WordPress security, handled for you.
A real-time firewall, malware scanning and automatic cleanup, daily updates and off-server backups, all part of your plan.
Something wrong today?
If you think you have been hacked, do not delete anything yet. Pick what is happening and follow the first steps while we take over.
Spam pages, redirects or a Google warning. We isolate it, clean it and patch the way in.
Get it fixed Locked out of adminLost password, a broken login page or a hacker changed your email. We get you back in.
Get it fixed DownAn error page, a blank screen or nothing at all. We find out why and bring it back.
Get it fixed Broken by an updateA plugin or theme update took the layout or the whole site down. We roll it back first.
Get it fixedHow we keep it secure.
We lock it down
Firewall on, login protection on, risky settings switched off in your WordPress config.
We scan and watch
Files are scanned as they change, plus a full scan every night.
We patch
Security updates for WordPress, plugins and themes, checked against your pages.
We clean it up
Infected files are cleaned automatically, and cleanup is free on every plan.
Protection that runs before WordPress loads.
Most of this happens at the server and the edge, before a request ever reaches your site. It is on from day one on every plan, and it does not slow your pages down.
- Firewall. Known attack patterns, bad bots and abusive traffic are stopped at the edge
- Malware scanning. Files are checked as they change, plus a full scan every night
- Login protection and 2FA. Repeated failed logins are blocked, admin logins can require a code
- Daily updates. Core, plugin and theme security patches, applied with a visual check
- Nightly off-server backups. Kept 14 days, so there is always a clean copy to go back to
What we do in the first hour.
If your site is showing spam, redirecting visitors or flagged by Google, this is the order we work in. You can sign up today and we start on it today.
- 1Isolate
Put the site behind a holding page or block the attacker’s path so no more damage is done and visitors are not hurt.
- 2Snapshot
Take a full copy of the site as it is, infected files and logs included, so nothing is lost and we can see how they got in.
- 3Clean
Remove injected code, backdoors, rogue admin users and spam content. Replace core, plugin and theme files with clean originals.
- 4Restore if needed
If the damage is deep, roll back to a clean nightly backup from before the break-in and bring recent content forward.
- 5Patch the way in
Fix the hole: the outdated plugin, the weak password, the abandoned theme, the open upload folder.
- 6Rotate everything
New passwords for every admin, new database password, new security keys and salts, new SFTP and API keys.
- 7Resubmit to Google
If Search Console flagged the site, we request a review once it is clean and watch until the warning clears.
Clean-up is part of the plan, not an extra bill.
Every plan includes hack recovery. Sign up, tell us what you are seeing, and the clean-up is in your first month. No emergency fee.
You never have to ask “any update?”
Every request gets a live status in plain English from the moment it lands, right in your dashboard.
- Nine clear states, not just Open and Closed
- Every status change, timestamped
- Close finished work with one click, or send it back
- Your sites, backups, billing and uptime in the same place
Protection on every plan.
Real-time firewall
Blocks common attacks like SQL injection and malicious bots before they reach WordPress.
Malware scanning
Files scanned as they change, plus a full scan every night.
Automatic cleanup
Infected files are cleaned automatically. Hack cleanup is free on every plan.
Login protection
Repeated failed logins are blocked so passwords can’t be guessed.
Daily security updates
Patches applied daily, with a visual check so nothing breaks.
Off-server backups
Nightly backups kept 14 days, so there’s always a clean copy to restore.
What an incident looks like, start to finish.
The firewall stops almost everything. For the rest, this is the timeline you can expect, on every plan.
We notice
The scanner flags a changed file, the uptime check fails, or the firewall sees a pattern. Our team gets the alert, not you from a customer.
We contain and clean
Isolate, snapshot, clean, and restore from a clean backup if that is faster. Your dashboard shows a request with a live status the whole time.
We close the hole
The way in is patched, passwords and keys are rotated, and the site is back up with the firewall rule that would have stopped it.
You get the write-up
What happened, how they got in, what we changed, and anything you should do, like changing a reused password. Google review requested if needed.
Included in recovery on every plan
- Malware removal and backdoor cleanup, however long it takes
- Restoring from a clean backup, files or database or both
- Rotating passwords, salts, database and API keys
- Removing spam pages and rogue admin users
- Search Console review request and follow-up
- A plain-English write-up of what happened
What we need from you
- Access to your domain registrar if DNS was changed
- Access to Search Console if Google flagged the site
- A list of who should have admin access, so we can remove everyone else
- Ten minutes to set up two-factor codes on your own login
A security plugin vs a hosting firewall vs Upstrike.
