# OFFERS · JKCA security subscriptions (patch and harden)

Drafted Thu Oct 22, 2026, ~3:00 PM PT. Hand-off only. Nothing is built, priced, posted, emailed or set up in Stripe.
Every `DECISION` block is json's call. Nothing marked `DECISION` or `PROPOSED` ships until json fills it and Critic signs off.

Facts used here are listed in the `README.md` fact sheet with sources. Rules: no guarantees, no invented stats, no urgency, no deal copy.

---

## 0. How this fits with CARE (read first)

JKCA already sells **CARE** (care.jkca.studio, listed at `jkca.studio/services/care-plans/`): Hosted $69, Cared For $129, Growth $299, plus Store Lite $149, Store $299, Store Plus $499, Store Scale $999, a $995 move, $225/hour for extra work, 30 days notice, annual = 11 months (Store Plus 12). Source: `care-stripe-audit-2026-10-20.md` and the saved care-plans page in `audit/`.

CARE's site plans say "No login page and no database to break into". CARE-hosted sites are static and don't run PHP, so php2shell doesn't reach them.

So the security subscriptions are **not a second CARE**. They are for sites that **stay on WordPress or PHP**: on the client's own host, a managed WordPress host, or a VPS. The split:

| Site situation | Offer |
|---|---|
| Already on CARE Hosted / Cared For / Growth (static, JKCA-hosted) | Nothing new to buy. Crew confirms per site that no PHP is serving it, then sends template 1 in `EMAIL-TEMPLATES.md`. |
| CARE Store on WooCommerce (PHP) | **DECISION D7**: is PHP/plugin patching already part of the Store plan, or is it a Patch/Harden add-on? |
| WordPress/PHP site JKCA built or touches but doesn't host | Emergency patch check, then Watch, Patch or Harden. |
| Outside small business with a WordPress/PHP site | Free site check, then the same path. |
| Owner who would rather stop running WordPress | Point to CARE and the $995 move (existing `/services/wordpress-migration/`). No new offer needed. |

Same house conventions as CARE so they read as one menu: per site, month to month, 30 days notice to stop, extra work at an hourly rate quoted before it starts {DECISION D12; CARE's is $225}, one list, no rollover.

---

## 1. Emergency patch check (one-time entry offer)

**Who it's for:** any WordPress or PHP site owner who wants to know their PHP is patched for php2shell (CVE-2026-109618, CVE-2026-109619) and wants it done and confirmed once. Also the first step before any subscription.

**Page label:** the crew may show it as "One-time patch check" if Critic finds "Emergency" too loud. Stripe product name stays the same either way.

**Included**
1. Read-only outside check (`INTAKE.md` script): PHP header, TLS, WordPress version exposure, security headers, Cloudflare in front or not.
2. Inside check with the access the client gives: PHP version from a live web request (WordPress Site Health or a temporary phpinfo page we remove after), PHP handler (mod_php, php-fpm, LiteSpeed), WordPress core, plugins and theme pending updates.
3. Patch PHP to a fixed release (8.5.12, 8.4.27, 8.3.36, 8.2.35 or later), **or** on 8.1, 8.0 or 7.4 confirm the official minimal patch build is installed: the version number doesn't change, so we check the package build date is Oct 21, 2026 or later (Plesk, CloudLinux alt-php, cPanel EA4, sury and Remi show it in their changelogs).
4. Restart PHP (php-fpm, Apache, LiteSpeed lsphp) and confirm from a live request, not the CLI.
5. One indicator sweep where we have log or shell access: user agent `php2shell-scan/109618` (or any UA containing `php2shell`) in access logs; multipart POSTs carrying `PHP_SESSION_UPLOAD_PROGRESS`; bursts of "Allowed memory size exhausted" in PHP error logs since Oct 17; PHP or the web server user starting `wget`, `curl` or a shell; a file at `/tmp/nfs`; new or changed `.php` files in `wp-content/uploads`, `mu-plugins` or the web root; unknown admin users; unexpected cron entries.
6. Short written note: what we found, what we changed, what we couldn't see.

**Not included:** cleanup if we find real signs of compromise (we stop, explain, quote first), PHP major upgrades that need plugin or theme fixes (quoted, see the php2shell page tier 4), secret rotation (offered as a line item), hosting changes.

**Host-controlled PHP:** we verify what we can from outside and inside WordPress, send the host the written question from `INTAKE.md` §3, and report the host's answer verbatim. We don't claim a site is patched until the host confirms it in writing or we confirm it from a live request.

