WordPress Pro: Hosting, Maintenance, and Performance in One Plan

It is managed hosting, maintenance, and performance sold as one plan, with the security work included, for $250 per website per month. The protections run off-site, so nothing extra is added to your install, and a team configures them, reads what they report, and acts on it. Findings get dealt with instead of waiting in a dashboard for a free afternoon.

Hosting, Maintenance, and Performance together. On the security side that means a cloud-based firewall, login protection, managed 2FA for every admin, a vulnerability scanner covering plugins, themes, and core files, daily malware scanning of files and the database, bot access monitoring, optional regional blocking, and free malware cleanup. Hosting adds the servers, staging, and migrations, maintenance adds updates, backups, and monitoring, and performance adds daily optimization and Core Web Vitals tracking.

It is $250 per website per month. That includes 5 GB of storage, 50 GB of bandwidth, a quarter of a processor, 10,000 emails a month, 10 uptime monitors, 10 monitored forms, and 10 pages measured daily. The standalone prices for hosting, maintenance, and performance add up to the same $250, so the difference is the larger allowances: standalone hosting includes 2 GB and 2,000 emails, and the other services include 5 monitors, 5 forms, and 5 measured pages. Bandwidth and processing are the same as standalone hosting.

Nothing stops and nothing slows down. Storage (your files and database together) above 5 GB is $2.50 per GB a month, based on the monthly average, bandwidth above 50 GB is $0.25 per GB, processing above a quarter of a processor is $0.25 per processor hour, and email above 10,000 is $1 per 1,000. Overages appear on your next monthly invoice, and your monthly report shows where you stand against what is included.

Yes. Hosting is $25 a month, maintenance is $125, and performance is $100, each per website and each sold on its own. WordPress Pro is for sites that need all three. The security protections described here come with the plan because they run off-site and replace the stack of security plugins most sites accumulate. If a specific plugin is genuinely needed on yours, we will say so and manage it.

With separate suppliers, each one owns a slice and the gaps between them are yours to chase. Here one team has the whole site, with one plan, one invoice, and one activity log. A detection puts people on it, who validate, clean, and harden, so you are buying action and accountability instead of another dashboard to check.

By closing the doors attackers actually use, in order. Every request is filtered through a cloud firewall before it reaches WordPress. Admin access is locked down with login protection and managed two-factor authentication. Then the install itself: every file and database table is scanned daily for malware, unauthorized changes and bad-bot behavior are watched for, and access from regions you do not serve can be blocked outright.

Login attempts are monitored, and bad ones are throttled or blocked, which shuts down brute-force and credential-stuffing runs. Separately, we set up and manage two-factor authentication for every administrative user, off-site, so a stolen password on its own does not get anyone in.

Yes. Every request passes through our cloud-based firewall first, and known malicious attempts are stopped before WordPress sees them. Bots are judged by what they do, not what they call themselves: automated traffic that probes, scrapes, or hammers your login and forms is cut off. If you sell only into certain regions, blocking the rest removes a share of hostile traffic too.

Every day. The scan reads every file and every database table against known malicious code, which differs from an occasional surface check, and plugin, theme, and core files are watched for unauthorized changes on top of that. The aim is a short window between an infection landing and someone acting on it.

We treat it as ours to fix, and cleanup is included in the plan. There is no specialist to hunt for, no quote to approve, and nobody learning your install for the first time, because your account manager already knows it and which plugins are on it.

First we confirm it is real, since false positives waste everyone’s time. The infected files or database entries are isolated and cleaned, and we go through the rest of the site for anything related, because malware rarely travels alone. Then we close the hole it came through and verify the site is clean. Removal is included, so you never weigh a cleanup against an extra invoice.

Each helps, and neither covers the whole picture. A host secures its own servers, not your plugins, themes, logins, or content, and free plugins tend to detect more than they fix. Neither removes malware for you or responds when something happens. That gap is what a managed plan fills.

Usually when the site is worth protecting and you no longer want to be the one watching it, which tends to happen once it drives revenue, holds customer data, or carries your reputation. Stacking security plugins, ignoring update prompts, or having no idea what you would do on the day you got hacked are other signals. Tell us about your site through the contact form and we reply within two business days.

At 11 AM Pacific on the first Tuesday that falls on or after the 3rd, covering the month just ended. The email goes to the people on your account who receive reports and links to the full report online, which stays open for 90 days.