Skip to content
WPdoki
HU

WordPress technical operations

We don't edit websites.
We run them.

WordPress technical operations from the server to the plugins. Security, updates, backups, monitoring, performance, migration and development. We take care of the technical side. Content and marketing stay with you or your agency.

Request an assessmentSee the plans
  • WordPress
  • PHP
  • MySQL
  • Linux
  • Nginx
  • Redis
  • DNS
  • CDN
  • Backup
  • Security
  • Monitoring
  • A verified backup before every update
  • We check more than whether the site is up
  • From the plugin to the server

You decide what goes on the site. We make sure it works.

If it belongs to how your WordPress site runs, we handle it. If it belongs to what the site says, we don't. The two are kept apart on purpose, so neither suffers for the other.

Technical operations

  • Installation, configuration, updates, tested updates, staging
  • Backups, off-site copies, restores and regular restore tests
  • Monitoring: availability, functions, performance, server, logs, security
  • Hardening, vulnerability monitoring, malware detection and cleanup, incident response
  • Performance: PHP, MySQL, Redis, caching, CDN, Core Web Vitals
  • Migration, DNS, SSL/TLS, Cloudflare, Nginx, Apache, server setup
  • Custom plugins, WooCommerce extensions, API integrations, automation

Content and marketing

  • Copywriting, blog posts, recurring content upload
  • Campaign management, ad management, social media
  • Link building, SEO content production, keyword research
  • Graphic design and branding

If you need those too, we are glad to work alongside your agency: we keep the technical side in order, they do the rest.

Services

Five areas, one responsible team.

Operations, security, performance, infrastructure and development. All of it is about how your WordPress site runs, and all of it belongs to the same people.

Operations

Updates, backups, monitoring — regular and documented

Outdated components, weak access control and misconfiguration widen the attack surface. Regular updates, monitoring and verified backups reduce the risk and limit the impact of incidents.

  • WordPress updates
  • Provably restorable backups
  • Monitoring
  • Staging and restore
  • Server operations
In detailSecurity

Smaller attack surface, faster detection, handled incidents

Security is not a plugin but several layers: current components, hardened settings, monitored vulnerabilities, and a procedure for when something happens anyway.

  • Hardening
  • Vulnerability monitoring and management
  • Malware detection and cleanup
  • Incident response
  • Access security
In detailPerformance

A fast site for measurable reasons

Speed is not a plugin you switch on but the whole chain: PHP, database, cache, CDN, and what the browser actually loads. We measure, change, and measure again.

  • WordPress and PHP tuning
  • MySQL and Redis
  • Caching and CDN
  • Core Web Vitals
  • Technical search compatibility
In detailInfrastructure

Order underneath WordPress too

Server, DNS, certificate, CDN, web server. Rarely visible, but everything else stands on them — and most mysterious faults start here.

  • Migration
  • DNS, SSL/TLS, Cloudflare
  • Server setup
  • Staging environments
In detailDevelopment

If a technical function is missing, we build it

Custom plugins, WooCommerce extensions, integrations with external systems. Engineering work, not page-builder clicking: version-controlled, tested, documented.

  • Custom plugins and WooCommerce extensions
  • API integrations
  • Automation and SSO
In detail

Access levels

What can we see at each level of access?

How deep the monitoring goes depends on what you give us access to. A great deal is visible from outside; WordPress admin opens up the internal state; server access opens up the whole infrastructure.

Level 1 — public

Only the site's address. No admin, no server access.

Everything measurable from outside: availability, certificate, DNS, security headers, WordPress exposure, performance, and synthetic tests of the functions that matter.

  • Availability and response time
  • Certificate and DNS
  • Security HTTP headers
  • WordPress exposure
  • Core Web Vitals
  • Synthetic function tests
Full list

Availability

  • HTTP and HTTPS, status code, uptime
  • Redirect chain, response time
  • DNS lookup, TCP connect, TLS handshake, TTFB, page load

TLS

  • Certificate validity, expiry, chain
  • Hostname match, TLS version, HSTS

DNS

  • A, AAAA, CNAME, NS, MX, TXT
  • SPF, DMARC, DNSSEC
  • Record changes

HTTP security

  • HSTS, CSP, X-Frame-Options, X-Content-Type-Options
  • Referrer-Policy, Permissions-Policy, CORS
  • Cookie security

