Outdated core, plugins or themes
Known vulnerabilities are published when a fix ships, which is precisely when unpatched sites become easier to find and target.
Updates · Backups · Security · Uptime · Support
Web Wonder Works keeps business websites updated, monitored and recoverable through tested software updates, verified backups, security checks, performance reviews, content support and a clearly documented response process.
Or call +91 76048 48428

Web Wonder Works LLP is an MCA-registered website maintenance company in Coimbatore, Tamil Nadu. The service covers a documented baseline audit, controlled software updates tested before deployment, backups of both files and database with tested restoration, automated uptime and functional monitoring, security maintenance, malware and hacked-site response, performance review against Core Web Vitals, defined minor content edits, and severity-based incident response. WordPress and WooCommerce are the primary supported platforms, with other stacks supported case by case and stated honestly in a platform matrix. The client keeps ownership of the domain, hosting, CMS, repository, analytics and backup destination throughout.
Prevent first. Test before deployment. Verify backups before depending on them. Restore from evidence, not assumptions.
Maintenance evidence
Maintenance is mostly invisible when it works, which makes it the easiest service to claim and the hardest to evidence. A credible proof item names the site, the period, what was actually done and what the number does not prove.
There is no maintenance evidence published here yet. Uptime reports, backup logs and incident timelines contain hosting paths, account identifiers and client data, so each one needs written permission and careful redaction before it can go on a public page. If you want to assess the work before that, ask on the review call: we will screen-share a live monitoring dashboard, a redacted monthly report and a restore-test record.
The limitation line matters most here. An uptime figure proves the monitoring ran, not that the site was fully functional, because a page can return a 200 status while its contact form is silently failing. Any provider quoting uptime without that distinction is telling you what they measure rather than what you need.
Ask to see a live dashboard and a redacted reportChoosing a provider
Fourteen criteria worth applying to any provider in this city, including us. Two of them currently count against us, and they are marked rather than skipped.
A provider claiming to maintain every stack is describing willingness rather than capability, and you find out which during an incident.
A platform matrix on this page names what is supported, what is case by case and what we decline, with the update model and exclusions for each.
Taking over an undocumented site means inheriting unknown technical debt and being blamed for it the first time something breaks.
An inventory of platform, versions, plugins, theme, custom code, hosting, users, integrations and existing issues, with pre-existing problems separated from monthly maintenance and quoted individually.
WordPress stores content in a database and everything else in files. A backup of one is not a restorable site, and plenty of providers only have one.
Both components, with frequency, retention, off-site storage and the access owner stated in your plan rather than described vaguely as backups included.
An untested backup is a belief. The first time most businesses discover a backup was incomplete is the day they need it.
Scheduled restore tests to a separate environment, with the result recorded in your monthly report and the date of the last successful test always available.
Clicking update all on a live site works until a plugin conflict takes down checkout on a Friday evening.
A ten-step controlled process: review the release, confirm a backup, record versions, test on staging where risk requires it, update in a controlled order, run smoke tests, deploy, validate, record the change, roll back if needed.
The question is not whether an update will ever break something. It is how quickly the previous state can be restored when one does.
A verified backup taken immediately before any risky change, plus a recorded version state, so reverting is a procedure rather than an improvisation.
Providers quote a response time and let buyers hear it as a fix time. They are entirely different commitments.
Four severity levels, each with a separate acknowledgement target, investigation target, update cadence and resolution approach, plus the dependencies that can prevent us meeting any of them.
Still owed on this page: Contractually approved response and resolution targets per severity level. Ask for it on the call and judge us on the answer.
A site can return a healthy status code while the enquiry form silently stops delivering email. Uptime monitoring alone will never catch that.
Functional checks on forms, checkout, login, payment, email delivery, certificate expiry and DNS alongside availability monitoring, with the check interval stated.
Agency-held domains, hosting or backup destinations turn leaving into a negotiation, and occasionally into a loss.
Domain, DNS, hosting, CDN, CMS, repository, analytics, Search Console and the backup destination all in your name. We take role-based access at the lowest level that works.
