Rizen care plans

What we do to your website every month, and what happens when an update breaks it.

Most update policies are written so that nothing in them can ever be held against the agency. This one names dates, hours and a list of what gets tested, because a promise you cannot check is not a promise.

Tell us what you need

1What it covers

Every site on a Rizen care plan. Nothing else.

If you pay us monthly, this is what you are paying for, written down. If you do not, we are not updating your site and you should not assume anyone is.

Three quarters of WordPress sites that get broken into were running software with a patch already available. The patch existed. Nobody applied it. That is the entire problem this policy is built to solve.

Care covers WordPress core, your plugins, your theme, and the hosting they sit on. It does not cover building new things. If you ask for a new page, a new feature or a redesign, that is quoted separately and it is quoted before the work starts.

2The schedule

When we update, and how fast.

Most agencies will not tell you this, usually because there is no schedule. Here is ours.

Security releases: within 72 hours. When a plugin or core release fixes a disclosed vulnerability, it goes on within three days of publication. If the vulnerability is being actively exploited in the wild, it goes on the same day, straight to production, and we test after rather than before. A site that is being attacked right now is worth more than a tidy process.
Everything else: once a month. One batch, in the first full week of the month. Bundling routine updates means one staging cycle and one test pass instead of eleven, which is how a small practice keeps this affordable rather than pretending each plugin gets its own release day.
WordPress major versions: held fourteen days. Major releases break things, and the plugins you depend on need time to catch up. Point releases and security releases are not held.
Abandoned plugins: flagged, then replaced. If a plugin has had no update in twelve months or gets pulled from the directory, we tell you, and we plan a replacement. We do not quietly leave it running.

3How it works

What actually happens on update day.

Six steps, every time, whether it is one plugin or fifteen.

Restore point

A fresh backup before anything is touched, and we confirm it completed rather than assuming it did. An unverified backup is not a backup.

Staging

Your live site is cloned to a private copy. Every update happens there first, with the one exception noted above for vulnerabilities under active attack.

Read the changelog

We read what changed before installing it. Anything marked as a breaking change or a database migration gets flagged and handled on its own rather than in the batch.

Apply

Core, then theme, then plugins, one at a time so that if something breaks we know exactly what broke it. Caches cleared after.

Test

The specific list for your site, below. Not a glance at the homepage.

Deploy and watch

Pushed to live, caches cleared again, and we check it once more the next morning.

4Testing

What we check, named in advance.

"We test critical functionality" means nothing. So here is the actual list, and we write yours into your plan when we set it up.

Every form on the site submits, and the email arrives somewhere a person reads. This is the one that silently fails most often.
Any payment, booking or giving flow completes a real transaction end to end.
The homepage and one page of every template, on a phone as well as a desktop.
Whatever is specific to you. A sermon archive. A class registration. A quote request. We list yours by name.
Load time compared against the reading before the update, so a slow regression gets caught rather than accumulating.

5When it goes wrong

Something will break eventually. Here is what we owe you.

Not if. Eventually. An agency that tells you their updates never break anything is telling you they do not update.

If we find it, we roll it back the same day and tell you it happened, including when you would not have noticed.
If you find it, tell us and you get a reply the same day on a weekday, and within twenty four hours on a weekend. You are emailing a person, not a ticket queue.
Rolling back comes first, diagnosing comes second. Your site goes back to working, then we work out why in staging on our own time.
You get a monthly email listing what was updated, what was held back and why, and anything we think you should know about. One message a month, not silence.

6Your side

Four things we need from you.

Short list, and every item on it is something we genuinely cannot do without you.

Keep premium licenses paid. A lapsed license stops delivering security updates while the plugin carries on looking fine. If one lapses we will tell you, but we cannot renew it for you.
Tell us before you install a plugin. Not to gatekeep. Because we test what we know about, and a plugin we have never seen is a plugin nobody tested.
One named person who can answer a question. Somebody who can say yes or no when we ask whether a feature is still in use. Volunteer committees change; the contact should not go missing.
Let us host it, or accept the limits. On our hosting we have staging and one click restore points. Somewhere else we may have neither, and this policy is only as good as the tools the host gives us.

7Not covered

What this does not include.

Stated plainly so nobody discovers it during an emergency.

Sites without an active care plan. We are not watching them and nobody else is either.
Custom code somebody else wrote, until we have read it and agreed to take it on.
Recovery from a break in on a site that was not under care. We will quote that as rescue work, and we will take it on.
New pages, new features and redesigns. Care keeps what exists working. Building is quoted separately.
Content you or your volunteers change. Editing is yours, and it is meant to be.

8Questions

The things people actually ask.

Why not just turn on automatic updates and be done with it?

Because automatic updates apply the change and then nobody looks. The update is the easy part. Noticing that the donation form stopped sending email three weeks ago is the part that needs a person.

Our current site has not been updated in two years. Is that a problem?

Probably, and it is fixable. We audit what is running, work out what can be safely brought current and what needs replacing, and quote it as one piece of rescue work before we start. It is the single most common call we get.

What happens if a plugin we depend on gets abandoned?

We tell you as soon as we see it, keep it running while it is still safe to, and plan a replacement on a normal timeline rather than in a panic. Migrating off an abandoned plugin is quoted separately, because it is a rebuild of that feature rather than an update.

Can we cancel?

Any time, and you keep everything. The site, the domain, the hosting account, every login. There is no exit fee and nothing is held hostage. That is true of everything we do.

Do you update the site if we are not paying monthly?

No. It would not be fair to charge some clients for care and give it to others for free, and a policy that is applied sometimes is not a policy. If you are unsure whether you are covered, ask us and we will tell you straight away.

9Connect

Not sure whether your site is covered?

Ask. We will tell you what is running on your site, what is out of date, and what we would do about it, before you decide anything.

hello@getrizen.com (877) 412-1233

Book a call