Every plan includes the same careful maintenance: monthly updates, prompt security patches, backups and monitoring. What changes is how much developer attention your site gets each month. Pick the amount that fits today. It can change whenever your needs do.
Same maintenance baseline on every plan. The tiers are about attention: a monthly block of discretionary developer hours, and how proactively we use it. Packages are the easy way to start; most clients end up somewhere custom.
$500per month
The maintenance baseline, plus a little room for edits and fixes.
Maintenance+2 hrsof developer time a month
$1,000per month
For an active marketing site. We keep an eye on it and flag what we see.
Maintenance+5 hrsof developer time a month
$1,500per month
When the site is a revenue channel. We fix what we see without waiting to be asked.
Maintenance+10 hrsof developer time a month
Let’s talkpriced to fit
Honestly, where most clients end up. Tuned to your needs: smaller than Essential, bigger than Premium, or a different shape entirely.
Maintenance+as manyhours as you need each month
All prices are per month. Hours are a monthly budget we manage for you: small requests just get done, and we only stop to talk when something is clearly bigger than the month. Hosting and paid plugin licenses are billed at cost. If onboarding turns up a larger cleanup, we quote it as a fixed project before any work starts.
The baseline is identical on every plan. Below it, the rows that actually differ: hours, proactivity, response time and reporting.
Swipe sideways to see every plan.
| Feature | Essential$500 | Standard$1,000 | Premium$1,500 | CustomLet’s talk |
|---|---|---|---|---|
| Included in every plan | ||||
| WordPress core, theme and plugin updates, monthly, tested on staging first | Included | Included | Included | Included |
| Security patches applied within a business day or two of release | Included | Included | Included | Included |
| Abandoned-plugin check: plugins that stopped shipping updates get flagged and replaced | Included | Included | Included | Included |
| PHP and hosting-stack upgrades | Included | Included | Included | Included |
| Daily backups through your host, confirmed at onboarding | Included | Included | Included | Included |
| Uptime monitoring with alerts | Included | Included | Included | Included |
| Malware scanning and login hardening | Included | Included | Included | Included |
| Access recovery and baseline audit at onboarding | Included | Included | Included | Included |
| Developer attention | ||||
| Discretionary developer hours each month | 2 | 5 | 10 | Sized to fit |
| Typically used for | Content edits, fixes, questions | Small features, design tweaks, cleanup | Landing pages, campaigns, integrations | Whatever the site needs |
| How proactive we are | You ask, we do | We flag what we see | We fix what we see | Agreed up front |
| Small requests | Just done, no quotes | Just done, no quotes | Just done, no quotes | Just done, no quotes |
| Performance score monitoring | Not included | Included | Included | As agreed |
| Plugin audit and cleanup | Not included | Flagged | Done from your hours | Done from your hours |
| Accessibility and SEO hygiene check | Not included | Quarterly | Monthly | As agreed |
| Additional hours | $175 / hr | $160 / hr | $150 / hr | Agreed rate |
| Support | ||||
| Hack and malware recovery | Quoted if needed | Included | Included | Included |
| Response time | 2 business days | Next business day | Same business day | Agreed up front |
| Channels | Email and phone | Email, phone and Slack | Your tools | |
| Emergency line | Not included | Not included | Included | As agreed |
| Dedicated lead developer | Not included | Included | Included | Included |
| Reporting and strategy | ||||
| Activity report | Quarterly | Monthly | Monthly | Monthly |
| Roadmap call | Not included | Quarterly | Monthly | As agreed |
Think of it as how much attention you want the site to get. Essential keeps it maintained and gives you a couple of hours when you need something. Standard adds a developer who watches the site and flags what should happen next. Premium is the same person fixing it before you notice.
To be honest, most clients don’t stay in a box. They start on a package, ramp up for a redesign or a campaign, ramp down when things are quiet, and end up on a plan shaped around them. The packages are the simplest way to get started and build the relationship. The plan can change whenever your needs do.
A brochure or informational site that needs to stay maintained, with a couple of hours a month for edits and fixes when you ask.
An active marketing site: regular content, campaigns, forms that have to work, and a developer who keeps an eye on performance and tells you what needs doing.
The site is a revenue channel. Proactive polish, performance and SEO work, same-business-day answers, and a shared Slack channel.
