WordPress care that keeps up with AI-speed attacks
Attackers now use AI to turn a newly disclosed plugin flaw into a working exploit within hours. WordPress Care keeps your site updated, protected, and watched, so a problem gets handled before your visitors or Google notice it.
From $149 per site, per month. Month to month. Free onboarding.
White-label care for agencies with five or more client sites. Contact us for partner pricing.
Your WordPress site is being tested every day
5 hours
For the most heavily exploited WordPress vulnerabilities, the weighted median time from public disclosure to the first attack.
11,334
New vulnerabilities found in the WordPress ecosystem in 2025. That is 42% more than the year before.
91%
Of those vulnerabilities were in plugins, not in WordPress itself.
46%
Had no fix available on the day they became public.
Source: Patchstack, State of WordPress Security in 2026.
A monthly update used to be enough. It no longer is on its own. When a flaw can be exploited the same afternoon it is announced, your site needs protection that works in the hours before an update exists.
Keeping your software current closes most of these holes, and every plan does that. If your site earns money or holds sensitive data, it also needs protection in the hours before an update exists. That is what the add-ons are for.
That is what the three care levels are built around.
One plan. Add protection that fits what your site does.
Start with WordPress Care. Add Business Protection if your site sells or brings in leads, and Sensitive Data Security if it handles information that has to stay private.
WordPress Care
$149 per site, per month
For business websites that need to stay current, backed up, and safe.
- Monthly WordPress core, plugin, and theme updates, tested before going live
- Backups before any change
- Login check after every update: each plugin updated, or a reason why not
- Exclusion list for plugins and themes that should not be auto-updated
- Update notes: what was done, what was skipped, and why
- Firewall and malware scanning installed with standard settings
- Uptime monitoring every 60 seconds
Business Protection
+$100 per site, per month ($249 in total)
Add-on for online stores and sites that bring in leads or sales.
- Automatic vulnerability protection with virtual patching (powered by Patchstack), typically applied within hours of a disclosure
- Outage response: acknowledged after 15 minutes of confirmed downtime, then worked to resolution within 4 hours
- PitchPurge AI: keeps sales pitches out of your contact forms, AI usage included. Only available from Webidextrous.
- Scheduled form testing: we are alerted when a form breaks or is missing from your site
- WordPress Health & Security Review at onboarding and whenever a problem surfaces ($149 value)
- Unlimited image compression for faster pages
- Quarterly hosting plan and traffic review
Sensitive Data Security
+$100 per site, per month ($349 in total)
Add-on for health, financial, and legal sites, and any site that takes payments or faces security audits.
- Security plugin management: setup, alert monitoring, and fixes for what it finds*
- Security headers and Content Security Policy, tuned as your site changes (Advanced Security Headers license included)
- SecurityHeaders.com grade: we aim for an A and never let a site fall below a B
- Monthly security and maintenance summary
Added on top of Business Protection. A person on our team manages your site’s security instead of leaving it on standard settings.
Which do I need?
| Your site | What to choose | Monthly |
|---|---|---|
| Brochure site: tells people who you are and how to reach you | WordPress Care | $149 |
| Online store, bookings, or a site your leads come through | WordPress Care + Business Protection | $249 |
| Health, financial, legal, or audited | WordPress Care + Business Protection + Sensitive Data Security | $349 |
Good to know
- Month to month. Free onboarding. Either side can end with 30 days written notice.
- Add or remove an add-on before any billing cycle.
- Sensitive Data Security is added on top of Business Protection. It is not sold on its own.
- *Sensitive Data Security sites should carry Wordfence Premium or another premium security plugin, purchased by you. A premium plugin gets new firewall rules and malware signatures as they are published instead of 30 days later.
- On the base plan, the firewall runs on standard settings and we do not monitor its alerts.
- Plugin and theme licenses belong to you. We flag expired or missing licenses; renewing them is your call.
- Work outside the plan is quoted before we start.
Three care levels. Mix them across your portfolio.
Essential
Kept current and monitored, with a firewall. Best for simple brochure sites.
Managed
Protected automatically, watched, and pitch-free. Best for sites that bring in leads or sales.
