WordPress security that goes below WordPress.

No. WordPress updates fix WordPress. A flaw in PHP itself, like PHP2Shell in October 2026, is fixed by a new PHP release on the server, and PHP has to restart to load it. For PHP2Shell, WordPress.org said no WordPress update was required or planned. That is why BoltPress Security checks the PHP version and patch level under every site, every day.

No. On shared hosting the host owns the server, so only the host can patch PHP. When your server needs a patch, you get a ready-to-send message for your host, filled in with your site's versions and the exact question to ask. If your PHP branch has reached end of life, we can move your site to a supported version. That is work a person does, so it uses your plan's work hours, and it starts only after you approve it.

Every scheduled update starts with a backup. Afterwards a health check loads your homepage and wp-admin, and on WooCommerce sites the cart and checkout pages. If a check fails, the update is rolled back automatically. We then offer to fix what the update broke and apply the security update again. The offer shows the estimated work hours, and nothing is billed until you approve it.

No. BoltPress Security is included in every care plan at no extra cost, and the automated service is the same on every plan. Work a person does, like a repair after a rollback, uses your plan's work hours. You can compare the plans on the plans page.

No. Nobody can honestly promise that, and we won't. What we promise is the work: known vulnerabilities flagged in plain English, updates applied with a backup and a health check, scheduled malware scans, and the server layer watched. If an update breaks something or a scan finds malware, a person can fix it once you approve: it uses your plan's work hours, and a one-off cleanup is available without a plan.

Every care plan includes malware scanning: a security plugin set up at onboarding runs scheduled scans, and a detection reaches you as a portal alert. Removing malware is work a person does, so it uses your plan's work hours, or you can pick a fixed-price fix. SSL certificate management is on every plan too: expiry monitoring for every site, auto-renewal set up at onboarding where BoltPress controls the certificate, and a ready-to-send message for your host where the host issues it. Fixing a broken certificate uses work hours.

Yes. Every care plan includes vulnerability alerts, PHP and server watch, incident advisories, safe updates with automatic rollback, malware scanning and SSL certificate management, plus a firewall, login protection and security headers set up at onboarding. Plans differ in work hours, priority support, uptime checks, backup retention and the free fix. Work a person does, like a repair, a PHP upgrade or a malware cleanup, uses your plan's work hours, then extra hours or a fixed-price fix.

We match the exact versions installed on your site against a vulnerability database every day, check your PHP version against official security releases and end-of-life dates, and your MySQL or MariaDB version against its end-of-life date. You only get an alert when something installed on your site is affected.

When a big issue lands below the plugin layer, like PHP2Shell, every client gets one advisory email. It lists each of your sites, what we checked, and what happens next, so you know where you stand without reading the news.