The PHP flaw WordPress couldn’t patch: how badly were sites hit, and what to do now
In 30 seconds (as of 2026-10-22). PHP2Shell is a pair of critical flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619), not...…
One-off fixesPay once, get it fixed.
Site is down
Store is losing sales
Security and speed
Ongoing careMonthly care plans. Cancel anytime.
Care plansMonitoring, backups, safe updates and work hoursPrefer email? [email protected]
Describe what you are seeing and a person will look at it, or run the free audit to find problems automatically.
Checkout
Orders
Orders
Users
Core Web Vitals
Audit report
Monitors
Blog
SubjectMy checkout stopped working
Expert care for your WordPress site - security, safe updates, backups and support, so you can focus on what matters.
Deep expertise in
Click a feature to see it in action.
Hi, our contact form stopped sending emails since the updates yesterday.
Found it: a plugin update reset the mail settings. Fixing it uses your work hours. Shall I go ahead?
Yes, please go ahead.
Done. The form sends again, and a test message is in your inbox.
Tips, guides, and insights for WordPress site owners.
In 30 seconds (as of 2026-10-22). PHP2Shell is a pair of critical flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619), not...…
Quick triage (read this first). WooCommerce checkout not working and orders not coming in? Take a breath, this is one...…
Quick triage (read this first). Order emails gone quiet? Take a breath, this is one of the most common WooCommerce...…
Daily vulnerability alerts for plugins, themes and core, a PHP and server watch, and safe updates with automatic rollback. Included in every care plan.
How it works →Lab-measured Core Web Vitals, scheduled uptime checks, response-time tracking, incident alerts.
A backup before every update and a health check after, daily off-site backups to Backblaze B2, one-click restore.
A real engineer on every request, in the BoltPress portal or by email. No chatbots, no scripts, no outsourcing.
Free audit at /wordpress-audit/ — security, performance, SEO, best practices. PDF report in your inbox in 90 seconds.
Start the audit →One-time cleanup at /fix-wordpress/: from $149 Quick fix to $349 Comprehensive (USD). No subscription required.
See fixes →Monthly care plans at /plans/ — Essential $89, Managed $249, Complete $599. Cancel anytime.
View plans →BoltPress is a human-run WordPress care service. We scan your site, fix what's broken, and keep it maintained with monthly care plans. No chatbots, no scripts. One engineer, your site.
WordPress site owners who run a business on their site — agencies handing off client sites to a long-term maintainer, e-commerce shops on WooCommerce, SaaS companies with a marketing site, and founders who want someone else handling the boring maintenance.
Care plans: Essential ($89 per month), Managed ($249 per month), Complete ($599 per month). Every plan includes work hours each month: Essential 1 work hour, Managed 3 work hours, Complete 5 work hours. Anything a person does, like a repair after a failed update, a PHP upgrade, a malware cleanup or speed work, uses your plan's work hours. Extra hours are $60/hour, or pick a fixed-price fix. One-time fixes are also available without a subscription.
You'll get an email with onboarding steps: add our admin account to your site, install the BoltPress Worker plugin, and we handle the rest — scan, your free fix, backup setup, monitoring, firewall and login protection. You get full dashboard access once onboarding is done.
Yes. We maintain WooCommerce stores on all plans. Every update starts with a backup, a health check then loads your cart and checkout pages, and a failed check rolls the update back automatically. Testing an update on a staging copy first is work a person does, so it uses your plan's work hours.
Yes. We work with any WordPress host — Kinsta, WP Engine, SiteGround, Cloudways, your own VPS. If your host is causing problems, we'll tell you and help you migrate.
Cancel anytime from the dashboard. We retain your backups for 30 days after cancellation, then permanently delete them. Plugin installations and config changes we made stay on your site.
Managed hosts give you infrastructure. We give you a human who fixes things. Hosts don't debug your broken form or reverse your bad plugin update. We do.
Join 500+ site owners who sleep better at night.