Security updates

Why this matters

Roughly 96% of all hacked WordPress sites have an outdated component as the entry point — usually a plugin or theme that hasn't been updated in months. Security updates aren't complicated themselves, but they're one of the things most easily put off "until I have time". And that's exactly when things break.

We take that work off your calendar entirely. When an update lands, we're the ones handling it — properly, at the right time, with a fallback if something goes wrong.

What's included

• WordPress core — every minor and security release applied within 24 hours of release. Major releases (e.g. 6.4 → 6.5) ship after we verify your theme engine and premium plugins are compatible.
• Plugins — every active plugin is monitored. Security patches get prioritised; other updates roll up in weekly batches to minimise risk.
• Themes — both parent and child themes. We don't touch your custom child-theme code.
• Compatibility reading — before we roll an update we read the changelog. If a plugin update looks suspicious we pause it and reach out.

How it goes — without drama

1. We take a backup. Not a scheduled one — a specific snapshot right before the update.
2. We test in staging (Pro and Enterprise). The plugin or core is updated in a copy of your site, automated smoke tests run (homepage, key landing pages, a checkout flow if there is one), and if anything fails we abort.
3. We roll out to production. The site stays up the entire time — the update applies in 1–3 seconds.
4. We monitor for 30 minutes after. If error rates in the logs spike noticeably, automatic rollback to the backup.
5. A human reviews the result the day after. Not just at the server level — we actually load your homepage.

What if an update goes wrong?

It happens. Rarely, but it happens — often because two plugins interact unexpectedly. When it does:

• Automatic rollback to the backup (usually within 60 seconds).
• You get an email: "We paused the X update because Y. We're looking into it."
• We read through the issue, contact the plugin author if needed, and schedule a new attempt when the path is clear.
• You haven't had to do anything.

What this isn't

• It's not WordPress's built-in auto-updates. The native function runs without backups, without testing, and without escalation when something breaks. We do the job better — that's the whole point.
• It's not a major-version upgrade without a decision. For major releases (e.g. 5.x → 6.x) we reach out beforehand, walk through breaking changes, and ship with your sign-off.
• It's not updating pirated plugins or abandoned themes. If you have one of those, we'll suggest alternatives.

Which plans include it?

Security updates are included in every plan — Basic, Pro, and Enterprise. The difference is how much testing happens before rollout:

• Basic: Security updates within 24 hours, backup before, 30 min monitoring after. No staging test.
• Pro: Everything above + a staging environment where plugin updates are tested before they reach production.
• Enterprise: Everything above + custom update windows (e.g. "not during the April campaign week").

See the full comparison on the pricing page →

Questions & answers

How fast does a critical security patch ship?

Within 24 hours for documented critical issues (CVSS 7.0+). In practice usually 4–6 hours — we monitor WordPress security feeds 24/7.

What if I have a custom plugin that doesn't auto-update?

We talk to you first. If it's an internally developed plugin we can help set up an internal release process. If it's an abandoned third-party plugin we suggest alternatives with similar functionality.

Do updates affect my visitors?

No. Updates apply atomically in 1–3 seconds, and WordPress handles incoming requests while the core updates. If we ever see an update that requires longer downtime, we reach out beforehand and schedule a window.

Can I pause updates temporarily?

Yes — we have a "freeze" mode for periods when you absolutely don't want anything changing (e.g. product launches). Security patches still ship, but non-critical updates pause.

Get started

Security updates start the day we install the WEBBELi worker plugin on your WordPress. That typically takes 24 hours from order to first update run.

See plans and pricing