Website security

Proactive patching for WordPress, Drupal & Laravel

Itomic keeps WordPress, Drupal and Laravel websites patched, monitored and maintained, with monthly updates and clear reports. Most hacks exploit known weaknesses that already have a fix, so staying current is the best protection.

How it works

A simple, repeatable process

We monitor

We track security releases for your platform and every plugin, module or package your site relies on.

We update

Updates are applied on a regular schedule, with critical Drupal patches fast-tracked. Where a staging site is available, updates go there first.

We report, you check

We send you a summary of what’s been patched. You know your site best, so we ask you to check key pages, forms and payments after each update cycle and tell us straight away if anything looks wrong.

Wherever your site is hosted

We look after sites on our own hosting and elsewhere. No website can be made completely hack-proof, but keeping it patched drastically reduces the risk. If the worst does happen, we can repair your site or restore it from a recent backup. We patch WordPress, Drupal and Laravel sites, and security works best alongside our Australian hosting.

If your platform is already past end of life, patching alone isn’t enough. See platform upgrades and replatforming.

What’s included

Security that doesn’t wait for a problem

Our security contracts cover the ongoing work of keeping your website patched and protected: watching for security releases, applying updates on a regular schedule, and reporting back on what we’ve done.

Monthly patching

Core, plugin and module security updates applied every month, with critical Drupal patches fast-tracked.

Help if something breaks

If an update causes a problem, tell us and we’ll put it right, under your plan or quoted first.

Malware scanning

Daily scans on WordPress sites, with malware removed or your site restored from a healthy backup.

Help when updates misbehave

If an update causes a problem, we’re on hand to put it right.

Clear reporting

A summary after every update cycle, so you know exactly what’s been patched.

Platform specialists

Dedicated security contracts for WordPress, Drupal and Laravel sites.

Why it matters

Out-of-date software is the easiest way in

WordPress, Drupal and Laravel are open-source platforms with active communities that release security fixes as new threats emerge. Those fixes only protect your site once they’re installed. Left unpatched, a site becomes an easy target for malware, defacement, downtime or data loss. Applying updates properly takes time, technical skill and a process for knowing when they’re released. That’s the work we take off your hands.

For quick checks between updates, our free website tools include an SSL certificate checker, DNS and email authentication health checks, uptime alerts and Secret Share, a safe way to send passwords that expire after viewing.

WordPress and Drupal security and maintenance

Most website maintenance comes down to keeping software up to date. Our security contracts cover the most important part of WordPress and Drupal maintenance: applying core, plugin, theme and module security updates every month, with critical Drupal patches fast-tracked. WordPress sites also get daily malware scanning, and we offer the same proactive patching for Laravel applications.

Major version upgrades, such as Drupal 10 to 11, are larger projects that we quote separately; see platform upgrades. Content changes and new features also sit outside security contracts and are quoted as needed.

FAQs

Website security questions

More FAQs

What does WordPress maintenance include?

WordPress maintenance mainly means keeping WordPress core, plugins and themes up to date, particularly security updates, and watching for malware. Our WordPress security contracts cover monthly security patching and daily malware scanning, with help if an update causes a problem. Larger work, such as major upgrades or new features, is quoted separately.

Why does my website need regular security updates?

WordPress, Drupal and Laravel are open-source platforms whose communities release security fixes as new threats emerge. Those fixes only protect your site once they’re installed. An unpatched site is more vulnerable to malware, defacement, downtime and data loss.

Can you guarantee my website won’t be hacked?

No one honestly can. Keeping your site patched drastically reduces the risk, and if the worst does happen, we can repair your site or restore it from a recent backup.

What if a security update breaks something?

It’s rare, but it can happen. If something needs fixing after an update, we’ll put it right. Depending on your plan, that fix may be included or quoted first.

Can you look after the security of a website hosted somewhere else?

Yes. We can keep your site patched wherever it’s hosted, though the arrangement may differ from sites on our own hosting.

Our website is already out of date. Can we still start a security contract?

Yes. We’ll bring it up to date first as a one-off job, quoted before we begin, then keep it patched from there.

Are major version upgrades included in security contracts?

No. Moving to a new major version (for example Drupal 10 to 11) is a larger project, and we quote it separately.

Can’t we just apply security updates ourselves?

You can, but it needs developer access, technical skills, a way of knowing when updates are released, and the know-how to fix things if an update doesn’t go smoothly. That’s the work we take off your hands.