WordPress exposure

  • wp-login and wp-admin exposure, XML-RPC, wp-json, REST user enumeration
  • Version leakage, readme, license, directory listing, error leakage
  • Exposed backups, .git, .env, SQL and log files

Performance

  • TTFB, LCP, CLS, INP, FCP
  • Page size, request count, JS, CSS and image payload
  • Cache headers, compression, HTTP/2, HTTP/3, CDN

Synthetic tests

  • Homepage, contact page, search, contact form, login
  • WooCommerce cart, checkout, payment handoff
  • Critical API endpoints

Level 2 — WordPress admin

Administrator access to WordPress.

Everything from level 1, plus the internal state of WordPress: versions, updates, vulnerabilities, users, file integrity, database health and WooCommerce.

  • Plugin and theme versions, vulnerabilities
  • Abandoned plugins
  • Administrators and roles
  • File integrity
  • WP-Cron, Action Scheduler
  • WooCommerce health
Full list

WordPress

  • Core version, pending updates, auto-update settings
  • Site Health, WP-Cron, loopback requests, REST health, permalink issues

Plugins

  • Installed versions, update status, latest version
  • Vulnerability data, CVEs, abandoned plugins, repository status, compatibility
  • Inactive and unnecessary plugins

Themes

  • Active, parent and child theme
  • Updates, vulnerabilities, unused themes

Users

  • Administrators, new admins, role changes
  • Inactive admins, weak admin usernames, two-factor state where measurable

File integrity

  • Modified core, plugin and theme files
  • Unexpected PHP files, executable files among uploads

Application health

  • Database size, revisions, transients, autoloaded options, orphan metadata
  • WP-Cron jobs, failed cron, Action Scheduler, object cache status

WooCommerce

  • WooCommerce version, database schema, scheduled and failed actions
  • Payment gateway state, webhook errors, REST, checkout and mail health
  • Third-party integration status

Level 3 — server / root

An SSH key to the server. Root or sudo where possible.

Everything from the previous levels, plus the whole infrastructure: operating system, services, PHP, web server, database, Redis, filesystem and server-level security.

  • CPU, memory, disk, inode, IO
  • Nginx / Apache, PHP-FPM, MySQL, Redis
  • OS and PHP lifecycle, security updates
  • Slow queries, buffer pool
  • SSH logins, firewall, fail2ban
  • Filesystem integrity
Full list

Operating system

  • Uptime, CPU, RAM, swap, load, disk, inode, IO wait, disk latency
  • Filesystem, kernel, reboot required, OS version and lifecycle
  • Package and security updates

Services

  • Nginx, Apache, PHP-FPM, MySQL/MariaDB, Redis, cron, fail2ban
  • Postfix where relevant

PHP

  • Version and lifecycle, extensions, memory_limit, max_execution_time, upload limits
  • OPcache and its hit rate, worker count, saturation, queues, max_children, slowlog

Nginx / Apache

  • Requests/sec, connections, 2xx/3xx/4xx/5xx ratios, upstream errors, timeouts, latency
  • Worker saturation, access log anomalies, error logs

MySQL

  • Connections and max_connections, slow queries, query latency, deadlocks, aborted connections
  • InnoDB buffer pool and hit ratio, temp tables, disk temp tables, locks
  • Database size, table growth, binlog growth, replication, backup state, corruption checks
  • WordPress-specific: wp_options and autoload size, postmeta and options growth, Action Scheduler tables, revisions, transients

Redis

  • Availability, memory, hit ratio, evictions
  • Connected clients, expired keys, fragmentation, maxmemory

Filesystem

  • File integrity, unexpected PHP, wp-config modifications, permissions, owner/group
  • World-writable files, .env, logs, executable uploads, symlink changes

Security

  • Failed and successful SSH logins, root login, new Linux users, sudo usage, SSH key changes
  • Firewall and open port changes, fail2ban, brute force, suspicious processes and outbound connections
  • Malware and rootkit checks, cron/crontab changes

The same team, the same report — more simply becomes visible at every level.

Monitoring

We check more than whether the site is up.