Maintenance reduces risk. It does not make a site secure, and a provider promising complete protection is either misinformed or hoping you are.
Layered hardening with OWASP ASVS as a reference, a documented hacked-site response, and an explicit statement that no provider can guarantee a site will never be compromised.
Unlimited small changes is either untrue or already priced in, and the argument arrives in month three.
A published list of what counts as a minor edit, a separate list of what is quoted as development, and a stated monthly allowance with fair-use terms.
A report saying everything is fine is indistinguishable from no work at all.
A monthly report covering uptime, incidents, updates applied with versions, backup status, restore tests, vulnerabilities, performance, functional checks, content hours used, open risks and next actions.
How a provider behaves when you leave tells you how confident they are that you will not.
A published offboarding checklist: access removed within two working days, documentation and change log handed over, backups confirmed in your own destination, and no dependency left behind.
Uptime and response claims are trivially easy to state and almost never evidenced.
Every proof item on this page carries its period, baseline, source and limitation, or it is not published. Right now that means the section is empty.
Still owed on this page: Published uptime reports, restore-test records and incident timelines with client permission. Ask for it on the call and judge us on the answer.
Why it matters
A website is a running system with dependencies that change underneath it. These are the failures we see most often, and almost none of them are caused by anyone touching the site.
Known vulnerabilities are published when a fix ships, which is precisely when unpatched sites become easier to find and target.
Hosts upgrade runtimes on their own schedule. An old plugin that stops working the morning after is a common and avoidable outage.
A lapsed licence usually stops updates silently. The site keeps working and quietly stops receiving security patches.
An expired certificate makes a browser warn visitors away. A DNS change made elsewhere in the business can take the site off the internet.
The most expensive silent failure there is. The form submits, the visitor sees a thank-you message, and nobody receives the enquiry.
Authentication records change or a host changes its sending method, and order confirmations start landing in spam.
A payment gateway updates its integration requirements and an old plugin version stops completing transactions.
Often invisible on the page itself and visible only in search results, where injected pages damage the site's standing before anyone notices.
A tag removed during an unrelated change means weeks of missing data, usually discovered when somebody asks where the leads came from.
Storage fills, revisions and logs accumulate, and performance degrades gradually enough that nobody attributes it to anything.
A backup job reporting success is not evidence of a restorable site. The gap between those two things is where businesses lose data.
Every new image, script and third-party tag adds weight. No single change is the culprit, and the cumulative effect is real.
Fit
Maintenance earns its cost when a website is doing commercial work and somebody would notice within an hour if it stopped. It is poor value on a site nobody depends on.
Baseline audit
Before we accept responsibility for a website we document what it is made of. Taking over an unknown site and being blamed for its pre-existing problems helps nobody.
Pre-existing technical debt is never absorbed silently into the monthly fee. It is quoted separately, and you can decline it, in which case we record the risk and the components it affects rather than pretending it is covered.
Software updates
Ten steps, applied to every update regardless of how small it looks. Step two is the one most often skipped, and it is the one that makes the other nine recoverable.
Read the changelog and any security advisory. A security release and a feature release carry different urgency and different risk.
Verify that a recent backup of both files and database exists and completed successfully. No backup, no update.
Capture the exact version state before the change, so the rollback target is a fact rather than a memory.
Major version changes, ecommerce plugins and anything touching checkout or payments are tested on a copy first.
Core, then dependencies, then plugins, one logical group at a time, so a failure can be attributed to a specific change.
Homepage, key templates, forms, login and checkout where applicable. Automated where possible, manual where it matters.
During an agreed window for higher-risk changes, and outside peak trading hours for ecommerce.
Re-run the same checks live, because staging and production differ in caching, integrations and traffic.
What changed, from which version to which, when, by whom, and whether anything needed attention afterwards.
Revert to the recorded state, confirm the site is functional, then investigate the conflict separately rather than under pressure.
