Med spa hosting and maintenance is the unsexy line on the invoice that protects every other line above it.

No. We are host-agnostic. Whether you are on WP Engine, Kinsta, GoDaddy, Cloudways, or some niche reseller, we work with what is already there. We may recommend a move if performance or security is structurally impossible on your current host, like a shared box without staging, no malware scanning, or no PHP version updates in the last 18 months. It is a recommendation, not a requirement. If you would prefer managed med spa hosting on our infrastructure, that is available on Premium and up at no extra fee, with a one-week migration included.

Essential keeps the lights on: uptime monitoring, daily backups, monthly patching, monthly malware scans, and 2 hours of content edits. Premium adds the WAF, weekly patching, daily malware scans with auto-quarantine, faster incident response (14 minutes average versus best effort), 5 hours of edits, and an annual HIPAA form audit. Enterprise adds proactive monthly performance tuning, schema upkeep, conversion-tracking integrity checks, and a 2-hour SLA. Most med spas running active paid or SEO spend should sit on Premium or higher. The price difference between Essential and Premium is roughly one Google Ads click on a competitive injectables keyword.

No. Med spa hosting and maintenance runs month to month with 30 days’ notice to cancel or downgrade. Too many med spas have been inherited from agencies that locked them in with annual contracts they could not get out of without losing access to the site, and that model does not get replicated here. The monthly site-health report is what should keep you on the plan, not a clause in a contract. Clients who stay the longest, often three years and counting, are the ones who could leave at any point and choose not to. That is the relationship the program is built for.

The everyday edits a med spa manager actually needs: hours updates, new injector bios, photo swaps, treatment-page tweaks, monthly specials, holiday banners, FAQ additions, blog posts you have already written. Edits get billed against the monthly hours bank (2, 5, or 10 hours by tier). Larger work, like a new treatment-line page or a full redesign of a section, is scoped separately and quoted flat. Emergency work like a broken booking widget or a 503 on a Friday night does not eat the hours bank. That kind of work is covered as part of the SLA.

On Premium and above, recovery is included: restore from off-site backup, malware sweep, vulnerability patch, and a Search Console reconsideration request if Google has issued a manual action. Average recovery time across the incident history is 4 hours to back-up-and-running, with 30 days to fully restored search rankings. Most recoveries see zero ranking loss because the rollback hits before Google has time to re-crawl and downgrade. On Essential, recovery is billable hourly, but you have the same daily backups and uptime monitoring in place to catch the incident inside the first hour.

Yes, any time. Most clients start on Essential or Premium and move up when they start running paid acquisition or hit a PageSpeed ceiling that their current tier cannot keep on top of. Downgrades are also fine. We will usually flag if the site has features (HIPAA forms, structured schema, conversion tracking) that the lower tier no longer covers, so you can decide whether to keep them or let them retire. The site-health report shows exactly which features sit inside which tier, so the switch is never blind.

Yes, that sits on the Custom tier. Multi-site dashboard, per-location reporting, dedicated maintenance pod, and a 1-hour SLA on critical incidents. If you are rolling out new med spa locations, hosting and maintenance integrates with the broader rollout playbook so each new location enters maintenance on day one of going live, instead of waiting a quarter for the legal department to negotiate a separate vendor agreement. Per-region cost rollups and security review sit on top.

Three things show up by month two. First, med spa compliance: HIPAA-aware form routing for prescription treatments like Botox and GLP-1, BAA-covered intake, and PHI audits that generic WordPress agencies do not perform because they do not know they should. Second, med spa management of the integrations that matter: booking platform connections to Boulevard, Mindbody, Vagaro, Aesthetics Pro, and Zenoti; consult-fee payment flows; call-tracking like CallRail. Third, med spa website optimization tuned to landing-page conversion for injectables, body contouring, and laser, not generic homepage PageSpeed. Most generic agencies pick one of these and ignore the other two.

Yes, on Premium and above. After every plugin or theme update goes live in staging, an engineer runs the full booking flow on desktop Chrome, mobile Safari, mobile Chrome, and the most common iPad browser, then submits a test booking that gets verified arriving in your booking platform. The test booking gets canceled before the staging push goes to production. The whole QA cycle adds roughly 15 minutes per update, but it catches the “auto-update broke the booking form” failure pattern that costs most med spas thousands of dollars per month in lost revenue. Most maintenance providers skip this check because it does not scale into a recurring billable line. We do not.

It is backed up off-site every 24 hours, with 30-day retention, and stored on a separate provider from your hosting. Most med spas have years of before/after photos sitting in the WordPress media library or in a custom gallery plugin, often the single most valuable asset on the site. A backup strategy that only protects the database (which most cheap hosts default to) loses every one of those images in a recovery scenario. Our off-site backups include the full media library, the database, the theme, and any custom code, with a one-click restore tested weekly. Photos do not disappear when the site does.

Yes. State board inspections and HIPAA audits do not happen often, but when they happen, the website’s posture matters: BAA documentation for form routing, privacy policy compliance, consent capture for prescription treatments, secure handling of PHI in intake flows, supervising-physician disclosures where required. Premium and above includes the annual HIPAA-aware form audit, which produces a documented record of the audit findings and remediation. Enterprise adds the broader compliance review (privacy policy, terms, consent flows, telehealth disclosures if applicable) on a quarterly cadence. The documentation is the deliverable: if a state board or auditor asks for proof that PHI is handled correctly, you can hand them the audit record without panic.