something flags as compromised, there’s a documented playbook — not a rushed call to whoever built the site three years ago.
- You stop reading “site is down” emails on weekends. Uptime monitoring, escalation, and a named person who responds.
What’s included
- Monthly: core, plugin, and theme updates. Tested on staging, deployed to production, with a rollback path. Compatibility issues surfaced before they reach customers.
- Monthly: backup verification. Off-site backup confirmed, retention checked, restore tested every quarter on a clean environment.
- Monthly: security review. User audit, malware scan, vulnerability scan against installed plugins, file-integrity check on themes and core. Anything flagged gets a remediation plan inside the same monthly cycle.
- Monthly: performance check. Search Console p75 Core Web Vitals review on top URL groups, error log review, slow-query log review on hosts that ship one.
- Quarterly: light optimisation pass. Image pipeline tune, plugin audit (anything not earning its keep gets flagged), object-cache health, redirect-chain cleanup.
- On call: incident response. Site down, hacked, or otherwise broken? Documented response window — typically 4 business hours for non-critical, 1 hour for site-down.
Process
- Discovery call · joint, 20 min. Walk the current state, identify any immediate risks (out-of-date plugins, missing backups, exposed admin paths). Deliverable: risk summary.
- Onboarding · me, week 1. Access provisioned, monitoring wired up, baseline backup verified, baseline performance captured. Deliverable: maintenance dashboard with first-month plan.
- Monthly cycle · me + your team async. Updates → staging → production. Monthly written report, plain language, with anything that needs your attention surfaced clearly. Deliverable: monthly maintenance report.
- Quarterly review · joint, 20 min. Performance trend, security posture, plugin discipline, anything coming up the road. Adjustments to the monthly cycle. Deliverable: quarterly trend report.
- Off-cycle: incident response. Documented escalation. Response within the contracted window. Deliverable: incident report and prevention notes.
Timeline and investment
Onboarding takes one week. Monthly retainers start at $650/month for a single low-traffic WordPress site, scaling to $1,800/month for sites with multisite, ecommerce, or membership complexity. Annual contracts get a 10% discount; quarterly pre-pay is the most common arrangement. Anything outside the retainer scope (a feature build, a migration, an emergency rescue for a non-client site) bills at $275 an hour.
For comparison: an emergency call to recover from a compromised site (without a maintenance retainer in place) typically lands between $3,500 and $12,000 depending on extent. The math for the retainer pays itself the first time it prevents that call.
Trust cues
- WordPress maintenance and recovery work since 2010, including incident response on production sites with five-figure daily revenue exposure.
- Hosts I work with most often: WP Engine, Kinsta, Pantheon, SiteGround, and self-hosted on AWS / DigitalOcean / OVH.
- Documented runbooks for every common WordPress incident type — not improvising on your downtime.
- Available across Canadian time zones; on-call windows clear in the contract.
What I check when I take over an inherited site
Most maintenance engagements start with a site that someone else built and someone else stopped maintaining. The first-week pass that surfaces risk before it bites:
- User audit. Pull the user list. Anyone with administrator privileges who shouldn’t have them gets demoted or removed. Old developer accounts, agency accounts that left, former staff. The most common breach vector on inherited sites is a forgotten admin account.
- Plugin inventory + vulnerability scan. List every active plugin with last-update date. Cross-reference against WPScan’s vulnerability database. Anything with a known CVE gets patched the same day; anything abandoned (no update in 24+ months) gets queued for replacement.
- Backup verification. Pull the most recent backup. Restore it to a clean staging environment. Confirm the database imports cleanly and the file copy is complete. If the backup doesn’t restore, that’s the first emergency.
- Performance baseline. Capture current p75 LCP, INP, CLS from Search Console. Capture current TTFB and time-to-first-byte from a synthetic test. These become the baseline for measuring every subsequent change.
- Security headers + admin path. Check that
wp-login.phpis rate-limited, two-factor is on for administrators, and the standard security headers (HSTS, X-Content-Type-Options, X-Frame-Options) are set. None of these is hard to fix; all are commonly missing. - Error log review. Pull the last 30 days of PHP error logs. Repeating warnings are bugs nobody filed; repeating errors are time bombs. Each gets triaged.
The week-one pass is included in onboarding. Anything urgent gets fixed inside the first month at no additional cost; anything structural becomes a planned project with its own scope.
The audit cadence included at this tier
Essential care includes an ongoing $500 pre-check level of audit work distributed across the monthly cadence — not a single up-front report, but a rolling inventory of the site’s technical health.
- A monthly health-check report. Uptime, backup verification, core/plugin/theme update status, security posture, broken-link scan, Core Web Vitals on the templates that matter.
- An annual deep-pass audit. Once a year the rolling work consolidates into a $500-level pre-check report covering the technical SEO, plugin governance, accessibility regression, and the structural items the monthly cadence catches piecemeal.
- A surface for the things the monthly cadence finds. When a check turns up a problem larger than maintenance hours can carry, it is logged with a recommendation rather than buried in a status email.
If the audit cadence surfaces work that calls for a build engagement — a substantial redesign, a performance overhaul, an integration replacement — the maintenance hours already spent in scoping the problem credit against the build engagement when it is commissioned. The audit work pays forward.
How the relationship works
Essential care is a relationship, not a help-desk subscription. The handover surface is shaped around what you actually need to read each month rather than what a generic dashboard happens to surface.
- A monthly written report — what was done, what was found, what needs your attention — sent on a predictable cadence rather than dumped into a portal.
- A single email contact for everything maintenance-related. No ticket portal, no support form, no chat widget that times out.
- A walkthrough at relationship start covering what the monthly cadence includes, how to read the reports, what counts as in-scope versus out-of-scope, and how to request work.
- Annual review on what the cadence has covered, what has emerged from the audit work, and what the next year of the relationship should look like.
Scope flex and no lock-in