Backup and recovery
A backup is only worth what it can restore. WordPress documentation treats files and the database as separate components, and a typical full restore needs both, so this page states them separately.
Uploads, themes, plugins, configuration and any custom code. Everything on disk that is not in the database.
Posts, pages, products, orders, users, settings and most plugin data. A file backup alone will not bring the content back.
Both components are required for a typical full restore. A backup of one is not a restorable website.
| Parameter | How we handle it |
|---|---|
| Frequency | Set per plan and stated in your scope. Ecommerce needs a shorter interval than a brochure site, because the cost of losing orders is different. |
| Retention | Stated per plan. Long enough to recover from a problem discovered late, which is the usual case with malware. |
| Storage location | Off-site, in a destination you own, separate from the hosting account. A backup stored only on the server it is protecting is not a backup. |
| Encryption | In transit and at rest, per the storage provider's standard. |
| Access owner | You. We hold role-based access to the destination and can be removed from it. |
| Restore testing | Scheduled, to a separate environment, with the result and date recorded in your monthly report. |
| Recovery point objective | The maximum data loss an incident could cause, which follows directly from the backup frequency in your plan. Agreed at contracting rather than published as a universal figure. |
| Recovery time objective | The target time to restore service. Agreed per site, because it depends on site size, hosting access and the type of incident. |
| Exclusions | Content held in third-party systems, email held by your provider, and anything outside the hosting account. Stated explicitly in your scope. |
We do not publish universal recovery point or recovery time figures on this page. Both depend on the backup frequency in your plan, the size of the site, whether hosting access is available at the time and what kind of incident it is. Quoting a fixed number to every visitor would be a marketing figure rather than an operational commitment, and the first serious incident would expose it.
Monitoring coverage
Availability monitoring tells you a server answered. Functional monitoring tells you the enquiry form actually delivered. Both are listed here with how often each runs.
A 200 status code means a server answered. It does not mean the enquiry form is delivering email, the checkout is completing or the tracking is recording. That gap is the reason functional checks exist alongside availability monitoring, and it is the single most useful question to ask any maintenance provider.
Automated monitoring runs continuously, every day, and raises an alert whenever a check fails. Human response happens during stated support hours, and outside those hours an alert is queued for the next covered period unless your plan includes out-of-hours cover. These are two different things, and merging them into a single 24/7 claim is the most common overstatement in this category. If you need genuine round-the-clock human response, say so at the review and we will tell you honestly whether we can staff it.
Security
Hardening and monitoring on one side, a documented recovery process on the other. Neither is a claim that a site cannot be compromised.
Maintenance reduces risk. It does not eliminate it, and any provider saying otherwise has not read an incident report.
Cleaning a site without finding how it was compromised guarantees a second incident. Both halves are required.
No maintenance provider can guarantee a website will never be compromised. Vulnerabilities are disclosed in software we did not write, credentials leak from systems we do not control, and hosting environments are shared. We use OWASP ASVS as a reference for what to verify, and we hold no security certification and claim none. What we commit to is the hardening, the monitoring, the patching cadence and a documented response, and to telling you what happened rather than quietly cleaning up. On Search Console review requests, Google decides its own timeline and nobody can promise one.
Performance
Every image, script and third-party tag adds weight. Maintenance is about noticing the drift against a baseline, not a one-off optimisation.
Performance degrades gradually as content, plugins and third-party tags accumulate. Maintenance is about noticing the drift, not about a one-off optimisation.
Google's published good thresholds, measured at the 75th percentile of real user experiences, are 2.5 seconds or less for Largest Contentful Paint, 200 milliseconds or less for Interaction to Next Paint, and 0.1 or less for Cumulative Layout Shift. We track against those and work to improve them. We will not promise that every page on your site will meet them, or that any page will load in under two seconds, because that depends on your hosting, your content, your third-party scripts and the device and connection of the person visiting. A provider promising a fixed load time for every page is describing a lab test.
Content and development
The most common maintenance dispute is about what counts as a small change. Publishing the boundary before the contract starts is cheaper than arguing about it in month three.
