What’s included
“Managed” is a word that gets used loosely.
Plenty of hosts describe themselves as managed and mean they’ll reboot the server if it falls over. Here is the specific list of what we do to your website — and, if you take them, your mailboxes — and how often, so you can hold the word to something.
Traffic filtering
Every site sits behind Cloudflare. Bad traffic — login brute-forcing, scraper bots, volumetric junk — is turned away before it reaches the server, which is why it doesn’t show up as a slow site. It also serves your images and stylesheets from a network with a UK presence, and that alone is most of the speed difference.
Server-side scanning
Imunify runs on the server itself, scanning files for malware signatures and known attack patterns. Server-level scanning catches things a WordPress plugin can’t, because a plugin only runs when WordPress does. If something is found, we deal with it and tell you what it was.
Backups
Files and database, taken daily and stored away from the server. That last part matters: a backup sitting on the same machine as the site is not a backup, it’s a copy. Restores are included — we don’t charge you to put your own site back.
Managed updates
WordPress core, plugins and themes, applied by us. The failure mode we’re preventing is the common one: auto-updates left switched on, a plugin update quietly breaks the booking form on a Saturday, and nobody notices until Tuesday. We apply, check the site afterwards, and roll back from that morning’s backup if an update misbehaves.
Broken link checking
Practice sites accumulate dead links faster than most: referral forms move, insurers reorganise their sites, consultants leave. We flag them so they get fixed before a patient hits one.
A report you can actually read
One page. What was updated, what was backed up, what was blocked. If you connect your Google account we’ll add a short section on how the site is doing in search. It exists so you can see the work happening rather than take our word for it — and so a practice manager has something to put in front of a partner who asks what the £400 buys.
Vulnerability patching
When a vulnerability is disclosed in a popular plugin, there’s a window — sometimes days, sometimes longer — between the disclosure and the developer shipping a fix. Attackers work that window aggressively. Patchstack can be added to your site to shield the known vulnerability during it. Worth it if you’re running booking, forms or membership plugins.
Microsoft 365, run properly
Business Premium with backup, filtering and managed signatures, at £320 per mailbox a year. Joiners set up, leavers removed and their mailbox dealt with, multi-factor authentication actually enforced. Your mailbox holds more patient data than your website does — this is what looking after it involves.
Out-of-hours cover
Standard support runs 9:00 to 17:30, Monday to Friday. If your site takes bookings overnight or at weekends, round-the-clock cover is available as a paid add-on. We’d rather price it honestly than imply the standard plan covers 3am.
Who does the work
ClinicPress is run by BLS Computer Solutions, an IT company that has looked after charity and care sector organisations for years. The people applying your updates are the same small team you’ll speak to on the phone. There is no tier one, no ticket queue in another timezone, and nobody reading from a script.
That’s a genuine limit as much as a selling point: we’re small, we answer during working hours, and if you need a 24/7 NOC watching a hospital group’s estate we’re the wrong choice. For a practice with one site and no in-house IT, it’s usually the right shape.
Where the sites live
UK servers, with Cloudflare in front. Your site’s data stays in the UK, which is the answer to the question that comes up in every procurement form and most DSPT returns.
What we don’t put on the server
Email. Not because we don’t do it — we do — but because a shared web server is the wrong place for patient correspondence. No meaningful backup, no real protection against phishing, and mail that increasingly gets rejected by other providers. Practice mailboxes belong in Microsoft 365, where they can be backed up, protected and administered when someone leaves. Moving them off the web server is the single most common thing we ask incoming practices to do, and we do it for you.
See what your site is running now
Send the domain over. We’ll tell you what’s out of date, where the backups are, whether anything’s already been touched — and where your email is currently hosted and whether it’s protected against spoofing.