What is managed WordPress hosting? A month of the actual work

Reading the update list before touching it

Managed WordPress hosting means your host keeps the software current, keeps working copies of it, watches for trouble and renews certificates before they lapse. Every host would sign that sentence, so rather than define it again, here is the work itself: what happens to a WordPress site on our servers across an ordinary month. Nothing dramatic happens in this month. A month where nothing dramatic happens is the thing you are buying.

A WordPress site is three things wearing one coat: the core software, a theme, and however many plugins you have collected. Each releases on its own schedule, written by different people with no obligation to get along. So the month starts with a list, and the first job is reading it, not applying it. A release note saying "fixes a flaw allowing an unauthenticated visitor to upload files" is a today job, and at eleven at night it is a tonight job. One that "adds a colour picker to the settings screen" can wait for a quiet hour.

Each update goes on with a fresh backup taken first and a rollback ready. Then comes the half nobody sells and nearly everybody skips: checking afterwards. A monitoring tool will report that a page returned a 200 while happily serving a broken layout. We open the site and use it, starting with the pages that would embarrass you most if they stopped working.

The one that breaks something

Once or twice a month an update does not survive contact with a real site. It is rarely dramatic and usually specific: a layout that shifts because a page builder changed how it handles a container, a slider that stops sliding, a product filter that starts returning nothing.

The update comes straight back off, so the site is working again before anyone has to think hard. Then the thinking starts: which two plugins disagreed, what the changelog says changed, whether a setting fixes it, and whether the author already knows. Sometimes it ends with an email to a developer in another country and a fortnight on the old version. Sometimes it ends with us telling you the plugin has been abandoned and you need a replacement. Most customers hear about all of that afterwards rather than during. That gap is more or less the whole product.

Backups and the alert nobody is awake for

The copy you hope never gets used

A copy of the site leaves the server every day and is kept for 14 days. The important word in "daily off-site backups" is not "daily". A backup stored next to the thing it protects dies in the same fire: if the machine fails, or ransomware reaches everything it can touch, a copy on that server goes with it. A backup nobody has ever restored is a hope, which is worth asking any host about, us included. Our guide to what daily backups should actually mean lists the questions.

The 3am alert

WordPress runs a large share of the web, which makes it the platform most worth attacking. Almost none of that is personal. It is scripts working through lists of sites, trying known holes in old plugins and guessing weak passwords. So the watching is mostly mechanical: login attempts faster than a person could type, files changing when nobody has logged in, server load that does not match the traffic, and mail suddenly pouring out of a site that never sends email. That last one is often the first sign a site has become somebody else's spam relay.

Our monitoring genuinely runs at three in the morning on a bank holiday, not nine to five with an alarm bolted on. Out of hours it reaches the same people as during the week, and Olly, who runs the place, picks problems up himself at weekends. That does not mean nothing will go wrong. It means the gap between something going wrong and us knowing stays short, with a clean copy behind it either way. If a site is hacked, the clean-up is included at no extra charge.

Certificates, and the jobs you send us

The padlock in the address bar comes from an SSL certificate, and certificates expire. Modern ones are deliberately short-lived, so renewal is a recurring job that has to keep succeeding. The failures worth watching for are the ones where the renewal itself is fine and something around it moved: a domain pointed at a different DNS provider, or a subdomain added months back that never made it onto the certificate. When one lapses, browsers put a full-screen warning in front of your site and most visitors turn round. See the "Not secure" warning for more.

Plenty of the month does not arrive on a schedule. It arrives from you: a mailbox for a new starter, a DNS record for a booking tool your marketing agency wants to plug in, a heads-up that a campaign goes out next week and will the server cope. Those calls cost minutes in advance and save hours afterwards. You still choose what goes on your website, and anything you install this afternoon becomes something we maintain from tomorrow, so tell us before you add something heavy and you get an opinion beforehand rather than an apology afterwards.

Where managed WordPress hosting stops, and what it costs

Two edges are worth naming early. None of this is unlimited development: redesigning a page, building a booking system or writing your content is project work, quoted on its own, usually by dijitul, our sister agency. And hosting cannot rescue a badly built site. We can make a slow site quicker, but we cannot turn a bad theme into a good one, and where the real answer is a rebuild we would sooner say so early than host the old one for another three years.

All of the work above sits inside £1 a day + VAT (£365 a year + VAT, or £35 a month + VAT), with the move from your current host included. Several sites under one roof are priced on their own, and a shop moves the conversation to WooCommerce hosting, which is a different amount of work again. The itemised list is on our WordPress hosting page, and the general argument about managed, unmanaged and budget shared hosting is in what fully managed web hosting means.

Related