WordPress and WooCommerce
Most WordPress incidents originate in a component nobody was tracking. An ecommerce store adds a second problem: it can fail commercially while looking technically healthy.
WordPress is a dependency management problem more than a content management one. Most incidents originate in a component nobody is tracking.
An ecommerce store fails commercially long before it fails technically. A checkout that completes but sends no order email is still a broken store.
Platform support
Eight platforms, three support levels, and one row that says no. Support level reflects what we can maintain responsibly at plan pricing, not what we think of the technology.
Supported
Excluded: Custom plugin development and theme rebuilds.
Supported
Excluded: Custom checkout development, and accounting or tax configuration advice.
Supported
Excluded: New feature development and design changes.
Supported
Excluded: Rebuilding the site, and adding a content management system.
Case by case
Excluded: Custom app development and Shopify Plus scripting.
Case by case
Excluded: Feature development, and any application with server-side business logic we have not reviewed.
Case by case
Excluded: Business logic changes, database schema work and anything requiring the original developer's knowledge.
Not supported
Excluded: The entire category. We will tell you this at the enquiry rather than after taking a fee.
Support level is not a judgement about the technology. It reflects whether we can maintain it responsibly at maintenance-plan pricing, with the response targets published on this page. Case by case means we will review the codebase and give you an honest answer, which is sometimes no.
Incident response
Four severity levels, with acknowledgement, investigation, update cadence and resolution kept in separate columns. Those are four different commitments and this table refuses to merge them.
| Severity | Examples | Support hours | Acknowledgement | Investigation | Updates | Resolution |
|---|---|---|---|---|---|---|
| P1Critical | Site unavailable, checkout or payment failing, active compromise, or a serious access or data risk. | Covered window, with out-of-hours cover only where your plan includes it | Target: within the first hour of the covered window | Begins immediately on acknowledgement | Every hour until service is restored or a workaround is in place | Restore service as the first priority, root cause second. No fixed restoration time is promised. |
| P2High | Primary enquiry form broken, an important feature unavailable, or serious performance degradation. | Covered window | Target: within the same covered day | Same covered day | At least daily until resolved | Targeted within the next working days, dependent on cause |
| P3Normal | A non-critical bug, a display problem, or a content issue with a workaround. | Covered window | Target: within one working day | Scheduled into the maintenance cycle | On status change | Within the maintenance cycle, best effort |
| P4Request | A routine content change, a small enhancement, or a question. | Covered window | Target: within one working day | Not applicable | On completion | Within the agreed content allowance, in the order received |
The targets above describe the operating model. The exact hours and figures for your engagement are confirmed in your scope of work, because a response target we cannot staff is worse than no target at all.
What happens weekly, monthly and quarterly. The quarterly restore test is the one that turns a backup from a belief into a control.
Weekly
Monthly
Quarterly
Frequency is matched to the plan and to the site. An ecommerce store on a weekly update cycle and a brochure site on a monthly one are both correct, and paying for the higher cadence on a site that does not need it is waste.
Reporting
A report that says everything is fine is indistinguishable from no work having been done. The monthly report shows what was checked, what changed and what still needs attention.
The open-risks section is the one worth reading. It carries forward anything we have flagged and you have decided not to act on yet, so nothing is silently forgotten and neither side is surprised later.
Takeover
Most sites we maintain were built by somebody else. Taking one over safely is a process, not a login handover.
We confirm you have the right to authorise access before touching anything. This protects both of us.
Individual accounts at the lowest level that works. We do not accept a shared password.
Platform, versions, plugins, theme, custom code, hosting, integrations and licences.
Our own verified backup of files and database before any change, stored in your destination.
Outdated components, direct theme modifications, abandoned plugins and unsupported runtimes.
Anything we cannot responsibly maintain, named explicitly rather than glossed over.
Recorded as pre-existing, so nobody later assumes we caused them.
Technical debt is a one-off scope. You can decline it, and we record the accepted risk.
A dated record of the site's condition on the day responsibility transfers.
