Watch. The lynx keeps an eye on your site.

Whenever the cause was WordPress itself or a plugin or theme we rated as approved or under watch. We clean the site (or restore it from a backup) and close the gap the malware came through.

Malware removal is quoted separately when the cause was:

• a plugin or theme rated not recommended that was not removed within 14 days of our notice,
• staying on an older major WordPress version for more than 90 days after a new one was released, if you did not agree to the update or the work it requires,
• editing theme or plugin files yourself,
• an account taken over on your side (e.g. a Google or Microsoft account without two-step verification, or password sign-in switched back on),
• an infection that existed before Watch was switched on - the first clean-up is a separate service: malware removal.

In every case we get the site working again first and talk about billing afterwards.

Yes. You keep administrator rights and install what you need. Watch keeps checking all installed plugins and themes - including ones you add later - and the monthly report rates them:

• approved - covered by the malware removal guarantee,
• under watch - e.g. rarely updated; the guarantee applies, but we suggest a replacement,
• not recommended - abandoned, with a known vulnerability or from an illegal source; we let you know, and it is not covered by the guarantee until you remove it.

We check against fixed criteria, not with a code audit: whether the plugin has known vulnerabilities, whether it is still maintained, when it was last updated and whether it works with your WordPress version. If something is wrong, the report says so and suggests a replacement.

We do not review plugins and themes from outside WordPress.org (e.g. paid .zip files) - the report marks them as not reviewed and they are not covered by the malware removal guarantee. On request we can review them individually. For WordPress.org plugins the repository shows us their update history, support and reported vulnerabilities straight away - for others that data does not exist.

Want to know before installing whether a new plugin is safe and right for your site? We review it on request within 1–2 working days, as part of technical support (per hour of work).

+ Add an hour of work to cart

By default you sign in to the WordPress dashboard with your Google or Microsoft account - no separate password. The username and password form is switched off, so there is nothing to guess or steal.

• Access is limited to the email addresses you give us, or to your whole company domain (Google Workspace, Microsoft 365).
• Two-step verification works on your Google or Microsoft account - we recommend switching it on.
• When an employee leaves, just disable their company account - they lose access to the site too.
• Your store's customers sign in as before - this only applies to accounts with dashboard access.

If you prefer password sign-in, we will switch it on at your request - an infection through a stolen password is then not covered by the guarantee.

Security patches (e.g. 6.8.1 → 6.8.2) are installed automatically within 36 hours of release (usually within 24 hours) - in every package, whatever update frequency you choose. We treat a new major version the same way if we consider it important for security.

New major versions (e.g. 6.7 → 6.8) are rolled out after checks:

• we wait for the first patch of the new version (e.g. 6.8.1) - unless we decide otherwise, and a version important for security (e.g. one that fixes a vulnerability in the version you use) is rolled out within 36 hours of its release in the WordPress.org repository, like a security patch,
• before the update we back up the whole site, check that the theme and plugins are compatible and tell you the date,
• after the update we check the key areas: home page, forms, cart and payments, sign-in.

You can postpone a major update - e.g. during peak sales - by up to 60 days. The same rules apply when changing the PHP version. The frequency chosen in the calculator applies to plugin and theme updates.

Vulnerabilities in plugins and themes are fixed faster the more frequent the updates you choose:

Severity follows public WordPress vulnerability databases. Plugins and themes from outside WordPress.org (e.g. paid .zip files) are updated on schedule - there is no official vulnerability information for them, so we do not promise a deadline. A vulnerability that waited for an update according to your chosen option does not void the malware removal guarantee.

We restore the working version from the backup straight away - your site does not wait for a fix. Then we find the cause, e.g. a theme that does not support the new WordPress version, a plugin that does not work on the new PHP version or custom code on the site.

If the site needs changes, we will quote the work needed for the update. Once you approve it, we will do it as part of technical support and run the update again. The update itself, the backup and restoring the site are included in the subscription - adapting the site is not.

Exception: for a critical vulnerability that is already being exploited, we update immediately and let you know afterwards. If going back to the backup would mean going back to the vulnerable version, we will agree on temporary protection while the work is done.

Included is care for what is already on your site: updates of WordPress, themes and installed plugins, a check of the site after every update (and restoring a backup if something breaks), plugin checks with a monthly report and malware removal.

Extra are changes: installing and configuring new plugins, design changes, new features and reworking the site when e.g. a theme does not work with a new WordPress version. We do them as part of technical support (PLN 200 net per hour) or at the rate of our trusted partner - always after you approve the quote.

Choose a package in the calculator and add it to your cart - you can enter your domains straight away. At the start we check the site, move sign-in to Google or Microsoft and review the installed plugins. If your site is already infected, start with malware removal (from PLN 990 net per domain, quoted after a review) - once it is clean, Watch takes over.