WordPress maintenance & support in Basel

A WordPress site serving businesses in Basel sits next to Roche on Grenzacherstrasse, the Novartis Campus on Fabrikstrasse, DayOne accelerators in the BaselArea cluster, and the Art Basel calendar at Messe Basel. That proximity does not turn a marketing site into a GxP system or a Novartis-class clinical portal. It does mean updates, backups, logs and form integrations are discussed before the first production change, not as an appendix after an incident that triggers a question from legal about nFADP and the Federal Data Protection and Information Commissioner (FDPIC, EDÖB in German).

WPPoland delivers ongoing WordPress maintenance from Poland, as one senior developer, for businesses, CRO suppliers and organisations with a base, branch or client base in Basel. Scope is WordPress maintenance: tested updates, daily backups, security and performance monitoring, incident response on working days (CET), and up to four hours of small development changes per month. Custom theme builds and plugin development are separate topics, described on the WordPress developer in Basel page.

#WordPress maintenance in Basel and the life sciences cluster

Basel is not Bern with the Bundeshaus, nor Geneva with the UN and WTO. It is life sciences capital: Roche and Novartis set the bar for documentation, partner onboarding and scientific recruitment. Around them grows an ecosystem of CROs, suppliers, spin-offs and accelerators promoted by BaselArea (baselarea.swiss). Basel Digital Hub and the trilingual Dreiländereck add reviewers who ask whether restore was tested last quarter and whether wp-admin logs show who installed a plugin on Friday afternoon.

For WordPress maintenance those facts translate into three recurring requirements. First, update discipline: Core, plugins and themes ship through staging, with regression checks in DE, FR and EN before production promotion. Second, decision trail: who approved the update, what changed, what was rolled back, and what remains in the monthly report. Third, residency and retention: backup location, log retention and processor documentation are recorded in the runbook, not assumed because hosting sits in Switzerland.

The typical brief that reaches maintenance in Basel does not read “keep it updated somehow”. It reads: last Core update was eight months ago, backup plugin shows green but nobody has restored since 2022, WPML or Polylang serving German text on the French version after a patch, a recruitment form with CV upload returning 500 after a forms-plugin update, and a new life sciences conference landing broken because someone updated Elementor without staging. That is an operations and process problem, not a marketplace-theme problem.

WPPoland is not a supplier to Roche, Novartis or BaselArea. Proximity to the pharma cluster sets the bar for documentation, roles and trilingual delivery. It does not set a reference list.

#What the monthly maintenance package includes

Maintenance in Basel is a written scope, not a vague “I look after the site”. The monthly package covers:

• Tested updates: WordPress core, plugins and themes updated on staging first. Regression checks cover front templates, forms, DE/FR/EN language pairs, consent banners and critical user journeys. Production promotion follows a documented step with rollback path.
• Daily backups with 30-day retention: automated backups stored in geographically separate locations. Restore is tested on staging at onboarding and at least quarterly thereafter. A backup that has never been restored is decoration, not recovery.
• Security monitoring: malware scanning, file integrity checks, login attempt monitoring, WAF rules tuned for WordPress attack vectors, and quarterly security review of plugin inventory and admin accounts.
• Uptime and performance monitoring: synthetic checks at one-minute intervals, PageSpeed and Core Web Vitals tracking on templates that actually exist (not only the homepage), alerts via Slack and email.
• Small development hours: typically two to four hours per month for content-model tweaks, block fixes, form adjustments, accessibility patches and editorial workflow improvements without opening a separate project.
• Replies on working days (CET), with no guaranteed response time. Confirmed security incidents and production outages trigger the incident procedure on working days (CET).
• Monthly status report: metrics (uptime, backup success, update log, performance trend), decisions taken, remaining risks, and incident summary if applicable.

Pricing is individual and delivered in writing after scope is agreed. There is no rate card on this page.

#Tested updates, staging discipline and the Art Basel freeze

The most expensive maintenance failure in Basel is not a missed minor plugin update. It is a Core or major plugin update pushed to production on a Thursday because “it looked fine on localhost”, breaking the French version of a recruitment form the day before a campaign week at a CRO on the Novartis Campus.

Staging is a production copy with anonymised data. WP-CLI search-replace on URL, separate keys, crons that send mail to real addresses disabled. Editorial and IT click through staging with real Gutenberg patterns in all three languages, not on the developer’s laptop. Multilingual regression, form submission with CV upload and keyboard navigation happen here.