From the baseline date, for the documented scope, and not before.
The previous provider does not need to be involved, and we will not disparage their work. Websites accumulate debt for ordinary reasons: budgets end, staff change, priorities move.
Ownership and handover
Four windows across the first month. Where a site arrives with unknown technical debt, this period establishes the baseline and the risks rather than resolving everything.
Days 1 to 5
Days 6 to 10
Days 11 to 20
Days 21 to 30
Where a site arrives with significant unknown technical debt, the first thirty days establish the baseline and the risks rather than resolving everything. Promising a clean bill of health on an undocumented site inside a month is not a commitment anybody can keep.
Monthly deliverables
Three plan shapes. The rows that matter most are restore testing, which functional checks run, and which incident severity levels are covered.
| Included each month | Essential Website CareA brochure or content site where availability and security matter, but downtime is inconvenient rather than costly. | Business Website CareA site that generates enquiries, where a broken form or a slow page has a direct commercial cost. | Ecommerce / Priority CareA store or booking system where a failed checkout is lost revenue and the purchase path needs transaction-level checks. |
|---|---|---|---|
| Baseline audit and asset inventory | |||
| Platform coverage | WordPress or static | WordPress or static | WooCommerce and higher-complexity sites |
| Update cycle | Monthly | Monthly, security releases sooner | Fortnightly, security releases sooner |
| Staging environment for testing | For major updates | ||
| Rollback on failed update | |||
| Backup frequency | Stated in your scope | Stated in your scope | Stated in your scope |
| Files and database both backed up | |||
| Backup retention | Stated in your scope | Stated in your scope | Stated in your scope |
| Off-site backup in your own destination | |||
| Restore testing | Annually | Quarterly | Quarterly |
| Availability monitoring | Automated, continuous | Automated, continuous | Automated, continuous |
| Form delivery checks | |||
| Checkout and payment checks | |||
| Transactional email checks | |||
| Malware scanning | |||
| Malware cleanup | Quoted separately | Quoted separately | Included once per year |
| Security hardening and access review | Annually | Quarterly | Quarterly |
| Performance review | Quarterly | Monthly | Monthly |
| Content edit allowance | Stated in your scope | Stated in your scope | Stated in your scope |
| Monthly report | |||
| Incident severity SLA | P3 and P4 | P2, P3 and P4 | P1 through P4 |
| Out-of-hours cover | Available, quoted separately | ||
| Change freeze at peak trading | |||
| Access inventory and quarterly review |
Backup frequency, retention and content hours read as stated in your scope rather than as fixed numbers, because they are set from the baseline audit. An ecommerce store taking fifty orders a day and a five-page brochure site need genuinely different backup intervals, and a printed grid would either overcharge one or underprotect the other.
Pricing
Three plan shapes, quoted after the health review. Maintenance is priced from what the site actually is, which is why the audit comes first.
A previously published page quoted three monthly maintenance prices, and the digital marketing bundles contain a different and much thinner set of maintenance features. Neither has been reconciled against the operating model on this page: the update cadence, backup frequency, restore testing, functional checks and response targets described here have a real staffing cost, and publishing an old figure against a fuller scope would misprice the work. One model is being approved. Until it is, this page publishes the plan shapes and every cost line, and you get a written quotation after the review.
Industries
Nine sectors with different critical functions and different costs of downtime. The plan that fits follows from what would actually break.
The critical function is the enquiry and quotation form, often the only route an overseas buyer has. The main risk is silent email delivery failure, which is why form submissions are tested rather than assumed.
Appointment booking and contact details are the critical functions, and availability affects real patients. Content accuracy carries a compliance weight that ordinary business sites do not.
Admission enquiry forms and application windows concentrate risk into short periods. A change freeze around the admission window matters more than a faster update cycle.
Checkout is the critical function and a failure is immediate lost revenue. Needs transaction-level checks, a shorter backup interval and a change freeze during peak trading.
Usually a marketing site in front of a product, with demo request forms and integrations to a customer system. The risk is a broken integration nobody notices until pipeline drops.