**Relationship to the php2shell page tiers:** this is the general-purpose name for that page's "Patch, verify and check for trouble" tier. Recommend one Stripe product for both (see `STRIPE-PLAN.md`) so reporting stays clean.

> **DECISION D1: Emergency patch check price (per site, one-time)**
> - **A. $149.** Same as the php2shell pack's earlier "Patch and verify" placeholder. Easiest yes; tight if the indicator sweep takes longer than an hour.
> - **B. $249.** About one hour at CARE's $225 rate plus the write-up (see D12). Fits the scope above.
> - **C. $395.** Matches the php2shell pack's "check for trouble" placeholder. Leaves room for slow hosts and messy access.
> - Reference: php2shellcheck.com sells a $49 written patch plan where the owner does the work (https://php2shellcheck.com). Sucuri's one-site security platform is $229 to $549 per year and includes malware cleanups (https://sucuri.net/website-security-platform/signup/). Neither is hands-on patching by a local studio.
> - Also decide: does the fee credit toward the first month of a subscription? (Say it in the quote, not on the page, so it doesn't read as deal copy.)

> **DECISION D2: Emergency patch check turnaround**
> - **A. "Done within 2 business days of getting access."** Promise starts at access, not at payment.
> - **B. "Scheduled within 3 business days; we tell you the slot when you book."** Safer while JKCA's ~50 own sites come first.
> - **C. No public promise; the slot is in the written quote.** Safest; weakest on the page.
> - Reasoning: hosts' answers can take days and JKCA patches its own fleet first. Whatever is picked, the clock should start when working access arrives.
> - Also decide: when a new monthly client gets the first report. Options: within 30 days of access; at the end of the first full calendar month; or no stated time (page just says "monthly"). The page currently states no time.

---

## 2. Monthly tiers

All three: per site, month to month, 30 days notice to stop, monthly plain-English report, uptime and TLS monitoring, alerts to json's crew (not auto-emails to the client) so a person reads before the client hears anything.

### Tier 1: Watch

**Who it's for:** owners whose host or in-house person does the updates, who want an outside eye and a plain monthly report. Also sites where the host owns PHP and won't give us access.

**Included**
- **Patching:** none by us. Weekly we check and report: PHP version and build (from WordPress Site Health or the host), WordPress core, plugin and theme updates waiting, plugins with a public security notice.
- **Uptime + log watch:** uptime check every {interval, DECISION D6} with an alert to us; TLS expiry; blocklist check. Log watch only if the host gives read access: weekly search of access and error logs for the indicators in §1.5.
- **Backups and restore tests:** we confirm a backup exists and is recent (the client's or the host's). No restore test.
- **WAF / Cloudflare:** we report whether Cloudflare or another edge firewall is in front, and recommend settings. No changes.
- **Monthly report:** one page, plain English: what we checked, what's waiting, what we asked the host, what we couldn't see.
- **Incident hours:** none included. If something looks wrong we tell you {how soon, DECISION D5} and quote any work at {hourly rate, DECISION D12} first.

**Not included:** applying any update, changing server or DNS settings, cleanup, restore tests, secret rotation.

### Tier 2: Patch

**Who it's for:** small-business WordPress sites that want someone to keep PHP, WordPress and plugins current and check that it worked.

**Included (everything in Watch, plus)**
- **Patching cadence:**
  - WordPress core minor/security releases, plugins and theme: applied **weekly**, after a fresh backup, with a quick check of the home page, a form and checkout if there is one.
  - Plugins with a published security fix: applied in the **next working session** {window, DECISION D4}.
  - PHP security releases: applied by us if we have server access, then PHP restarted and confirmed from a live request. On 8.1, 8.0 or 7.4 we confirm the Oct 21, 2026 or later build and put an upgrade plan in the report.
  - WordPress major versions and PHP minor-version jumps (for example 8.2 to 8.3): planned with you, not automatic.
- **Uptime + log watch:** weekly log review for the §1.5 indicators where logs are reachable; process check for PHP starting `wget`, `curl` or a shell on servers we can access.
- **Backups and restore tests:** daily offsite backup with 30 days kept {DECISION D6}; one test restore to a staging copy **every quarter**, written up in the report.
- **WAF / Cloudflare:** where the client agrees and DNS can move, Cloudflare free plan in front with the managed rules on, plus JKCA's baseline rules (block user agents containing `php2shell`, challenge `/wp-login.php` and `/xmlrpc.php`). Paid Cloudflare plans are the client's cost.
- **Monthly report:** as Watch, plus a list of every update applied and the backup and restore status.
- **Incident hours:** {1 hour a month, DECISION D3}, no rollover. Covers looking into an alert, a rollback, or a host escalation.