Production promotion is a documented step: tag or merge, asset build, cache warmup, rollback path to the previous tag. I do not “quick upload” one PHP file over SFTP, because nobody can reconstruct what was on production on Friday before Art Basel fills Messe Basel.

The maintenance runbook for clients in Basel treats the Art Basel window in June as a period of elevated operational risk. That week does not schedule theme deployments, new blocks or plugin changes unless it is a security hotfix with written product-owner approval. Staging receives changes; production waits until the Monday after the fair. That is not event superstition. It is an agreed deployment freeze that a pharma compliance officer recognises from their own change-management procedures.

Update cadence follows risk, not calendar superstition. Security patches for actively exploited CVEs move faster than cosmetic plugin updates. Major version jumps (PHP, Core, WooCommerce if present) get their own written plan and acceptance criteria. WooCommerce stores are a separate scope; if the brief includes checkout, see WooCommerce developer in Basel.

#Backups, restore and hosting in Switzerland

Hosting “in Switzerland” is a jurisdiction argument in procurement, not a magic shield. A form collecting candidate CVs without legal basis is not fixed by a server in Kleinbasel alone. Maintenance still records where backups live, whether off-site copies cross borders, and what the client’s processor agreement requires.

Practical backup rules written into the runbook:

• Daily automated backup of files and database, 30-day retention minimum unless contract says otherwise.
• Off-site copy in a separate region or provider from production.
• Restore test on staging at onboarding, then quarterly. The test produces a timestamped note in the monthly report.
• Backup encryption at rest where the hosting stack supports it.
• Documented recovery steps agreed in writing, not invented after an outage.

Cyon operates from Basel and is one hoster local operators recognise without explaining “why not AWS in Virginia”. Infomaniak and Metanet also offer in-country centres. SwissIX connects Swiss data centres; for a site operator in the Basel region, origin in CH shortens the path to users in the country. If the client requires backups to remain in CH, that is a contract topic checked at onboarding against the actual provider configuration, not an assumption from the TLD.

#Security, nFADP, FDPIC and GDPR in cross-border briefs

Proximity to Roche and Novartis does not turn a marketing WordPress site into a GxP system or a certified clinical environment. WPPoland does not claim “ISO 27001 compliant” or “meets GxP” unless the client ran that audit. Maintenance delivers inventory, access trail and update discipline the client can paste into procurement or processor-agreement documentation, not an agency compliance stamp.

Posture maintainable in code and process:

• No secrets in Git. Keys, database passwords and CRM tokens go through environment variables or outside the repo.
• Admin accounts use 2FA. Polish editors do not get install_plugins on production. Roles are cut to what Gutenberg requires.
• XML-RPC stays disabled unless a justified client needs it. File editor in the admin too.
• Headers: HTTPS, HSTS where certificate and CDN allow, CSP matched to real scripts (consent, tag manager, fonts).
• Dependencies: pinned plugin versions, CVE awareness, updates on staging before production. Unpatched Core is worse than skipping a new “security” plugin.
• Logs: who logged into wp-admin, which plugin change shipped when. Retention agreed with nFADP and client policy, not “keep everything forever”.

The revised Swiss Federal Act on Data Protection (nFADP, nDSG in German) entered into force on 1 September 2023. Supervision sits with the Federal Data Protection and Information Commissioner (FDPIC, Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter EDÖB). Maintenance supports the data controller with evidence: what personal data the site processes through forms and analytics, which subprocessors touch it, where backups and logs sit, and what happened during an incident. GDPR still applies to processing aimed at people in the EU. A corporate site in Basel with traffic from the Union therefore has two layers, not one. After a personal-data breach the client may need to notify FDPIC; logs and the incident timeline must fit a notification workflow. WPPoland documents interventions with timeline, root cause and remediation steps. It does not file on behalf of the data controller.

Penetration tests are mentioned only when the client has or orders them from a lab. Hardening WordPress is a set of operational decisions recorded in the monthly report, not a slide about zero incidents.

#DE/FR/EN trilingual maintenance

The most common post-update regression in Poland-Basel collaboration is not PHP fatal errors. It is the French version showing German strings because a plugin update reset language mappings, or hreflang pointing to de-DE instead of de-CH because the theme overwrote tags after an SEO plugin update.

Maintenance for trilingual sites in Basel includes:

• Regression checks in DE, FR and EN after every staging update cycle.
• Monitoring for hreflang errors and broken language switcher links.
• String-level awareness: consent banners, form errors and aria-labels must stay aligned across all three languages.
• Editorial freeze windows recorded in the runbook (Art Basel week, scientific congress, recruitment campaign) when production changes require explicit approval.
• Monthly report note when a language pair was touched, what was verified, and what remains for client-side approval.

