The pace at which vulnerabilities are published in WordPress plugins no longer allows security fixes to be handled as they come, without a framework. From 1 November 2026, we are offering our clients two plans for their website’s security updates. Neither is imposed: each client chooses the one that suits their site and budget.
The time to fix a vulnerability has collapsed
Between the publication of a vulnerability and its large-scale exploitation on sites that have not yet patched it, the average time was 45 days in 2020. It fell to 7 days in 2023. In 2026, it is less than 24 hours.
The acceleration comes from automation. A public security advisory can now be turned into working attack code in around fifteen minutes, for about one dollar, using AI tools available to anyone (Cloud Security Alliance, 2026).
What your website is up against
Bots looking for vulnerable sites run around the clock. They are not targeting anyone in particular: they are looking for a plugin version that has not been updated. Your site does not need to be well known to be found.
- Around 250 vulnerabilities are published every week in WordPress plugins and themes.
- 43% of them can be exploited without any login.
- 23% are still unpatched a month after publication.
These are 2026 figures consolidated from Patchstack, Wordfence and Sucuri reports.
How we handle a vulnerability
Part of this work goes unseen; the rest happens while you sleep.
Daily monitoring. We follow vulnerability databases, specialist blogs and security researchers’ accounts, where information often circulates before the official fix is published.
Same-evening response. Vendors almost always announce their fixes in the late afternoon. So we regularly step in at 10 or 11 pm, sometimes at weekends, because waiting until the next morning means leaving a door open through an entire night of automated scans.
Shared deployment. We prepare and test the fix once, then apply it automatically to every site concerned. Time spent for one client benefits the others, and vice versa. That is what keeps the maintenance contract at this price: each client pays their share of shared monitoring, not a one-off intervention.
What hosting covers, and what it does not
This point often causes confusion, and it is better to clarify it before an incident does it for us.
The hosting contract covers server availability and monitoring, platform security and hardening, system backups, and SSL certificates and their renewals.
What belongs to the website itself, however: updates to WordPress, plugins and the theme, the application security of the site and its forms, clean-up and restoration after a compromise, and the consequences of a targeted DDoS attack.
Two plans from 1 November
On-demand interventions, billed by time spent. Security updates are applied when needed and invoiced at the end of the month, with no minimum term. The cost varies from month to month, and these interventions are handled after those of clients under contract.
Maintenance contract, €50 to €150 excl. VAT per month per site. This is the plan we recommend. It includes:
- daily monitoring of published vulnerabilities;
- fixes applied as a priority, including outside office hours;
- a backup before every intervention;
- a check of the site after each update;
- a monthly report of interventions.
The amount depends on the size of the site, the number of plugins and how critical it is. The heaviest platforms and custom developments receive a separate proposal.
What about your site?
Every site is different, and we do not want to quote a price off the cuff. We look at your installation together, the number of plugins and their condition, then give you a costed proposal.
Our clients have until 31 October 2026 to choose their plan. Without a reply by that date, their site switches by default to the “on-demand interventions” plan, billed by time spent.
To discuss it, book thirty minutes with us or contact Emmanuel Nudel directly at en@artwhere.eu or on +32 475 29 31 46.
Get in touch
ArtWhere, digital innovation