What the maintenance includes

We update everything your site is built from. On WordPress that is the core, the plugins and the theme; on sites built with Astro or Next.js it is the libraries – we rebuild the site and upload it again. We take a backup before the update and check afterwards that the site opens and the forms work. Security patches go first; the rest waits until we are sure the new version does not break anything. If an old theme or plugin no longer works with the new version, we rewrite it: on Business and Shop that is part of the plan, on Start we charge by the hour.

Before every update we take one more backup – files and database in full, on top of the daily one. If the update breaks the site, we put it back exactly as it was within a minute instead of spending half a day on it.

After an update we open the site and check the things that matter: do the pages load, does the form send, does the login to the admin panel work if there is one. On shops we also go through the checkout up to payment – that is where things break most often, and it is rarely noticed straight away.

If our update breaks the site, we fix it at our own cost and we do not take the time out of the edits included in your plan. This is not goodwill, it is the deal: the update is our work, so the consequences are ours too. Fixing means putting the site back as it was and repairing what broke. Rewriting is a different matter: when an old theme or plugin simply does not run on the new version, the code has to be rewritten – on Business and Shop that is inside the plan, on Start it is charged by the hour.

Every day we check everything your site is built from against the lists of known vulnerabilities: plugins and themes on WordPress, libraries on Astro and Next.js. When a patch is out, we install it the same day rather than waiting for the next scheduled update. If there is no patch yet and the hole is dangerous, we switch the affected part off for the time being and tell you exactly what stopped working and why.

We take a backup every day – files and database together, plus one more before every update. If the site has to be put back, we do it ourselves, with no ticket and no waiting. We also back up the whole server separately: even if it fails completely, the sites are restored from that copy.

Two lines of defence. On the outside, the firewall lets through only what the site and the email need, and the administrator login is open from our addresses only. On the inside, blocking is automatic: password guessing on the site, on the email and on the panel, bots pulling down the whole catalogue, bots hammering the basket in a shop. An address caught a second time is blocked for a month. The certificate renews itself.

We update not only the site but what it runs on: the PHP version and the server system itself. We are on PHP 8.3. PHP 7.4 has had no security patches since November 2022: every hole found since then stays open on such a site – there is nothing to patch it with. We still take a site on an old version: we move it across as it is and raise PHP once it is with us. First we check that the site works on the new version, and only then switch for good. If it does not work, we rewrite the code for the new version: at our cost on Business and Shop, by the hour on Start. On Astro and Next.js sites PHP is needed only by the form, but the server system is updated just the same.