From firefighting to thriving.

Most self-inflicted outages start here, and so does most of the exposure. In 2025 the WordPress ecosystem saw 11,334 new vulnerabilities, around nine in ten of them in plugins.

1. 1Firefighting

   Updates happen when something breaks or when the host forces them. Nobody knows which versions are running.

2. 2Reactive

   Someone clicks update in production every few months, then checks that the homepage still loads.

3. 3Managed

   A named person updates on a schedule, takes a backup first, and knows how to roll back.

4. 4Proactive

   Updates are applied to a copy of production first, with checks on the pages that earn money. Rollback is one step and has been rehearsed.

5. 5Thriving

   Updates ship through a pipeline with automated tests. Security patches reach production in hours, and time to patch is measured.

The gap that matters is not whether you patch but how fast. Public disclosure to mass exploitation now runs to a median of about five hours, and nearly half of vulnerabilities have no fix available the day they are published.

1. 1Firefighting

   You find out from a customer, a browser warning or a search engine.

2. 2Reactive

   A security plugin runs on default settings and emails an inbox nobody owns.

3. 3Managed

   Admin access uses unique passwords and a second factor, alerts have an owner, and someone reviews them weekly.

4. 4Proactive

   Least-privilege roles, two-factor everywhere, a vulnerability feed matched against the components you actually run, and a written response plan.

5. 5Thriving

   You hold an inventory of every component, alerts are tied to that inventory, and the response has a rehearsed decision-maker and a measured clock.

The difference between a scare and a loss is minutes, and minutes come from alerting on the thing customers do, not on whether a server answers.

1. 1Firefighting

   You learn the site is down from a colleague or a customer.

2. 2Reactive

   An uptime monitor emails someone. There is no agreed response time.

3. 3Managed

   Monitoring covers the site and its critical pages, alerts reach a named person, and escalation is documented.

4. 4Proactive

   Alerts cover business transactions (checkout, forms, logins) with an agreed response time and a runbook for common failures.

5. 5Thriving

   Incidents are caught before customers notice, and each one produces a blameless postmortem that changes something concrete.

Only around 45% of WordPress sites pass Core Web Vitals on mobile with real users, against 74% for Wix and 85% for Duda. The usual cause is accumulated weight nobody owns.

1. 1Firefighting

   The site is slow, people complain, and the answer is to install another caching plugin.

2. 2Reactive

   Someone runs a single-page score tool when they remember, usually on the homepage.

3. 3Managed

   Core Web Vitals are tracked from real users on the key templates, and regressions get an owner.

4. 4Proactive

   Each template has a performance budget enforced before launch, and work targets the slowest template rather than the best score.

5. 5Thriving

   Field data drives the roadmap, performance is a release gate, and the numbers are read next to conversion.

Almost every stalled website problem turns out to be an ownership problem wearing a technical costume.

1. 1Firefighting

   Nobody can say who owns the website. Decisions happen by whoever pushes hardest.

2. 2Reactive

   One person is the informal owner, everything routes through them, and nothing moves while they are away.

3. 3Managed

   Named owners for the site, the content and the platform, with a documented way to decide.

4. 4Proactive

   Responsibilities are mapped across marketing, IT and suppliers, changes and new plugins go through an approval step, and decisions are recorded.

5. 5Thriving

   Governance is light and real: short policies people follow, reviewed quarterly, with an obvious route to change them.

In one 2026 survey, 31% of marketing leaders named review and approval, not writing, as the biggest blocker to publishing.

1. 1Firefighting

   Edits go straight to production, made by whoever has the password.

2. 2Reactive

   A shared login, review over chat, and layouts that break when a non-technical editor touches them.

3. 3Managed

   Individual accounts with appropriate roles, a review step before publishing, and components editors cannot break.

4. 4Proactive

   A documented workflow with previews, scheduled publishing, defined roles and an agreed content model.

5. 5Thriving

   Publishing is fast because the constraints are good. The bottleneck is writing, not approval.

The question is not whether you trust your agency. It is whether your website would survive their absence.

1. 1Firefighting

   One freelancer or agency holds the keys. If they vanish, so does the site.

2. 2Reactive

   You have access in theory, but nobody has tested it, and the documentation lives in someone's head.

3. 3Managed

   You own every account: domain, DNS, hosting, repository, licences. Access is documented and has been verified.

4. 4Proactive

   Contracts define response times and deliverables, a handover pack is kept current, and switching providers is a project rather than a crisis.

5. 5Thriving

   Suppliers are interchangeable by design. You could move to another provider in weeks without losing anything.

95.9% of top-million home pages have detectable accessibility failures, and shopping pages average 71 errors each. Enforcement has started: in June 2026 a French court gave a major retailer six months to fix its store despite already meeting most criteria.

1. 1Firefighting

   Accessibility and privacy come up only when somebody complains or a lawyer writes.

2. 2Reactive

   An overlay widget or a cookie banner was installed to make the question go away.

3. 3Managed

   An audit has been run against WCAG, the critical failures are fixed, and the privacy notices match what the site actually does.

4. 4Proactive

   Accessibility is part of design and build, checked automatically in the pipeline and by hand on the key journeys, with obligations mapped.

5. 5Thriving

   Accessibility is a design constraint rather than a remediation project, and the evidence is kept current.

Checkout rarely fails loudly. It fails quietly, after an update, and the first signal is an order count that looks a little low.

1. 1Firefighting

   You find out checkout is broken when orders stop arriving.

2. 2Reactive

   Someone places a test order now and then. Stock and the back office are reconciled by hand.

3. 3Managed

   Automated checks confirm checkout works, payment and tax settings are reviewed, and failed orders have a process.

4. 4Proactive

   The whole order path is monitored end to end, integrations retry and alert, and peak season is load-tested beforehand.

5. 5Thriving

   Store operations are instrumented: conversion by step, failure rate by payment method, and the drop-offs get fixed.