The enquiry form is the pipeline and a single lead often exceeds the annual maintenance fee. Availability and form delivery matter far more than page speed.
Booking flow and current information are the critical functions, with demand concentrated seasonally. An outage during a peak weekend costs more than the same outage in a quiet month.
Listing accuracy and enquiry routing are what matter. Frequent content updates make the content allowance and the change process more important than the update cadence.
Phone number accuracy, click-to-call and the contact form carry the whole site. Simple, but the cost of an outage is immediate because customers move to the next result.
Case studies
A maintenance case study is only useful if it shows the condition the site was in, what was actually done, how long it took and what the outcome cannot be attributed to.
Two things will never appear here. An uptime or performance figure without its measurement period, and a claim that maintenance produced revenue or rankings. Maintenance protects availability, security and function. Attributing commercial growth to it would be the same overclaiming this page criticises elsewhere.
Ask about comparable sites we maintainFour legitimate answers to the same problem. The expensive mistake is assuming hosting support covers your website rather than their server.
| Feature | Maintenance company | Doing it yourself | A freelancer | Hosting support |
|---|---|---|---|---|
| Proactive monitoring | Automated availability and scheduled functional checks | You notice when a customer tells you | Usually reactive, when you report something | Server uptime only, not your site's functions |
| Platform knowledge | Documented inventory of your specific site | Varies with your own time and interest | Often deep, sometimes only on their own builds | Server level. They will not debug your plugin conflict. |
| Availability | Stated support hours, with severity levels | Whenever you are free | Depends on their other client work | Usually round the clock, but only for server issues |
| Backup control | Files and database, off-site, in your own destination | Whatever you remember to run | Varies widely | Often server-level snapshots on the same infrastructure |
| Restore testing | Rarely | |||
| Staging and rollback | Rarely | Sometimes | ||
| Defined response targets | Severity-based, acknowledgement separated from resolution | Not applicable | Informal | For server incidents only |
| Content support | Stated monthly allowance | Your own time | Hourly, when available | Not offered |
| Reporting | Monthly, showing checks, changes and open risks | None | Usually none | Status page only |
| Cost | Monthly fee | No cash cost, real time cost and real risk | Lowest per task, least predictable | Included in hosting |
| Where this is the right answer | The site does commercial work and downtime costs money | A personal or low-stakes site you enjoy tinkering with | You need occasional fixes and can wait for them | You have in-house capability and only need infrastructure |
Hosting support and a good freelancer are both legitimate answers, and for plenty of sites they are the correct one. Hosting support keeps the server running, which is not the same as keeping your site working, and a freelancer you already trust is often better value than a plan you do not need.
Client reviews
The testimonial below is for a hospital launch campaign and broader digital marketing work, not for a website maintenance engagement. It is labelled honestly rather than presented as maintenance proof. A maintenance testimonial will appear here once a client has approved one, with the platform and the maintenance period stated.

Web Wonder Works™ have done an excellent job, reaching everyone's hearts and minds. This launch alone has paved a great path for my success.
Choose a maintenance provider based on supported platforms, verified backups, restore testing, staged updates, clear service levels, account ownership, incident governance and real maintenance evidence, not the word best in a headline. The fourteen criteria on this page are the ones worth applying, and two of them currently count against us because our proof sections are still empty.
A baseline audit and asset inventory, controlled software updates tested before deployment, backups of files and database with tested restoration, availability and functional monitoring, security maintenance, performance review, a defined allowance of minor content edits, incident response against severity levels, and a monthly report. The deliverables table on this page shows what varies between plans.
It depends on platform and complexity, whether the site is transactional, update cadence, backup frequency and retention, which functional checks are needed, the content allowance, support hours and which severity levels are covered. We are not printing a monthly figure until one model is approved, because an older published price does not match the operating model described here. You get a written quotation after the health review.
Yes, and most sites we maintain were built by somebody else. We verify ownership, take role-based access, inventory everything, take our own verified backup, and record pre-existing technical debt separately so nobody later assumes we caused it. Cleanup is quoted as a one-off and never absorbed silently into the monthly fee. We do not disparage the previous provider.
