The part nobody budgets for until something breaks.

Yes, and for most clients that is the arrangement: an annual hosting plan with us, so the environment, the backups and the update path are all one thing rather than three vendors pointing at each other. If you would rather host elsewhere we will build to your environment and hand it over cleanly.

Not necessarily. If you have internal IT or a technical team member who will genuinely handle updates, backups and monitoring on a schedule, you can manage it yourself and we will set you up to do that. Plans exist for businesses where the honest answer is that nobody will.

On a care plan we handle detection, cleanup, restoration from a clean backup and closing whatever the entry point was. Most compromises we see come from an outdated plugin or a reused admin password, which is exactly what routine maintenance prevents.

Security releases should be applied within days. Feature updates can follow a monthly cycle, tested on staging first. The risk runs both ways: updating carelessly breaks things, and not updating leaves known vulnerabilities open, which is the more common failure.

Host backups are a reasonable floor but not a strategy. They are often retained briefly, stored on the same infrastructure as the site, and awkward to restore selectively. We keep independent off-host backups and, more importantly, verify that restores actually work.

Usually yes. We start with an audit of the theme, plugin stack and security posture so we know what we are inheriting. Occasionally a site is built in a way that makes safe maintenance impossible, and in that case we will tell you honestly rather than take the retainer.