Site Protect Pricing Explained: Cost, ROI, and Tradeoffs for Agencies Managing Client Sites
If you’re managing 50 to 500 WordPress client sites, Site Protect pricing is probably something you’ve glanced at and thought: “€2 per site. That adds up quickly.”
But whether it’s worth it depends less on the price tag and more on what happens when a vulnerability hits your portfolio before a patch is available. Let’s work through the math in this article.
How much does Site Protect cost per site?
Site Protect costs €2 per site per month as an add-on to WP Umbrella’s premium plan. If you’re a user of WP Umbrella, you already get uptime and performance monitoring, automated plugin/theme/core updates, backup and restoration management, activity log, client maintenance reports, robust security hardening, and real-time alerts on Slack, email, or both.
When you enable the Site Protect add-on, you add virtual patching on top of that existing infrastructure. This means you’re building on an already stable system, not bolting on a single security feature to an incomplete setup. The monitoring, updates, and backups are already happening. Site Protect is the hardening layer that fills the gap during patch windows.
Learn more about Site Protect.
What does Site Protect include?
Site Protect prevents exploits at the PHP level. At the heart of it is virtual patching. Here’s how it works:
When a plugin vulnerability is disclosed, before a patch is available or your client approves the update, Site Protect applies a rule that blocks the exploit at runtime. The vulnerable code still exists in your site’s files, but the attack never lands because Site Protect intercepts it at the PHP level.
The rules that block these exploits come directly from Patchstack’s threat database, a continuously updated feed maintained by their research team and ethical hackers who track WordPress vulnerabilities in real-time. You’re not relying on a static list.
For example, a SQL injection vulnerability might require a parameter called user_id to be exploited. Virtual patching doesn’t fix the vulnerable code. Instead, it watches for requests that attempt to use that parameter in ways that match known exploit patterns, and blocks them before WordPress even fully loads.
Since most attacks happen in the window between when a vulnerability is publicly disclosed and when patches are deployed, Site Protect ensures your site remains safe. Coordinating 200 updates simultaneously across 200 client sites isn’t realistic. Virtual patching closes that window without requiring you to update everything at once.
Beyond virtual patching, Site Protect includes a set of hardening rules that address common WordPress attack vectors:
- Disable Theme and File Editors
- Hide WordPress Version Information
- Disable User Enumeration
- Restrict XML-RPC Access
- Add Security Headers
- Block Sensitive Files
- Disable Directory Listing
- Block Proxy Comment Spam
Learn: what is virtual patching in WordPress?
Is Site Protect worth it for agencies managing multiple sites?
When Site Protect pricing is worth it
Site Protect is built for one job: blocking known vulnerabilities before they can be exploited. It does that well. It’s lightweight, impactful, and requires no configuration or maintenance.
What it doesn’t do: it’s not a malware scanner. If a site is already compromised, you’ll need dedicated forensics tools for post-incident analysis. Site Protect won’t clean up after an attack or restore your site if an exploit somehow gets through.
And Site Protect is not a replacement for updates. It buys you time to update safely, but updates are still necessary. The goal is to reduce the urgency and panic around patch deployment, not eliminate the need for patches entirely. For deploying those updates at scale, WP Umbrella’s built-in update management is already the solution you need.
If you are one of the following, we strongly recommend you turn on Site Protect:
- Agencies delaying updates. If your workflow includes testing periods, client approval windows, or resource constraints that prevent updates from going live immediately, Site Protect is essential. The vulnerability window is where most attacks happen. Site Protect bridges that gap.
- Agencies managing WooCommerce stores. E-commerce sites are higher-value targets. A compromised store can lose customer payment data, suffer chargebacks, and face legal liability. For WooCommerce agencies, €2 per site is a cost-effective insurance.
- Agencies handling high-value clients. Larger clients expect infrastructure-level security, not just reactive scanning. Site Protect demonstrates that your security posture is built on prevention, not detection.
- Agencies scaling beyond 100 sites. Once you’re managing enough sites that a single vulnerability event could affect multiple clients simultaneously, the operational burden of coordinating emergency patches becomes significant. Virtual patching reduces that pressure.
When Site Protect might not be necessary
Even though we recommend enabling Site Protect for all your sites, there might be a few scenarios where it might not be feasible, including:
- Single-site owners or small teams. If you’re managing your own site or a handful of projects, and you’re updating regularly, Site Protect is a lower priority than it is for agencies.
- Hobby projects with minimal traffic. A low-traffic site with no client expectations around security doesn’t justify the cost in the same way.
What is the ROI of Site Protect for WordPress agencies?
Even a minor incident absorbs several hours of senior developer time. You’re investigating what happened, pulling backups, coordinating with the client, and then deploying fixes. That labor alone often exceeds the cost of months of Site Protect across your entire portfolio.
According to IBM, the global average cost of a data breach reached $4.44 million in 2025. For an agency, the cost per incident is obviously lower, but it’s not negligible. Add in client communication, potential data recovery, and the reputational hit of a security incident, and you’re looking at at least five figures, even for a “small” breach.
Site Protect might cost hundreds per month if you have a large client portfolio. But one incident costs thousands, minimum. The math isn’t subtle.
Site Protect pricing: final answer
For agencies operating at scale, enabling Site Protect across the entire portfolio removes one variable from an already complex system. At €2 per site, the decision is less about price and more about operational consistency. You’re not buying a feature. You’re buying stability during the hours before patches land and updates deploy.
FAQs about Site Protect
Around 100 sites, most agencies start feeling the update-coordination strain. Past 250 or 300, it becomes operational overhead. Above that, it’s infrastructure.
For smaller portfolios, say 50 to 100 sites, Site Protect makes sense if you’re delaying updates for testing, client approval, or resource reasons. If you’re pushing patches within 48 hours of release, it can be optional.
For mid-scale operations (100–300 sites), it’s strongly recommended. €200–600 per month buys operational stability and removes one source of firefighting.
And at 300+ sites, Site Protect stops being a feature and becomes a necessity. A single unpatched vulnerability affecting dozens of clients simultaneously is a scenario that justifies the cost without question.
Virtual patching doesn’t prevent all security issues; that’s not realistic. But it eliminates one specific, high-impact risk: exploitation of known vulnerabilities during the patch window. For an agency managing sites at scale, the benefit is straightforward.
You’re not woken up at 2 AM because a critical vulnerability was exploited across three client sites while you slept. Your team spends less time managing incident response and more time on planned work and client relationships. Fewer incidents are usually worth more than the monthly line item.