Yes, it is the primary supported platform. Core, plugins, themes, runtime compatibility, database maintenance, scheduled tasks, licences, users, spam, transactional email and security are all covered. WordPress is really a dependency management problem, and most incidents originate in a component nobody was tracking.
Yes, on the ecommerce plan, with transaction-level checks. Catalogue, cart, checkout, tax, shipping, payment gateway, order email, inventory movement, coupons, refunds and webhooks are all checked rather than assumed. Anything touching the purchase path is tested on staging and deployed in an agreed window, with a change freeze available during peak trading.
Case by case. Shopify maintains the platform itself, so maintenance covers theme, apps, content and functional checks rather than platform updates. Theme changes go through a duplicated theme and are previewed before publishing. Custom app development and Plus scripting are outside the scope.
Static, Astro and custom HTML sites are supported. React, Next.js, Laravel and PHP applications are case by case, accepted only after a code review and only where the codebase is documented and version-controlled. Bespoke software products and SaaS applications are not supported under a maintenance plan: they need a development retainer with engineers who know the codebase, and we will tell you that at the enquiry rather than after taking a fee.
On a scheduled cycle set by your plan, monthly for most sites and fortnightly for ecommerce, with security releases for the platform core applied sooner. Every update follows the same ten-step process regardless of cadence: review, backup, record versions, test where risk requires, update in order, smoke test, deploy, validate, record, roll back if needed.
Major version updates always, and anything touching checkout, payment or booking always. Minor updates on lower-risk sites are applied directly with a verified backup taken immediately beforehand and a recorded version state, so the rollback path exists either way. Whether your plan includes a maintained staging environment is stated in the deliverables table.
We roll back first and diagnose second. A backup is confirmed before any risky change and the version state is recorded, so reverting is a procedure rather than an improvisation. Once the site is functional again we investigate the conflict without time pressure, and the incident appears in your monthly report with the cause and what we did about it.
The interval is set per plan and stated in your scope, because it follows from how much data loss would be acceptable. A store taking orders through the day needs a shorter interval than a brochure site. What is fixed across every plan is that both files and database are backed up, storage is off-site in a destination you own, and restoration is tested.
Yes, always, and this is worth checking with any provider. WordPress stores your content in a database and everything else, including uploads, themes, plugins and configuration, in files. WordPress documentation treats them as separate components and a typical full restore needs both. A backup of only one is not a restorable site.
Off-site, in a storage destination that you own, separate from the hosting account. A backup that lives only on the server it is protecting will not survive a hosting failure or a compromise that reaches the filesystem. We hold role-based access to the destination and you can remove it.
Yes, on a schedule set by your plan, restoring to a separate environment. The result and date are recorded in your monthly report, so you always know when the last successful restore test happened. An untested backup is a belief rather than a control, and the first time most businesses find out theirs was incomplete is the day they need it.
The maximum amount of data you could lose in an incident, which follows directly from how often backups run. Hourly backups mean at most an hour of orders or form submissions lost. We agree this per site at contracting rather than publishing a universal figure, because the acceptable answer for a store and for a brochure site are not the same.
The target time to get the site working again after an incident. We agree it per site because it depends on the size of the site, whether hosting access is available at the time, and what kind of incident it is. We deliberately do not publish a fixed figure to every visitor: restoring a small site from a verified backup and recovering a compromised store with an unknown entry point are different problems.
Automated monitoring runs continuously, every day, and raises an alert when a check fails. That is genuinely round the clock. Human response happens during stated support hours. These are two different things and this page keeps them separate, because merging them into one 24/7 claim is the most common overstatement in this category.
No. Monitoring detects; people respond. Outside the covered window an alert is queued for the next covered period unless your plan includes out-of-hours cover, which is available on the ecommerce plan and quoted separately. If you need genuine round-the-clock human response, tell us at the review and we will give you an honest answer about whether we can staff it.