Fortified
Security managed by a person. Best for sites that take payments, face audits, or sit in healthcare, finance, or government.
| What each site gets | Essential | Managed | Fortified |
|---|---|---|---|
| Monthly WordPress core, plugin, and theme updates, tested before going live | ✓ | ✓ | ✓ |
| Backups before any change | ✓ | ✓ | ✓ |
| Login check after every update: each plugin updated, or a reason why not | ✓ | ✓ | ✓ |
| Exclusion list for plugins and themes that should not be auto-updated | ✓ | ✓ | ✓ |
| Update notes on your project board or by email, mirrored to our tracker | ✓ | ✓ | ✓ |
| Firewall and malware scanning installed with standard settings | ✓ | ✓ | ✓ |
| Uptime monitoring every 60 seconds | ✓ | ✓ | ✓ |
| Outage response: acknowledged after 15 minutes of confirmed downtime, then worked to resolution within 4 hours | ✓ | ✓ | |
| Automatic vulnerability protection with virtual patching (powered by Patchstack), typically applied within hours of a disclosure | ✓ | ✓ | |
| WordPress Health & Security Review at onboarding and whenever a problem surfaces | ✓ | ✓ | |
| Unlimited image compression for faster pages | ✓ | ✓ | |
| PitchPurge AI: keeps sales pitches out of contact forms, AI usage included. Only available from Webidextrous. | ✓ | ✓ | |
| Scheduled form testing: we are alerted when a form breaks or is missing from the site | ✓ | ✓ | |
| Quarterly hosting plan and traffic review, plus a portfolio review call | ✓ | ✓ | |
| Security headers and Content Security Policy, tuned as the site changes (Advanced Security Headers license included) | ✓ | ||
| SecurityHeaders.com grade: we aim for an A and never let a site fall below a B | ✓ | ||
| Security plugin management: setup, alert monitoring, and fixes for what it finds* | ✓ | ||
| Monthly security and maintenance summary | ✓ |
Good to know
- Month to month. Either side can end with 30 days written notice.
- Move a site between levels before any billing cycle.
- *Fortified sites should carry Wordfence Premium or another premium security plugin, purchased by you or your client.
- On Essential, the firewall runs on standard settings and we do not monitor its alerts.
- Plugin and theme licenses belong to you or your client. We flag expired or missing licenses; renewing them is your call.
Partner pricing is per site, per month, and depends on your portfolio.
The partner program starts at five client sites.
Fewer than five sites? Our plans for website owners work for client sites too. See owner plans.
Protection in the hours that matter
With Business Protection, your site is covered between updates. When a vulnerability is disclosed, virtual patching applies a protective rule inside WordPress, often before the plugin author ships a fix. No site code is changed, and your next monthly update installs the real fix.
Managed and Fortified sites are covered between updates. When a vulnerability is disclosed, virtual patching applies a protective rule inside WordPress, often before the plugin author ships a fix. No site code is changed, and the next monthly update installs the real fix.
Every WordPress Care site is checked from multiple locations every 60 seconds. With Business Protection, we also commit to a response. Short network blips clear on their own, so we treat the first 15 minutes as unconfirmed. After that:
Every site is checked from multiple locations every 60 seconds. On Managed and Fortified sites, we also commit to a response. Short network blips clear on their own, so we treat the first 15 minutes as unconfirmed. After that:
1. Acknowledge
You get a note from us saying we are on it.
2. Resolve
Outages we own are worked to resolution within 4 hours: restoring a backup, rolling back an update, or driving a ticket with your host.
3. Close out
You get a plain-language note on what happened.
What happens on your site every month
1. Back up
We back up the site before touching anything.
2. Update
We update WordPress core, plugins, and themes, with visual checks for anything that changed.
3. Verify
We log in and confirm every plugin updated. Anything that did not gets a reason, most often an expired license.
4. Check the live site
We look for visual or functional problems, and roll back if something is wrong.
5. Report
We send you notes on what was done, what was skipped, and why.
Plus a second set of eyes
With Business Protection, your siteEach Managed and Fortified site also gets an AI-assisted review of update logs, code changes, and rendered pages at onboarding and whenever a problem surfaces. A person on our team checks every finding and verifies every fix.
Included with Business Protection: forms that work, and an inbox without sales pitches
Included with Managed and Fortified: forms that work, and an inbox without sales pitches
Your contact form is for customers. Most of what arrives through it is not from customers. SEO vendors, lead-generation agencies, and offshore developers fill in forms by hand, so CAPTCHAs and spam filters let them through. Every one of them costs you time, and a real lead can get buried underneath.
PitchPurge AI is a plugin we built to fix that. It reads each form submission that got past your other filters and decides whether it is a real enquiry or a pitch.
Pitches go to the spam folder
The reason is attached, and no notification lands in your inbox.
Nothing is deleted
If it ever gets one wrong, the message is still there and you can restore it.
Real leads are never held up
If the AI is unavailable, the submission is delivered as normal.
It knows your business
It screens against a profile of what you actually sell, so a genuine customer asking about your services is not mistaken for a vendor.
Works with your form plugin
Gravity Forms, Contact Form 7, WPForms, Fluent Forms, Formidable Forms, and Ninja Forms.
