Keep your WordPress site patched and checked

JKCA Studio is a web and care studio in Seal Beach that patches, backs up and watches WordPress and PHP sites it does not host, starting with a one-time patch check at $395.

We've sat inside SOC 2 audits for clients and helped them pass. It's slow, careful work, and it's the standard we patch to.

Patch check

$395, one site

We look at the PHP that's live. Where we have access, we patch it to a fixed release, restart PHP and confirm the fix from a live page. Where only your host can change PHP, we ask them in writing. Either way you get a short note of what we found and what we couldn't see. Nothing on your site changes until you've said yes.

Ask for the check
Checked within 2 business days of getting access.
Patched within 5 business days of a PHP security release, for sites on monthly patching.
Alerts answered the next business day.

What the patch check covers

PHP
Patched to a fixed release, or your host asked in writing and their answer passed on to you.
Restart and confirm
PHP restarted, and the fix confirmed from a live page, not the control panel.
Updates waiting
WordPress, plugin and theme updates listed.
Logs
One look through the logs we can reach for known warning signs.
The note
A short written note: what we found, what we changed, what we couldn't see.

Only need the php2shell fix? The PHP patch page has the version table and where to look.

After the check, Watch or Patch.

Watch$69 a month

For owners whose host or team does the updates and who want an outside eye.

  • Uptime and certificate checks, with a person reading every alert
  • Weekly check of PHP, WordPress and plugin updates waiting
  • We confirm your backups exist and are recent
  • Monthly plain-English report
  • No updates applied by us
Patch$129 a month

For small-business sites that want updates handled and checked.

  • Everything in Watch
  • WordPress, plugins and theme updated weekly, after a fresh backup
  • PHP security releases applied within 5 business days and confirmed, or chased with your host in writing
  • A test restore to a copy of your site every quarter
  • Cloudflare set up in front of your site, if you want it
HardenComing later

For sites that take payments, bookings or logins.

Per site. Month to month, 30 days notice to stop. Your first monthly report arrives within 30 days. We don't promise incident hours, and we don't offer annual billing. Anything a plan doesn't cover is hourly at $225 an hour, quoted before we start.

What's not included.

  • Promises that a site can't be broken into. No one can honestly make one.
  • Cleanup after a confirmed break-in. We stop, explain what we found, and quote before doing more.
  • Forensic investigations, breach notices or legal advice.
  • Custom code, redesigns or content edits.
  • Hosting fees and paid plugin or Cloudflare licenses.

When your host controls PHP

On a lot of shared and managed hosting, only the host can update PHP. Then we check everything we can from outside and inside WordPress, ask your host in writing which PHP build is live, and put their answer, with the date, in your report. We never say a site is patched until the host confirms it in writing or we see it on a live page.

Would you rather stop running WordPress? Our care plans host your site with no login page and no database, and we can move it for you.

From the first email to the written note.

Ask for the check

Send the address and who hosts it with the form below. We reply with a payment link, or with questions if the site needs a closer look first.

Give us access

Through your own invites, so you can remove it any time. No passwords by email. We take a backup, then patch, restart and confirm.

Read the note

What we found, what we changed and what we couldn't see. If you want it handled from then on, Watch or Patch picks up each month.

Ask for the patch check.

One site per form. We reply in writing, and nothing starts before you pay.

Already sure? Pay for the check

The usual questions.

Can you promise my site won't be hacked?
No, and be careful with anyone who does. What we promise is the work: updates on a schedule, backups we've actually restored, a person reading alerts, and a written report of what we checked and what we couldn't see.
My host says PHP is patched. Is that enough?
Often it is. We still check it from a live page, and ask the host in writing which build is running. On PHP 8.1, 8.0 or 7.4 the version number doesn't change after the patch, so we check the build date: Oct 21, 2026 or later.
Do I need this if my site is on a JKCA care plan?
Most care plan sites don't. Our care plans host static sites with no PHP, no login page and no database, so php2shell doesn't reach them. We'll confirm it for your site and tell you. Store sites on WooCommerce are different; ask us.
What's the difference between this and a security plugin?
A plugin runs inside WordPress. The October PHP flaws sit underneath WordPress, in PHP itself, so a plugin's firewall may not stop them. Wordfence's help pages describe its firewall as running inside WordPress. We work on the PHP, the updates, the backups and the logs.
What happens if you find a real problem?
We stop and tell you what we found, in plain words, and what we suggest. Cleanup and anything else outside your plan is quoted before we start.
How fast do you respond?
A person reads every alert, and we get back to you by the next business day. We're a small studio, and we'd rather tell you that up front.
Do you test backups?
On Patch, yes. We take a backup before every update and restore one to a copy of your site every quarter, and the report says when and whether it worked. Watch confirms your own backups exist and are recent; it doesn't restore them.
Can I cancel?
Yes. Plans are month to month with 30 days notice, like our care plans. You remove our access when we're done.
More questions 3 more
What warning signs do you look for?
For php2shell, the public ones researchers have shared: a scanner user agent named php2shell-scan, upload requests carrying PHP's upload-progress field, bursts of memory errors, PHP starting programs like wget or curl, a file at /tmp/nfs, new PHP files in the uploads folder, and admin users nobody recognizes. A sign isn't proof. We check before we tell you anything is wrong.
How soon after a PHP security release do you patch?
On Patch, within 5 business days of the release. We restart PHP and confirm the fix from a live page. If your host controls PHP, we ask them in writing in that window and put their answer, with the date, in your report.
Do you only work with Seal Beach businesses?
No. We're in Seal Beach, and the work is remote, so your site can be hosted anywhere.
Sources, read Oct 22, 2026 4 links

Start with one check.

$395 for one site, done within 2 business days once we have access.

Ask for the check