**Not included:** cleanup of a confirmed compromise beyond the included hour, custom code fixes after an update breaks something (quoted), redesign or content edits (that's CARE Growth or hourly), hosting fees, paid plugin licenses.

### Tier 3: Harden

**Who it's for:** sites that take payments, bookings or logins, or owners who want the extra layers set up and checked monthly.

**Included (everything in Patch, plus)**
- **Patching cadence:** updates tested on a staging copy first, then applied; plugins with a published security fix get priority within {window, DECISION D4}.
- **Uptime + log watch:** daily automated search of logs for the §1.5 indicators with alerts to us; file-change monitoring on the web root, `wp-content/uploads` and `mu-plugins`.
- **Hardening, set up once and checked monthly:** `expose_php=Off`; `DISALLOW_FILE_EDIT`; XML-RPC off if unused; `file_uploads=Off` or multipart blocked on endpoints that don't take uploads, where the site allows it; `session.upload_progress.enabled=0` (the PHP team's interim mitigation); admin accounts reviewed and two-factor login on; least-privilege database user; security headers (HSTS, X-Content-Type-Options, Referrer-Policy, frame options, and a CSP where the site can take one).
- **Backups and restore tests:** daily offsite backup with 90 days kept {DECISION D6}; test restore **every month**.
- **WAF / Cloudflare:** custom rules kept current as advisories change (for php2shell: block multipart POSTs carrying `PHP_SESSION_UPLOAD_PROGRESS` and oversized bodies to PHP paths that don't take uploads); rate limiting on login.
- **Secrets:** one rotation a year of WordPress salts, database password and API/SMTP keys, plus one after any confirmed incident.
- **Monthly report:** as Patch, plus a short "what changed in the threat picture and what we did about it", in plain words.
- **Incident hours:** {2 hours a month, DECISION D3}, no rollover.
- **A 20-minute call each quarter** to go through the report (optional).

**Not included:** forensic investigation, breach notification or legal advice, PCI or compliance attestations, custom code, hosting fees, paid Cloudflare or plugin licenses.

---

## 3. Host-controlled sites (all tiers)

When the host owns PHP (shared hosting, many managed WordPress hosts):
1. We check what we can: PHP version and handler from WordPress Site Health, outside headers, the host's public status or security notice.
2. We send the host the written question in `INTAKE.md` §3, from the client's account or with the client copied.
3. We record the host's exact answer and date in the report. "Host says patched, confirmed in writing on {date}" is different from "we confirmed it from a live request", and the report says which.
4. If the host won't patch or answer within {DECISION D4 window}, we tell the client plainly and lay out the options: ask again, an edge firewall as a stopgap, moving host, or moving to CARE.
5. We never claim a host-controlled site is patched on our own say-so.

Price: same tier price. **DECISION D8** below asks whether Watch is the only tier sold on hosts that won't give any server or log access.

---

## 4. Onboarding checklist (crew, per site)

1. Signed quote or paid Payment Link with the `client_reference_id` tag (see `STRIPE-PLAN.md`).
2. Intake form complete (`INTAKE.md` §1).
3. Free site check run and saved (`INTAKE.md` §2).
4. Access received through the client's own invite (WordPress admin user in our name, hosting panel collaborator, SFTP/SSH key). No shared passwords by email. Record in the client record where each access lives and how to remove it.
5. Baseline: PHP version, handler and build date; WordPress, plugin and theme versions; admin user list; cron list; file listing hash of web root, uploads and mu-plugins.
6. First backup taken and stored offsite before any change.
7. Emergency patch check steps (§1) done if not already.
8. Monitoring added (uptime, TLS, blocklist; log watch where access allows).
9. Cloudflare (Patch/Harden) only after the client says yes to the DNS change in writing.
10. Hardening items (Harden) applied one at a time with a site check after each.
11. First report sent {timing, DECISION D2}, with what we couldn't see listed.
12. Offboarding note saved: how the client removes our access in five minutes.

