The part nobody notices until it fails
Security, uptime, speed, backups, and updates are tedious. They are also the difference between a site that works reliably for a decade and one that goes down the week before a conference, or worse, starts showing your patients a malware warning. This is the part I handle so you never have to think about it.
Infrastructure is everything holding the site up
A website is not a single element. It is an interwoven stack. A domain name points at a server, the server runs software, that software runs WordPress (or another CMS), WordPress runs a theme and a set of plugins, and a database lurks underneath holding your custom content. Any layer can fail, and mostly they fail quietly.
Your role isn't to know or care about any of it. What you should expect is that somebody is watching all of it, that a failure gets caught before your patients notice, and that when something does break there is a recent, accessible copy ready to put back.
Six things that keep a site standing
None of these are exciting. All of them are the reason a website is still working three years after launch, or is not.
Security, set up properly the first time
Strong authentication, restricted logins, a firewall in front of the site and malware scanning behind it, and file permissions set the way they should have been on day one. Most attacks are automated and opportunistic. Hardening takes you off the easy list.
Updates, applied and tested automatically
Core, theme, and plugin updates applied to a staging copy first, checked, then pushed live. Turning on auto-update for everything and hoping works right up until the morning an update takes your homepage with it.
Backups you can count on and rapidly restore
Automatic, stored somewhere other than your server, and kept long enough to cover a problem you did not notice straight away. Restored on purpose from time to time, because a backup nobody has ever tested is a guess.
Reliable and automatic uptime monitoring
The site gets checked around the clock. If it goes down, if the certificate is about to expire, or if a form quietly stops delivering, I find out first and you hear it from me rather than from a patient who could not reach you.
Speed, measured in ways that count
Google grades real visits on three things: how quickly the main content appears, how fast the page reacts when tapped, and whether it shifts around while loading. Good means under 2.5 seconds, under 200 milliseconds, and almost no movement. I measure the same numbers and fix what is genuinely slow.
Hosting, domains, and SSL certificates
Hosting chosen to suit the site rather than to be the cheapest line item, DNS configured correctly, certificates renewing on their own, and email that arrives instead of landing in spam. All of it registered in your name, with credentials you hold.
How small sites actually get broken into
It is almost never a person deciding to specifically target your practice. It is an automated script or 'bot' working through a list of every WordPress site on the internet, testing each one for a single known vulnerability in a specific plugin version. If you have that version, you are in the list. If it was patched three weeks ago, the script moves on to the next site.
That is why updates matter more than any security product you could buy. WordPress itself is well maintained and is rarely the point of entry. The way in is usually a plugin someone installed for one feature years ago and never updated, or one whose developer stopped maintaining it and quietly walked away, leaving it sitting in the plugin directory looking perfectly healthy.
So the work is discipline and routine rather than wizardry. Keep the plugin list short. Know who maintains each one and whether they still do. Patch quickly. Delete anything nobody uses. I audit what you are running, tell you which pieces are a liability, and keep the rest current.
The cheapest work is the work done before anything breaks
You already know this axiom better than I do, prevention beats treatment every time.
An hour a month spent applying updates on a staging copy, reading the security log, confirming the backups actually ran, and watching whether load times have drifted is uninspiring work. It is also the difference between a small scheduled task and an emergency, and emergencies never arrive at a convenient time. Cleaning up a compromised site, getting search warnings lifted, and rebuilding confidence with patients who saw a browser warning costs far more than never being on that list in the first place.
Maintenance is not an add-on I raise after the invoice. It is the part that protects everything else you paid for, and it is the single easiest place to spend a little and save a lot.
What I build on, and why
None of this is proprietary and none of it is mine. These are mature, widely used tools that are maintained, and this matters more than you might anticipate. If you ever hand the site to another developer, they will recognize every one of these tools and pick it up without a rebuild.
Security
Wordfence for the firewall, malware scanning, and login protection, or Kadence Security where a lighter footprint suits the site better. Both do the same essential job: stop the automated attacks before they ever reach WordPress.
Backups
UpdraftPlus for scheduled backups to offsite storage in your own account, with restores that have actually been tested rather than assumed. Host-level backups on top of that wherever the host provides them, because two independent copies are the whole point.
Hosting
WP Engine and comparable managed WordPress hosts, where server updates, staging environments, and daily backups come as standard rather than as something you have to remember. For a practice site this is worth the premium; a cheap shared host is a false economy you pay for later.
Speed and monitoring
Caching and image optimization matched to the host rather than piled on blindly, uptime monitoring that alerts me instead of you, and Google's own field data for speed, because what real visitors experience matters more than a synthetic score out of a hundred.
An unverified backup is not a backup
Every host will tell you they take backups. Fewer will tell you how old the most recent one is, how long they keep them, whether they sit on the same machine as your site, or what actually happens when you ask for one at nine o'clock on a Friday night. I set up backups that run automatically, live somewhere other than your server, are kept long enough to cover a problem you did not notice immediately, and get restored on purpose now and then so that we both know they work.
How fast I respond is something you choose
Practices do not all need the same thing. A three-physician clinic with a straightforward site does not need what a multi-location practice taking bookings and payments online needs. Pick the level that matches what an outage would actually cost you, and move up or down whenever that changes.
Keep it healthy
Scheduled maintenance, backups, monitoring, and security, with requests handled in turn. Right for a site where a day offline would be an annoyance rather than a real cost.
- Monthly updates, tested on staging
- Offsite backups and uptime monitoring
- Security scanning and firewall
- Response within a couple of business days
Keep it moving
Everything above, plus your routine content changes are included rather than billed piecemeal, and you are not waiting on me for small things. Where most practices land.
- Everything in Essential
- Content updates included, not itemized
- Quarterly speed and security review
- Same business day response
Keep it covered
Everything above, plus a site-down or security incident goes to the front of the queue and gets worked immediately, including outside normal hours. Right when patients book, pay, or submit information through the site.
- Everything in Priority
- Outages and incidents jump the queue
- Reachable outside business hours
- Agreed recovery target, in writing
Exact response windows go into your agreement rather than living as a promise on a web page. I would rather commit to one I can keep than one that reads well.
Find out what shape yours is in
Send me your website address. I'll tell you what it is running, what is out of date, whether your backups are real, and how the site performs for an actual visitor on a phone. Plain English, in order of what matters, including the parts that are fine and need nothing done to them.