A 200 response does not mean the contact form sends, the checkout charges or the login works. We actually walk through the functions that matter — regularly, by machine.

Availability

Status code, response time, redirect chain, TTFB — from several locations.

Checkout and forms

Cart, checkout, payment handoff, contact form, login — played through.

SSL and DNS

Expiry, chain, HSTS; records and every change to them.

WordPress

Versions, updates, vulnerabilities, admins, cron, file integrity.

Server

CPU, memory, disk, PHP-FPM, web server, logs, SSH, firewall.

Database

Slow queries, connections, buffer pool, table growth, backup state.

If the cart breaks, we should know before your customer does.

Backups

What matters is not whether a backup exists. It is whether it restores.

A backup that has never been tried is only a hope. We restore from it regularly, and we write down how long it took and how much data it would have lost.

Provably restorable backups.

  • Database and files separately, daily, with an off-site copy
  • Regular restore tests — in a sandbox with automatic checks on the larger plans
  • RPO and RTO written down: how much data can be lost, how long recovery takes

A backup does not prevent a break-in — updates and hardening reduce the risk, monitoring detects the problem, and the backup limits the damage and makes recovery possible.

What we track about backups

  • Last successful backup
  • Database backup
  • Files backup
  • Off-site copy
  • Retention
  • Encryption
  • Backup duration
  • Backup size
  • Size anomaly
  • Restore test
  • Last successful restore
  • RPO / RTO

Plans

Three plans. One team behind each.

The difference is not in how much we care but in what you give us access to and how much is at stake. Every plan is a monthly fee, invoiced, with no lock-in.

WPdoki Kontroll

Everything measurable from outside — and the updates in order.

29 900 Ft+ ÁFA / month

A small-business WordPress site where public monitoring and regular updates are what matters.

  • 24/7 public uptime monitoring
  • SSL and DNS monitoring
  • Performance monitoring, Core Web Vitals trends
  • Security headers, external malware and blacklist checks
  • WordPress update management, a backup before and a check after
  • Vulnerability monitoring
  • Daily backup with an off-site copy
  • Monthly technical report

Critical issue response begins: Within the next business day

Technical details
  • HTTP/HTTPS, status code, redirect chain, response time, TTFB from several locations
  • Certificate expiry and chain, DNS records and their changes
  • HSTS, CSP, X-Frame-Options and the rest
  • Core, plugin and theme updates with a post-update functional check
Choose this
Most popular

WPdoki Gondozás

Full WordPress-level monitoring, tested updates, tested backups.

59 900 Ft+ ÁFA / month

An actively used site where the internal state matters too: plugins, users, database, functions.

Everything in WPdoki Kontroll, plus:

  • Full admin-level monitoring
  • Malware monitoring and file integrity
  • Admin user change monitoring
  • Abandoned plugins, WP-Cron, database health, autoload, Action Scheduler
  • Staging and testing of critical updates
  • WordPress tuning and cache optimisation
  • Quarterly restore test
  • At least 3 synthetic function checks
  • Advanced monthly technical report
  • 30 minutes of technical work per month

Critical issue response begins: Within 4 business hours

Technical details
  • Plugin and theme versions, vulnerabilities (CVE), repository status
  • Modified core, plugin and theme files, unexpected PHP files
  • wp_options and autoload size, revisions, transients, failed cron
  • Contact form, login, cart/checkout walked through
Choose this

WPdoki Üzemeltetés

Managed application and server operations, in one pair of hands.

119 900 Ftfrom + ÁFA / month

Your own server or VPS, where the layer under WordPress is ours too. Requires server/root access where possible.

Everything in WPdoki Gondozás, plus:

  • Server monitoring: CPU, RAM, disk, inode, IO, network
  • Web server, PHP-FPM, database, Redis, cron, logs
  • SSH, firewall, fail2ban, OS security updates
  • PHP and OS lifecycle tracking
  • MySQL, PHP and Redis tuning
  • Server hardening
  • Server-level backup and restore verification
  • 1 hour of technical work per month

Critical issue response begins: Within 2 business hours

Technical details
  • OPcache, PHP-FPM saturation, slowlog; Nginx/Apache error ratios and upstream errors
  • MySQL slow queries, buffer pool, connections, table growth
  • Redis memory, hit ratio, evictions
  • SSH logins, new users, sudo, firewall and port changes, rootkit checks
Choose this

Prices are net, VAT is added. Every engagement starts with a paid technical assessment. Subscribe to any plan within 30 days and the full assessment fee is credited. About the assessment →

See the plans

Technical assessment

The diagnosis is paid. If we then run the site, the fee is credited.