---

## 5. Price and promise decisions (summary)

Competitor ranges, read Oct 22, 2026 from their public pricing pages:

| Provider | What it is | Public price |
|---|---|---|
| SiteLock (https://www.sitelock.com/pricing) | Automated scanning, auto malware removal, WAF/CDN on Pro and up | $19.99, $29.99, $44.99 a month |
| Sucuri (https://sucuri.net/website-security-platform/signup/) | Scans, WAF, unlimited malware cleanups, per site | $229, $339, $549 a year (Basic, Pro, Business); firewall alone $9.99 or $19.98 a month |
| Patchstack (https://patchstack.com/pricing/) | Plugin vulnerability mitigation software for developers | Developer $69 a month billed annually ($828/yr) |
| GoWP (https://gowp.com/pricing/) | WordPress care with updates, backups, scans | Pro $39, Business $99 per site a month |
| WP Buffs (https://wpbuffs.com/pricing/) | Hands-on WordPress care plans | Maintain $89, Protect $179, Perform $239, Custom $359 a month |

JKCA is a person-checked, local service with written reports, so it sits nearer WP Buffs than SiteLock. The CARE prices ($69 / $129 / $299) are the house anchors.

> **DECISION D3: Monthly prices and included incident hours (per site)**
>
> | Tier | Option A | Option B | Option C |
> |---|---|---|---|
> | Watch | $49 | $69 (same as CARE Hosted) | $89 (WP Buffs Maintain level) |
> | Patch | $129 (same as CARE Cared For) | $149 | $179 (WP Buffs Protect level) |
> | Harden | $249 | $299 (same as CARE Growth) | $349 |
> | Incident hours | Watch 0 / Patch 1 / Harden 2 | Watch 0 / Patch 0.5 / Harden 2 | Watch 0 / Patch 1 / Harden 3 |
>
> Reasoning: B mirrors CARE price points, so one menu reads cleanly and a client moving from Patch to CARE Cared For sees the same number. A keeps Watch an easy yes. C prices in hands-on time and slow hosts. Hourly overflow is set separately in D12. Also decide: annual billing at 11 months like CARE, or monthly only at launch (simpler; avoids anything that reads as a deal).

> **DECISION D4: Patch windows (how soon after a security release we apply it)**
> - **A. Within 2 business days** for PHP and security plugin fixes; weekly for everything else.
> - **B. Within 5 business days** for security fixes; weekly for everything else.
> - **C. "Next scheduled weekly session"**, no separate window. Lowest promise, simplest to keep with ~50 own sites.
> - Write it as a target in the terms, not a guarantee. The page can say "weekly" without a number if json prefers.

> **DECISION D5: Response time when an alert fires**
> - **A. Same business day** (Mon to Fri, 9 to 5 PT) for all tiers.
> - **B. Next business day** for Watch and Patch; same business day for Harden.
> - **C. No response-time promise on the page**; "a person looks at every alert" only.
> - Reasoning: JKCA has no 24/7 desk. Sucuri and SiteLock publish 4 to 30 hour ticket times with 24/7 teams; a small studio shouldn't copy those. Never say 24/7.

> **DECISION D6: Tooling choices that set cost**
> - Uptime interval: 1 minute / 5 minutes / 15 minutes.
> - Backup retention: Patch 30 days, Harden 90 days (as drafted) / both 30 / both 90.
> - Which backup and monitoring tools (the crew's call, but json approves any new monthly bill).

> **DECISION D7: CARE Store on WooCommerce**
> - **A.** Patch-level work is already part of the Store plan; say so in writing to those clients.
> - **B.** Store clients add Patch or Harden at the listed price.
> - **C.** Store clients add Harden at a set add-on price.

> **DECISION D8: Hosts with no server or log access**
> - **A.** Sell Watch only on those sites.
> - **B.** Sell any tier; the report says plainly what couldn't be checked.
> - **C.** Sell Patch, but only WordPress/plugin patching, and price it like Watch + {amount}.

> **DECISION D9: Capacity**
> How many outside sites JKCA takes in the first month while patching its own ~50 sites. Suggested: 5, 10 or 20. When full, the page CTA stays "Book a free site check" and the reply says when the next slot is.

> **DECISION D12: Hourly rate for extra work and incident time beyond included hours**
> - **A. $225, same as CARE.** One studio rate, nothing to explain; matches the existing CARE page and invoices.
> - **B. $195 for security-plan clients, $225 for everyone else.** Rewards being on a plan without discount copy on the page (it shows only the plan rate); adds a second rate to track.
> - **C. $175 in 15-minute blocks for incident checks only, $225 for project work.** Small checks stay cheap to say yes to; more bookkeeping, and the crew must label time correctly.
> - Reasoning: A is simplest and already public. B or C only make sense if json expects many small incident checks. Whatever is chosen also sets the Stripe hourly price (STRIPE-PLAN.md).


## Decided by json (Oct 22, 3:42 PM PT)
- D1, Emergency patch check price: **$395**. Replace `{DECISION D1}` placeholders with $395 when building.