The AI cost is on us
We supply and pay for the AI service, within a monthly allowance.
It also checks that your forms still work. A broken contact form fails silently: visitors think they reached you, and you never hear from them. PitchPurge tests your forms on a schedule and alerts us when one stops delivering or is no longer on any page of your site, so we can fix it before you lose leads.
You cannot get PitchPurge anywhere else. It is not in the public WordPress plugin directory. It comes with the Business Protection add-on. If you ever leave, the plugin stays on your site and keeps working once you connect it to your own AI account.
Something your competitors cannot offer. PitchPurge is not in the public WordPress plugin directory. Your clients get it only through you, on the Managed and Fortified levels. If a client ever leaves, the plugin stays on their site and keeps working once it is connected to their own AI account.
White-label WordPress care for agencies
Your team stays on sales and new builds. We do the maintenance under your name.
We never contact your clients
All communication runs through you.
Room for your margin
Partner rates sit well below what we charge website owners for the same care level, so you can resell at our public price or bundle it into your own retainer.
PitchPurge AI, exclusive to partners
On Managed and Fortified sites: an AI filter that keeps sales pitches out of your clients’ contact forms and tests that the forms still work, with the AI cost included.
Mix levels site by site
Put the brochure sites on Essential and the regulated clients on Fortified.
Built for portfolios
The partner program starts at five client sites, and you add more as you launch them.
Any WordPress host
We are a Pantheon partner agency and work on other hosts too.
How a partnership starts
1. Book a partner call
Send the short form and pick a time. On the call, tell us about your portfolio: how many sites, which hosts, and what your team handles today.
2. Get your partner pricing
We send a written quote for your portfolio, per site and per care level.
3. Onboard your sites
We set up each site and pick up the next monthly cycle.
Support from the people who manage your site
Send a request through the support form or by email. Our team covers U.S. Eastern business hours and a good part of the Asia-Pacific day, so overnight issues get picked up.
Not ready yet? Start with a review.
WordPress Health & Security Review: $149, one time. A written report on your site: outdated and vulnerable plugins, expired licenses, security header grade, speed problems, and what to fix first. Reviewed by a person, not just a scanner.
Included free with Business Protection. Sign up for WordPress Care within 30 days and the $149 is credited to your first month.
Want to see our work before the call? Order a review of one client site.
What a hacked site actually costs
Emergency WordPress help from us costs $200 an hour. A hacked site also costs you the leads you lose while it is down, a browser or search warning that scares visitors away, and the trust of the customers who saw it.
WordPress Care costs less each month than one hour of emergency work.
One hacked client site costs more in emergency work and goodwill than a year of care for it.
Start with a 15-minute call
Tell us how to reach you and pick a time. We will look at your site before the call, answer your questions, and handle the setup details for you afterwards. There is nothing technical to fill in.
Tell us how to reach you and pick a time. We will talk through your portfolio and send written partner pricing after the call.
Site already broken? Get emergency WordPress help.
Questions people ask
Host auto-updates install new versions without checking whether your site still works afterwards. We test every update, confirm each plugin actually updated, and roll back if something breaks. Hosts also do not protect you in the hours between a vulnerability being announced and a fix being released.
No. Plans are month to month and either side can end with 30 days written notice.
No. We maintain WordPress sites on any host. We are a Pantheon partner agency and can also move your site there with a free migration.
Yes. Submissions on the forms you choose are sent to an AI provider to be classified. We add suggested wording for your privacy policy when we set it up.
It stays on your site. To keep it screening, you connect it to your own AI account.
No. WordPress only.
A brochure site is well served by WordPress Care on its own. Add Business Protection if the site sells online or brings in your leads. Add Sensitive Data Security as well if it handles health, financial, or legal information, takes payments, or has to pass audits. You can add or remove an add-on before any billing cycle.
It is a protective rule that blocks attempts to exploit a known vulnerability, applied inside WordPress without changing your site’s code. It covers the gap until the real fix is installed. It is part of the Business Protection add-on.
No. Onboarding is free.
Business Protection and Sensitive Data Security are designed to stop that from happening. If it does, we tell you what we found and quote the cleanup before we start.
It is a plugin we built that uses AI to catch contact-form submissions that are really sales pitches. Flagged messages go to your form’s spam folder and are never deleted. It also tests your forms on a schedule and alerts us if one breaks. It is included with Business Protection and is not available in the public WordPress plugin directory.
Partner pricing is per site, per month, and depends on your portfolio and the care level for each site. Book a partner call and we will send a written quote.
The partner program starts at five client sites. For fewer, our plans for website owners work for client sites too.
We do the work, you own the client relationship. We never contact your clients, and update notes go to you to pass along under your brand.