For a P1 critical incident the target is acknowledgement within the first hour of the covered window, with investigation starting immediately and hourly updates until service is restored. Acknowledgement is not resolution, and this page never uses one word for both. We do not promise a fixed restoration time, because an incident whose cause sits in third-party code or at your host cannot honestly be given a deadline.
Yes. We isolate the site, secure every credential, clean or restore from a backup taken before the compromise, patch the entry point, verify files, database and search index, and review Search Console Security Issues. Cleaning without finding the entry point guarantees a second incident, so both halves are required. Cleanup is quoted separately unless your plan includes it, and forensic investigation for legal purposes is a separate specialist discipline.
No maintenance provider can guarantee zero downtime, complete security or a fixed recovery time for every incident. Vulnerabilities are disclosed in software we did not write, credentials leak from systems we do not control, and hosting is often shared. We commit to the agreed monitoring, backup, update, response and reporting procedures, subject to the documented scope and dependencies. That is the honest version, and any provider offering more is telling you something useful.
Both, and the distinction matters more than almost anything else on this page. A site can return a healthy 200 status while its enquiry form silently stops delivering email, which is the most expensive failure there is because nothing looks wrong. Scheduled functional checks cover form submission and delivery, checkout completion, login, payment connectivity and transactional email.
A monthly allowance is included, stated in hours in your scope of work rather than described as unlimited. Included: text changes, image swaps, contact details, business hours, form field adjustments, product or price updates and publishing supplied blog posts. Unused hours do not carry forward, because the capacity was reserved for you.
No. A new page or template, a redesign, custom functionality, a new integration, a campaign landing page, bulk uploads, copywriting, SEO content and multilingual work are all quoted separately as development. The boundary is published on this page so it is agreed before the contract rather than argued about in month three. Anything outside the allowance is quoted before work starts, never invoiced afterwards as a surprise.
Indirectly and partially. Availability, speed, working links, valid markup and a site free of injected spam all support search visibility, and losing any of them can actively harm it. But maintenance is not an SEO campaign: it does not include keyword research, content strategy, link acquisition or competitive analysis, and nobody should sell it as ranking improvement. We monitor indexation and Search Console security issues, and full SEO is a separate service.
We track them and work to improve them. Google's published good thresholds at the 75th percentile of real user experiences are 2.5 seconds or less for Largest Contentful Paint, 200 milliseconds or less for Interaction to Next Paint, and 0.1 or less for Cumulative Layout Shift. We will not promise every page meets them, or that any page loads in under two seconds, because that depends on hosting, content, third-party scripts and the visitor's own device and connection.
You do, all of them: domain, DNS, hosting, content delivery network, content management system, repository, analytics, Search Console, backup destination and licences wherever the vendor allows. We take role-based access at the lowest level that works and we do not ask for your passwords. Backups are written to a destination you own, so if we disappeared tomorrow your backups would still be yours.
Our access is removed within two working days and confirmed to you in writing. You receive the asset inventory, the change log, the current baseline report and the credentials documentation. Your backups are already in your own destination. We leave no dependency behind: no agency-only plugin, no licence keyed to our account, no monitoring you cannot reproduce.
With a website health review, free and around thirty minutes. We look at the platform, versions, plugins, hosting, backups, security posture, forms and performance, and tell you what condition the site is in, what needs fixing before a plan makes sense and which plan actually fits. If the site does not need a maintenance plan, we will say so.
Find us
We work with clients across Coimbatore and meet in person when it helps.
On Kalapatti Main Road, inside Annamalai Industrial Park, about 2 km from SITRA and roughly 10 minutes from Coimbatore International Airport. Ground floor, with parking on site.
Please call or WhatsApp ahead to fix a time, so the right person is in the office when you arrive.
Free 30 minute health review, no obligation
Start with a documented health review covering software versions, backups, security, forms, performance, hosting and critical integrations. We will identify pre-existing issues, recommend the right plan and define exactly where the support boundary sits.
Prefer email? Write to [email protected].