WordPress maintenance without surprises
We update core, plugins and themes on a staging site with a copy of your website, check that it still works, and only then touch production. With backups that have actually been restored, and vulnerability monitoring.
WordPress maintenance means keeping everything that runs on the server updated and monitored: the core, the plugins, the theme, the PHP version and the backups. Most WordPress intrusions get in through a plugin with an already published vulnerability that was not updated. Soamee applies updates first on a staging site with a copy of the website, runs tests on the critical flows, takes a backup before touching production and regularly checks that backups can be restored. If the site is already compromised, there is a separate intervention to clean it.
Four layers, each with its own review
What we watch runs from the application down to the server. A failure in any layer ends up showing on the website.
What we do every month
Tested updates
Core, plugins and themes are updated on staging, tests run on forms, checkout and private areas, and only what passes is published.
Restorable backups
Database and file copies stored off the server, and a periodic test restore. A backup that has never been restored is an assumption.
Vulnerabilities
We check the installed plugins and versions against published vulnerabilities and prioritise security patches.
Monitoring
An alert when the site goes down or the certificate is about to expire, and a review of PHP errors in the logs.
Users and permissions
A review of administrators, inactive accounts and access left over from former collaborators, which is where many problems begin.
Performance
Tracking of Core Web Vitals and of which plugin adds load, so we can fix it before it shows up in rankings or conversion.
How a silent intrusion is detected
WordPress publishes the checksum of every file in its core and in the plugins of the official directory. Comparing the files on the server with those checksums immediately shows which ones have been added or modified.
The list of administrators completes the review. On the right, an example WP-CLI session; names are illustrative.
$ wp core verify-checksumsSuccess: WordPress installation verifies against checksums.$ wp plugin verify-checksums --allWarning: File was added: wp-content/plugins/ejemplo/x.php# a file that is not in the plugin's official package: it gets reviewed$ wp user list --role=administrator --fields=ID,user_login,user_registered# unexpected administrators: a common sign of an intrusionFrequently asked questions about WordPress maintenance
What does WordPress maintenance include?
Why test updates on staging?
What if the site is already hacked?
Do you maintain a WordPress site you did not build?
What if a plugin we use is abandoned?
Start with an audit of your WordPress
We tell you which PHP version is running, which plugins are unsupported, whether the backups can be restored and what to fix first.
Tell us your challenge. We'll propose a solution.
No commitment. Within 24 hours, you'll receive a proposal with scope, timeline and budget. No fine print.