We do not start operating a site blind. First we look at what is there: from outside, or — with access — from inside and on the server too. The result is a written WPdoki Lelet, which is yours even if no subscription follows.

  • A written WPdoki Lelet: an overall score and one per area
  • Every finding with an ID, severity, risk and recommendation
  • A priority order: what is worth doing first
  • Marked: what we can fix, and what belongs to someone else
  • A recommendation on which plan fits the site — or that none does
Request an assessment

WPdoki Lelet

Example. The numbers are an illustration, not a real site's results.
87
Overall state
  • Availability99
  • Security73
  • Backup94
  • Performance58
  • Maintainability72
WP-017Outdated pluginHighOpen
Affected component
Plugin (example)
WPdoki can fix
Yes
Problem
The installed version is several releases behind the current one, and the release notes show a security fix it is missing.
Risk
A known, publicly documented flaw can be exploited for as long as the update is postponed.
Recommendation
Update tested in staging, a backup beforehand, a functional check afterwards.

Custom development

If a technical function is missing, we build it.

Only as much code as needed. An existing plugin where that is better; custom where the existing one is only baggage.

  • Custom WordPress plugin
  • WooCommerce extension
  • API integration
  • CRM and PMS
  • Invoicing and payments
  • SSO
  • Automation, import, export
  • Legacy plugin replacement
In detail

How we work

Assessment, report, operations.

We do not start with a contract but with a diagnosis. Then you decide.

  1. 1

    Technical assessment

    From outside, or with the access you give us, from inside and on the server too. Paid, standalone — not a sales pitch in disguise.

  2. 2

    WPdoki Lelet

    You receive it in writing: scores per area, every finding with severity, risk and recommendation, in priority order.

  3. 3

    Plan and operations

    Subscribe within 30 days and the assessment fee is credited. From then on you get a monthly report on state and trend, not a task list.

Questions

What people usually ask first.

What does it mean that WPdoki only handles the technical side?

WPdoki runs the technical operations of WordPress sites: updates, backups, monitoring, security, performance, migration, servers and development. It does not do copywriting, marketing, advertising, social media or graphic design, but works alongside the agencies that do.

Why is the assessment paid?

Because it is standalone technical work with a standalone result: a written report that is yours even if no subscription follows. If you do subscribe to a plan within 30 days, the full assessment fee is credited.

What access do I have to give?

As much as you like. With only the site's address we already see a great deal from outside. With WordPress admin access we see the internal state too: plugins, users, database, file integrity. With server access, the whole infrastructure. Every level sees more, but none is compulsory.

What happens if an update breaks the site?

We take a backup before every update, test the critical ones in staging, and check the important functions afterwards. If something breaks anyway, we restore the previous state and then look separately at what conflicted.

My site has been hacked. How long does recovery take?

Investigation of critical incidents begins with priority. Recovery time depends on the extent of the compromise and the infrastructure involved — we do not promise it in advance, but within the first hours we can see what we are dealing with, and we keep you informed in writing.

Does a backup protect against being hacked?

No, and we do not claim it does. Updates and hardening reduce the risk, monitoring detects the problem, and a backup limits the damage and makes recovery possible. That is why we regularly test whether the backup really restores.

Do you handle WooCommerce or multilingual sites?

Yes. We run WooCommerce, WPML and Polylang sites. A shop comes with checkout, payments and webhooks, so it usually carries a surcharge, and the synthetic tests extend to the cart and the checkout.

What does “critical issue response begins” mean?

That within the stated time on a business day we start investigating and acting — not that it is fixed by then. Resolution time depends on the fault. 24/7 human on-call is part of the Critical plan, by individual agreement.

Let us start with a report.

Send us your site's address and we will decide which assessment level fits. The result is a written WPdoki Lelet — and if we then run the site, the fee is credited.

Request an assessmenthello@wpdoki.com
WPdoki — WordPress operations, security, monitoring, performance