A plugin runs inside WordPress, after the attacker has already reached it. A hosting firewall stops traffic but does not fix a site. We do both and clean up when needed.
| What you get | A security plugin | A hosting firewall | UPSTRIKE |
|---|---|---|---|
| Where it runs | Inside WordPress, after the request lands | At the edge, before WordPress | At the edge and on the server |
| Effect on speed | Slows every page load | None | None |
| Malware scanning | Yes, on your server | Usually not | As files change, plus nightly |
| Who cleans up a hack | You, or $200 to $500 per incident | Not the host | We do, included |
| Security updates applied | Alerts you | No | Daily, with a visual check |
| Login protection and 2FA | Yes | Sometimes | Yes |
| Off-server backups | Add-on, often same server | Sometimes, same account | Nightly, 14 days, separate storage |
| Someone watching the alerts | You | Nobody | Our team, every minute |
| Cost | $100 to $200 a year, plus cleanup | Built into hosting | Part of every plan |
Who this is for, and who it isn’t for.
This is for you if
- You have been hacked before, or you are hacked now
- Your site takes payments or holds customer details
- You do not want to be the person who reads security alerts
- You have had a Google warning and cannot afford another
- You run several sites and want them all protected the same way
Probably not for you if
- You want security for a site hosted somewhere else (we protect at the server, so we need to run it)
- You need a formal penetration test or compliance audit (we can refer you)
- Your site is not WordPress
- You want a one-time clean-up with no plan afterwards (a cleaned site with the same hole gets hacked again, so we only clean sites we then look after)
Included in every plan.
Hosting, care, security and support in one monthly price. Higher plans add development time from our team.
WP Shield
Hosting and care for your site, handled every day. Development when you need it.
- Managed WordPress hosting
- Daily plugin, theme and core updates
- Nightly off-server backups
- 24/7 monitoring and emergency response
- Real-time firewall and malware protection
- Automatic malware cleanup
- Free whole-site troubleshooting
- Developer-level support
WP Boost
Most popularHosting and care, plus a developer who knows your site.
- Everything in WP Shield
- 1 hour of development each month
- Small updates without using your hour
- Proactive recommendations
- WooCommerce store care
WP Pro
Ongoing development with a dedicated point of contact.
- Everything in WP Boost
- 3 hours of development each month
- A dedicated point of contact
- Priority handling
WP Scale
Your complete web team: hosting, development and strategy.
- Everything in WP Pro
- 8 hours of development each month
- First-priority queue
- Strategy calls and consulting
No contracts, cancel any time, and your data is always yours. More sites are $79 a month each and share your plan's hours.
Which plan is right for you?
Sites that rarely change
Your site needs to stay safe, fast and online, but you rarely need changes.
Growing businesses
Your site brings in leads or sales and you sometimes need a developer for tweaks and fixes.
Busy sites and stores
You update every week, add features, or run a WooCommerce store.
Sites that drive growth
You want priority handling, strategy calls and real development time every month.
Questions, answered.
More on the full FAQ page, or email [email protected] and a real person will reply.
See plansWhat happens if my site gets hacked?
We clean it up, and it’s free on every plan. Infected files are cleaned automatically; if more is needed, our team removes the rest and restores a clean backup if it comes to that.
How often do you scan for malware?
Files are scanned as they change, and there’s a full scan every night.
Do I still need a security plugin?
No. Our protection runs at the server, before WordPress even loads, so a security plugin would only slow your site down.
How do you handle security updates?
Daily, with the same visual check as every other update. Urgent security fixes go out as soon as they’re released.
Do you do security audits?
Every new site gets a full checkup in its first week, including security settings, outdated plugins and risky configuration. You get a list of what we found and fixed.
What’s included in backup security?
Nightly backups of files and database, stored off the server and kept 14 days, so a problem on the server can’t touch them.
How do WordPress sites usually get hacked?
Outdated plugins and themes, by a long way. Then weak or reused admin passwords, pirated “nulled” plugins with backdoors built in, and abandoned plugins nobody patches. Daily updates and login protection close most of these.
Will you find out how they got in?
Usually, yes. The snapshot we take before cleaning keeps the logs and the infected files. That tells us the entry point, and the write-up you get says what it was and what we changed so it cannot happen again.
My site has a Google warning. How long until it clears?
Once the site is clean we request a review in Search Console. Google usually answers within a few days. We watch it until the warning is gone and the pages are back in results.
Do you set up two-factor login?
Yes, on every plan. Admin logins can require a code from an app. We set it up for you and your team and walk you through it in a few minutes.
What if the hack also hit my email or domain?
We help you lock down the registrar and DNS, and check mail records so your email is not being used for spam. If a reused password was the way in, we tell you which accounts to change.
Can I see what the firewall blocked?
Yes. Your dashboard shows security events for your site, and the monthly report lists attacks blocked, logins stopped and anything cleaned.
Hand off your WordPress site today.
Pick a plan, check out in two minutes, and we take it from there.