Basel-Stadt has German as the official language, but the border region with France (Weg bis nach Saint-Louis) translates regulatory and B2B copy into French. English is the operational language in life sciences. Swiss German copy uses ss instead of ß (Strasse, not Straße), MWST instead of MwSt. Impressum fields must match Handelsregisteramt des Kantons Basel-Stadt and Zefix, not a Zurich or Geneva template.

Polylang and WPML solve hreflang and language copies. They do not solve process: who approves German text, who approves French, who approves English, before production. The maintenance runbook records whether approval sits with the client in Basel, with the Polish content lead, or both in parallel.

#Monitoring and incident response

Monitoring combines synthetic uptime checks, application-level alerts and security scanning. Alerts route to Slack and email with enough context to triage without logging into five dashboards.

Incident management follows ITIL-lite: detection, triage, resolution, post-mortem. Every confirmed incident gets a written root cause summary. Monthly reports show the uptime actually measured rather than a marketing number.

I reply on working days (CET), with no guaranteed response time. I do not offer 24/7 on-call cover. The intervention is logged with timeline, containment steps, remediation and follow-up risks. That log is what legal and IT in Basel need when asking “what happened between 14:00 and 16:30 on Tuesday”.

Communication runs through a written ticketing channel. Calls unblock decisions; they do not replace the audit trail.

#Performance maintenance

Speed in Basel is not vanity. Life sciences firms and B2B suppliers compete on credibility; a site that loads in four seconds on mobile loses form completions and signals neglect to reviewers accustomed to pharma-grade project standards.

Performance maintenance includes:

• Core Web Vitals tracking on real templates: homepage, CPT archive, single, hero pattern page in DE, FR and EN.
• Image pipeline review: AVIF/WebP delivery, responsive srcsets, lazy loading without breaking LCP.
• Cache layer health: object cache hit rate, CDN cache rules, transient bloat from abandoned plugins.
• Database hygiene: autoloaded options audit, revision limits, orphaned post meta from retired plugins.
• Quarterly performance trend in the monthly report with before/after when a change was shipped.

Performance budgets are set at onboarding and checked against lab and, where available, CrUX field data. Event-related sites near Messeplatz see traffic spikes during Art Basel that do not appear in “normal” CrUX; monitoring from one US region lies. A measurement point in Switzerland or at least Central Europe is part of the operational contract, not an add-on. Poland and Basel share CET/CEST, so weekday diagnostics overlap.

#Relationship to development and handover

Maintenance is the steady state after launch, or the rescue lane for a site that outgrew DIY updates. If the site needs a new block theme, custom plugin or large refactor, scope moves to WordPress developer in Basel. If the site needs checkout, TWINT or product catalogues, scope moves to WooCommerce developer in Basel.

Development engagements end with a runbook: how to add a pattern, how to ship a branch, how to rebuild staging, whom to call when the editor will not save. Maintenance picks up that runbook and keeps it current as Core, plugins and hosting evolve. A handover without a runbook is a support ticket waiting to happen.

#Basel Digital Hub and the local tech scene

Basel Digital Hub is a reference point for Basel’s digital ecosystem: meetups, networking, projects linking life sciences, startups and IT suppliers. It is not a WPPoland sales argument. It is a barometer: editorial and IT teams in Basel ask about restore tests and staging because they heard those questions at local meetups and in University of Basel corridors.

BaselArea promotes the region as a life sciences cluster with access to three countries in the Dreiländereck. DayOne accelerators and CRO suppliers add reviewers who read monthly reports, not only marketing copy. For Basel, DE/FR/EN trilingual delivery, pharma-adjacent compliance culture and impressum aligned with Zefix matter more than pretending to be Zurich banking or Geneva diplomacy.

#How to start maintenance in Basel

A short brief is enough to begin: which theme and plugins exist today, who edits (PL/DE/FR/EN), when backups last restored successfully, whether the front is trilingual, where hosting sits and whether backups must stay in CH, and whether Basel IT requires Git and staging from day zero. WPPoland reviews the install, lists risks (unpatched Core, secrets in repo, broken DE/FR/EN trio, consent plugin sending data outside CH) and proposes a plan with acceptance criteria and a written scope.

Contact: WPPoland contact form. The service pillar without city in the slug remains at WordPress maintenance. Custom development in Basel is at WordPress developer in Basel.