Fully managed WordPress hosting: we hold the keys, you own the site

Updated: Sep 2026

Every so often a client asks us for admin access to their website. Sometimes it’s for the agency running their Google or Meta ads. Sometimes it’s because a new staff member was told they should have it.

We’ve given the same answer for 20 years. While your site is on our fully managed hosting, we hold the admin keys. You can still do nearly everything you’d want to do. And if you ever move on, the keys are yours.

It’s a fair question, and it deserves a proper answer. So here’s ours, and the reasons behind it.

Key Takeaways

• Most requests for “admin access” are really about running your own content. You can already do that.
• What we keep is plugins, the theme and server settings. That’s where sites break, slow down and get hacked.
• Your Google Ads or Meta ads agency can run campaigns without WordPress admin. Many already do.
• It’s your site. If you leave, you get all of it, admin included.

Admin access usually means something simpler

When someone asks for admin access, our first question is: what do you want to be able to do?

Nine times out of ten, the answer is about content. Adding landing pages. Publishing news. Updating the menu. Giving a new team member a login. Changing a form. You can do all of that on our sites now, using the page sections and components we built for you. We’d love you to use them more, not less.

What admin access adds on top is the ability to install plugins, change the theme and alter how the site runs. That’s the part we keep. If you need a new feature, tell us. We’ll find the right way to add it, test it on a copy of your site, then put it live. Most of the time there’s no charge.

What 20 years of hosting has taught us

We’ve hosted hundreds of WordPress sites. We’ve also been asked to look at, rescue or take over plenty of sites hosted elsewhere. The problems are rarely dramatic at the start. They build up quietly, one reasonable decision at a time.

The plugin added for one small feature

Someone wants a slider, a popup or a booking button. They search, find a plugin with good reviews and install it. It works, so nobody thinks about it again.

Repeat that over a few years and a site can end up with dozens of plugins, each doing one small job. When we take over sites like this, we usually replace most of them. A few lines of custom code or one plugin from our tested set does the same job. It’s common to see load times fall from four or five seconds to under one.

The site that got slower every year

Some plugins are badly built. They ask the database for far more than they need on every page load. One of them can slow the whole site, and everything else on the same server with it.

The owner rarely notices, because they see the site every day. Their visitors notice. People leave slow pages, and search engines rank them lower.

The contact form that stopped sending

A plugin update clashes with another plugin. The site still looks fine. But the contact form quietly stops sending, or the confirmation emails stop arriving.

There’s no error message and no alarm. The first sign is usually someone asking why enquiries have dried up. By then it may have been weeks.

The page that didn’t look like the rest

Page builder add-ons make it easy to build something quickly. They also make it easy to ignore the design. A new font here, a different button there. One page at a time, the site drifts away from the brand and the message.

The components we build exist so your team can add pages quickly and still have them look and read like you.

The setting that hid the site from Google

We’ve seen two SEO plugins fighting over the same pages. We’ve seen a single setting switch a page, or a whole site, to “hidden from search engines”. We’ve seen redirects break after a well-meant clean-up.

Each one makes a site harder to find, on Google and in the AI answers more people now use. None of them announce themselves.

The hacked site that couldn’t be cleaned

We’re often asked to fix hacked WordPress sites. The story is nearly always the same: cheap shared hosting, plugins nobody checked, and one out-of-date plugin that let someone in. Sometimes the damage reaches the database.

Modern malware is built to hide inside normal files and come back after it’s removed. So cleaning a hacked site properly often means stripping it right back. Sometimes the honest answer is a fresh build. That always costs more than prevention would have.

Nobody knows why it’s there

Plugins outlive the people who installed them. A few years on, nobody remembers what half of them do, or whether removing one will break something. Your team is busy running the organisation. Keeping track of that shouldn’t be their job.

Why it matters more now

None of this is new to us. It’s why we’ve worked this way from the start. But the risk keeps growing.

Security researchers now find thousands of new WordPress vulnerabilities every year, and the great majority are in plugins, not WordPress itself (Patchstack, 2026). AI tools are speeding that up on both sides. Flaws are found faster, and attackers start using them within hours of them becoming public.

WordPress itself has shipped security releases every few weeks through the second half of 2026. Keeping up with that takes daily attention, not an update when someone remembers.

Admin accounts are also exactly what attackers go after. A common attack starts with a link sent to someone who manages the site. If that person is an administrator, one click can hand over the whole site. If they aren’t, the attack usually goes nowhere. Every extra admin account is one more way in.

What fully managed means

Plenty of hosting calls itself “managed”. Often that means someone looks after the server, then hands you admin and leaves the rest to you. Cheaper hosting also crowds hundreds of sites onto one shared server.

Fully managed means we look after the server and everything that runs on it:

• Fast private servers. Our sites run on high-performance virtual private servers that we set up and tune ourselves, not crowded shared hosting.
• A tested set of plugins. We use a small set we know are fast and secure. Anything new gets tested on a copy of your site before it goes near the live one.
• Security that works around the clock. Patchstack blocks attacks on newly found vulnerabilities as soon as they’re published, often before a fix exists. Updates follow, tested first.
• Malware scanning at three levels. Real-time scanning on the site, an overnight virus scan on every server and a daily server-level malware scan.
• Backups in more than one place. Every site is backed up at least once a day, and twice a day for busier sites. Copies are kept in three to four separate places.
• One team responsible. If something goes wrong, it’s ours to fix. That only works because we know exactly what’s on every site.

That’s why we can stand behind the speed and security of the sites we host. If you want the case for paying for this kind of hosting at all, we covered it in why managed WordPress hosting is worth it.

Working with your Google Ads or Meta ads agency

SEO is one of our main specialties, so we handle it ourselves. Every site we build is fully set up for search from day one.

Paid advertising is where we work alongside other agencies. We work with many Google Ads and Meta ads agencies across our clients, and none of them need WordPress admin to run great campaigns.

Here’s how it works:

• Tracking: the agency gets access to Google Tag Manager, where ad tracking and conversion measurement belong.
• Analytics: their own access to Google Analytics, granted directly in Google.
• Landing pages: we build landing pages for specific campaigns as they’re needed. They use your site’s components, so they load fast and look like the rest of your site.
• Anything else: if the agency needs a change on the site, it comes to us. We test it and put it live.

It works well for everyone. The agency focuses on the campaigns. We make sure the pages are fast, on brand and that the tracking keeps working.

It’s still your website

Holding the keys isn’t the same as owning the site. Your content, your domain and your data belong to you. If you decide to move on, we hand over a full copy of the site with admin access.

While you’re with us, add as many pages as you like and get as involved as you want. We’ll keep it fast, secure and set up to be found on Google and in AI answers. We’ve worked this way for 20 years, and our clients have stayed.

If your site keeps slowing down, or you’re weighing up fully managed hosting, talk to us about managed hosting. You’ll be talking to the people who look after the sites.

---

Frequently asked questions

Can I get admin access on Weave’s managed hosting?

Not while your site is on our fully managed hosting. You can add pages, posts, menus, users, forms and media. We look after plugins, the theme and settings. If you leave, you get full admin.

Why can’t my ads agency have WordPress admin?

Every admin account is another way into the site, and agency logins are often shared between staff. Your agency gets Google Tag Manager and Google Analytics access instead, and we build the landing pages their campaigns need.

What if I need a new feature?

Ask us. We’ll find the right plugin or build it with a small piece of custom code, test it, then put it live. Most requests cost nothing extra.

Do I still own my website?

Yes. The content, domain and site are yours. If you move to another provider, we hand over a complete copy with admin access.