Where most clients land. A quiet site that only needs the maintenance baseline, a WooCommerce, LMS or membership system, a portfolio of sites, a Rails, Node or PHP app, or simply a plan that ramps up and down with you. We shape it around what you actually need.
Anyone can click Update. What you get with DD9 is everything around that click: a person who tests it first, understands the whole system, and has kept sites like yours out of trouble for fifteen years.
Updates are tested on staging and checked by a person before they go live: key pages, forms, checkout, the things that quietly break. We don’t click Update All and hope.
A plugin whose author walked away never asks for an update, so it looks fine forever, right up to the day a critical vulnerability lands. We have inherited sites from other shops that ran that way for years. We check what has gone stale, not just what is pending, and replace it before it matters.
We build and take over complex WordPress, Rails and Node systems, and the developer maintaining your site is the kind who builds them. When something misbehaves we read the code, we don’t swap plugins until the symptom goes away.
No site under our active maintenance has been compromised in fifteen years. Not luck: current software, hardened logins, monitoring, and someone actually watching.
The same three plans apply to Rails, Node, PHP and static sites. Updates become dependency and framework upgrades; backups, monitoring, support and developer hours work exactly the same way.
DD9 has been working with WordPress since 2008 and building Ruby on Rails applications since 2011. Taking over a site someone else built is most of what we do.
The things people ask before they pick a plan.
No. Plans are month to month. The first month is billed when you sign up, and you can cancel or change plans with 30 days’ notice. Most clients change plans at some point, up for a campaign, down for a quiet stretch. That’s expected, not a renegotiation.
Anything beyond the baseline maintenance: content changes, bug fixes, small features, design tweaks, landing pages, integrations, performance polish, and consulting on what to do next. It’s a monthly budget of attention; you direct it, and on the higher tiers we also spend it proactively.
Because the site doesn’t need it. Monthly updates with security patches applied within a business day or two is the right cadence for nearly every WordPress site; more churn adds risk, not safety. The higher tiers buy attention: more developer hours, and a developer who looks for problems instead of waiting to hear about them.
Most of the time, an update really is as simple as hitting the button. The difference is what happens around it. When DD9 runs updates, they go onto a local and a staging copy of the site first. We QA them there, deploy precisely the same updates we just tested, then QA again on the live site.
You can probably hit the buttons yourself for a while without anyone watching. Eventually one of them brings the site down, or worse, quietly breaks something critical: a form that stops sending, a checkout that stops charging, and nobody notices for weeks. And the update screen only tells you about plugins that still ship updates. The abandoned ones look fine right up until a vulnerability lands.
So the secret is: you can do it yourself for a while, and you will very likely get into trouble at some point. The plans exist so that point never comes.
No. That’s the point of a monthly budget. Send the request, we do it, and the monthly report shows where the hours went. We only stop to talk when something is clearly bigger than the month, and then you get a straight answer: add hours, quote it as a project, or move up a tier.
On Standard and above, recovery is included for any site that has been in our maintenance routine. We take it seriously and we take it personally. In fifteen years no site under our active maintenance has been compromised, which is the real reason the baseline looks the way it does: current software, hardened logins, monitoring, and someone actually watching.
We tell you before starting. You can add hours at your plan’s rate, have us quote it as a small fixed-price project, or move up a tier if it keeps happening.
No. We work with WP Engine, Kinsta, SiteGround, Pantheon, AWS and most others. If hosting is part of the problem we’ll say so, and we can manage a move.
Yes. Access and account recovery is part of onboarding on every plan, including registrars, DNS, hosting and WordPress admin.
Yes, on a Custom plan. Those systems have more moving parts than a marketing site, so we scope the plan around them rather than squeezing them into a flat tier.
DD9’s own developers in Boulder, Colorado. The same team that builds our client sites handles maintenance, so there is no hand-off to a separate support tier.
Yes. Maintenance clients get priority scheduling on larger projects, and the audit from onboarding usually tells us exactly where a redesign would pay off.
Pick a plan above or just tell us about your site. We confirm the fit, send a one-page agreement, and start onboarding within a week.
Pick a plan above or just tell us about your site. We confirm the fit, send a one-page agreement, and start onboarding within a week.
© 2026 DD9™.
