Is your server working for someone else?
Attackers break into unpatched servers within hours of a flaw going public, then quietly use them to mine cryptocurrency or send spam. Our automated system knows exactly what software runs on each of your servers, checks it against every new vulnerability the day it is published, applies the fixes and watches around the clock. A person reviews and approves every change.
Fully automated, human-approved · Ubuntu and Debian · WordPress, PHP, Node.js, Python, Docker · Cancel any month
ALERT CPU 96% for 18 min (normal: 7%) evidence process .ld-linux.so xmrig miner, renamed folder plugins/site-cache-helper not a real WordPress plugin network mining pool on port 443 disguised as web traffic cron */2 * * * * .run.sh added by the web server user inventory WordPress 6.9.1 fix in 6.9.9 verdict cryptominer installed through a WordPress backdoor proposed 1 block traffic to the pool 2 stop miner, remove cron entry 3 remove fake plugin and backdoors 4 reset admin logins, update WordPress status waiting for engineer approval
Illustrative example of an automated investigation report
Attackers don't wait for your next update.
Nobody picks your server by hand. Programs scan the whole Internet for every newly published flaw and arrive within hours. Someone checking for updates once a week cannot keep up. An automated system can.
Sources: Patchstack, State of WordPress Security in 2026; VulnCheck, State of Exploitation 2026.
Runs automatically, 24/7
- Software inventory of every server, refreshed every few hours
- Matching against every new vulnerability, the day it is published
- Security updates, with a snapshot first and automatic rollback
- Temporary protection when a flaw has no fix yet
- Monitoring of resources, files, users and network traffic
- AI investigation of every anomaly, with a written report
Done by a person
- Approves every change to your server
- Plans major upgrades with you, never automatically
- Answers your questions and explains what happened
Know what runs. Hear about every flaw. Patch. Watch.
Four steps that run on their own, on every server, every day. Each one closes a gap that manual maintenance leaves open: fixes are applied as soon as they exist, and flaws without a fix are contained until there is one.
Exact inventory
A lightweight agent records what runs on each server: system packages, PHP, Node.js and Python versions, WordPress core, plugins and themes, containers, open ports, users, SSH keys and scheduled tasks. Refreshed every few hours.
Vulnerability matching
Every new vulnerability and end-of-support date is checked against that inventory the day it is published, using distribution security trackers, OSV, WordPress vulnerability feeds and the U.S. government's list of flaws known to be under active attack.
Safe patching
Urgent fixes go in within hours, the rest in your maintenance window. We snapshot first and check your sites afterwards; if a site stops responding, the update is rolled back automatically. No fix yet? We disable the vulnerable plugin or block the attacked path until there is one.
Watch & investigate
We monitor resources, network, logins and file changes against each server's normal behaviour. When something is off, an AI investigator gathers the evidence within minutes and an engineer reviews it before anything is changed.
Every signal a hijacked server gives off.
A cryptominer can hide its CPU use. It cannot hide everything at once: a new process, a new outbound connection, a new file in your website and a new scheduled task all show up somewhere.
An AI investigator that can look, not touch.
AI makes us fast: it reads logs, correlates signals and writes a clear report in minutes, at any hour. But logs on a compromised server are written partly by the attacker, so we never let an AI act on them unsupervised.
- Read-only investigationThe AI collects evidence with read-only commands. Fixes come from a fixed list of approved actions, and anything that changes your server needs an engineer's approval.
- No new doors into your serverOur agent connects out to us. We do not ask you to open ports or share a root password.
- Each customer isolatedEvery investigation runs with access to one customer only, so a problem on one server can never reach another.
- Everything recordedEvery command and every change is logged and included in your monthly report.
- Your data stays yoursYour logs and files are never used to train AI models.
Per server. No contracts.
Start with a one-time check to see where you stand, or go straight to continuous, automated protection. Volume pricing for agencies and hosting resellers.
Health Check
A one-time look at one server: is it already compromised, and what is exposed?
$290 one time
- Full software inventory
- Vulnerability and end-of-support report
- Compromise check: miners, backdoors, rogue users, keys and tasks
- Exposure scan from the Internet
- Plain-language report with a fix list
Watch
Automated inventory, vulnerability matching, patching and monitoring.
$49 per server / month
- Everything in Health Check, kept up to date
- Same-day alerts for vulnerabilities in your software
- Security updates applied with automatic rollback
- 24/7 monitoring of resources, files, users and network
- AI investigation of every anomaly, reviewed by an engineer
- Monthly report
Managed
We run the server for you, including the upgrades nobody wants to do.
$149 per server / month
- Everything in Watch
- Major upgrades: operating system, PHP, databases
- Daily off-site backups, restore tested monthly
- Hardening: firewall, SSH, web server, WordPress
- Incident clean-up included (up to 4 hours a month)
- Response within 4 business hours
Prices in US dollars, taxes not included. Secure card payment by Stripe. Cancel any month.
Before you ask.
What do you need from me to start?
For the Health Check, temporary access to the server (an SSH key we give you, removed afterwards). For Watch and Managed, you install our agent with one command; it connects out to us, so you do not need to open any port.
How much of it is automated?
Everything that has to happen fast or often: inventory, vulnerability matching, security updates with rollback, monitoring and the first investigation of every anomaly. What stays with a person is approving changes to your server, planning big upgrades and talking to you.
Will automatic updates break my website?
Security updates rarely change behaviour, but we plan for the day one does. We snapshot before updating, check your sites afterwards, and roll back automatically if they stop responding. Big upgrades, such as a new PHP version, are never automatic: we test them first and agree a date with you.
Is an AI really looking at my server?
Yes, as an investigator. It reads metrics, logs and process lists with read-only commands and writes up what it finds. It cannot change anything by itself: fixes come from a list of approved actions, and an engineer approves them.
Which systems do you support?
Ubuntu and Debian servers at any provider (Hetzner, OVH, DigitalOcean, AWS, Contabo and others) running WordPress, PHP, Node.js, Python or Docker. Other Linux distributions on request.
My operating system or PHP version is old. Can you still help?
Yes. We will tell you exactly what is out of support and what it exposes you to, protect it as far as possible in the meantime, and plan the upgrade with you. On the Managed plan the upgrade is included.
Can I cancel?
Any month, from the payment portal or by email. We remove our agent and send you your full inventory and history.
Get a free exposure check.
Tell us the domain of one of your websites. We will check, from outside and without touching your server, which software versions and services it exposes to the Internet, and send you the result.