Security and maintenance for your WordPress website The Doppel­gänger.

A digital twin that keeps your WordPress website and all its plugins up to date, monitored and protected from attacks.

With it, content and changes can be prepared at your own pace and published with one click, without taking the website offline. Updates are tested there first, and your visitors only see the finished result.

Request a quote Learn more
Built around SMEs

Maintenance and a safety net for your website.

On most WordPress websites everything happens directly in the live system: a plugin update, a new text, a design tweak. Updates are tedious, risky and tend to get pushed back. Known security holes stay open for weeks. If that goes wrong one day, your customers will probably notice before you do.

No test systemHoles stay openNo dossier

The Doppelgänger changes that: a test environment that always mirrors your live website. With it, I keep your website up to date, monitor its condition and prevent outages. You don’t have to take care of anything. What used to be reserved for corporations with their own IT, I now make possible for small and mid-sized businesses too.

01 Staging environment Your own test system on a separate server. New pages, redesigns and updates only go live once you have checked and approved them there. Learn more
02 Security & updates Regular updates for WordPress, plugins and theme, tested on the Doppelgänger first. On top of that, eight automatic checks examine your live website every night. Learn more
03 Dossier Every change is recorded. If an update causes problems, the previous version is back with one click, without downtime or frantic troubleshooting. Learn more
Doppelgänger for Shopware
Since our store got its Doppelgänger, where Julian checks every update and every change first, the store has been running absolutely smoothly. Updates are no longer a big project we keep putting off. We see and test new features there before they go live, and only approve them once everything is right. It has made our work noticeably more productive.
Bettina SanioHead of Marketing & Communications, JuCad®
Since 2020in my careShopware 6with the Doppelgänger
01 · Staging environment

Tested first, then published.

The Doppelgänger is an exact copy of your WordPress website: the same version, the same plugins, the same theme, all content, images and settings. This is where things are built, tested and signed off, while the live website keeps running undisturbed. A regular sync keeps it up to date.

What stays as it is: your hosting, your domain, your logins.

Doppelgänger · checked
Live website

From the request to going live, without risk.

Posts, pages, plugin and theme updates: everything happens on the Doppelgänger first, unnoticed by your visitors.

Your live website stays online throughout.
From the Doppelgänger menu
Doppelgänger Applied today
WooCommerce 9.3.1 → 9.4.0Update
Page “Services”changed
Theme: new headerchanged
Live website untouched
Doppelgänger
Live website
4 changes marked Approve
Publishingapprox. 2 min
Backup created14:02
New version built14:03
Switching overrunning
Checking live website
Doppelgänger
As of 14:03
Live website
As of 14:03
Identical last synced today, 14:05 Sync
Versions4 of 128
v128
WooCommerce update, new headerToday, 14:03
Live
v127
Page “Services” revisedYesterday, 09:41
Restore
v126
Security update WordPress 6.6.2Sep 28, 16:20
Restore
v125
Autumn campaign launchedSep 24, 11:05
Restore

What the Doppelgänger does day to day.

Core feature

Test & review

New pages, a redesign, a campaign: on the Doppelgänger you experience everything in advance as a real website, to try out, show around and sign off. It only goes live once you are convinced.

Flawless publishing

No manual uploads, no forgotten files. The new version is prepared in full and switched over in an instant.

Write content with Claude

With the Claude connector you ask your own Claude for a new post or a new page. The result is saved as a draft on the Doppelgänger, nothing goes live on its own.

Worry-free updates

Even a major WordPress or WooCommerce update is run through in full before your visitors see it.

Prepared for emergencies

An attack is spotted quickly, every change is visible and can be undone. That keeps the damage small.

02 · Why more protection is needed now

Security in the age of AI

AI-assisted programs scan the entire internet around the clock for vulnerable websites. They don’t ask how big your company is, only which version you run. If you update promptly, you close the gap before it is found.

Hours, not weeks

A known vulnerability is often exploited automatically within a few hours, long before “we’ll update when we get around to it”.

Nobody is “too small”

Automated attacks don’t pick a target. They hit every website with a known vulnerability.

The damage is real

Hacked plugins, spam pages in Google’s index, malware, days offline. Cleaning up costs many times more than prevention.

Nightly security checks

While you sleep, your live website is checked point by point.

Uptime monitoringMonitored around the clock. Outages are noticed immediately.
Web VitalsLoad time and responsiveness in view. Any drop is detected.
Security checkCompared against known vulnerabilities in WordPress core, plugins and theme.
Server checkSSL certificates, disk space and services in the green.
System backupBacked up in full every night, independent and encrypted, on servers in Germany.
File comparisonEvery file checked against version control. Anything unexpected stands out.
Plugin inventoryAll WordPress plugins recorded, outdated or abandoned versions are detected.
Content validationPages and texts unchanged, no unnoticed tampering.
Uptime monitoringMonitored around the clock. Outages are noticed immediately.
Web VitalsLoad time and responsiveness in view. Any drop is detected.
Security checkCompared against known vulnerabilities in WordPress core, plugins and theme.
Server checkSSL certificates, disk space and services in the green.
System backupBacked up in full every night, independent and encrypted, on servers in Germany.
File comparisonEvery file checked against version control. Anything unexpected stands out.
Plugin inventoryAll WordPress plugins recorded, outdated or abandoned versions are detected.
Content validationPages and texts unchanged, no unnoticed tampering.
Uptime monitoringMonitored around the clock. Outages are noticed immediately.
Web VitalsLoad time and responsiveness in view. Any drop is detected.
Security checkCompared against known vulnerabilities in WordPress core, plugins and theme.
Server checkSSL certificates, disk space and services in the green.
System backupBacked up in full every night, independent and encrypted, on servers in Germany.
File comparisonEvery file checked against version control. Anything unexpected stands out.
Plugin inventoryAll WordPress plugins recorded, outdated or abandoned versions are detected.
Content validationPages and texts unchanged, no unnoticed tampering.
Expert view
An update alone is not enough: for almost half of all WordPress vulnerabilities there is no patch yet when they are published. That is why nightly monitoring is part of it.
Julian Bräucker
Julian BräuckerDeveloper and operator of the Doppelgänger, Düsseldorf
46%
of WordPress vulnerabilities have no patch at disclosure
03 · Dossier

The dossier.

Every change to your website goes into the dossier: when, what, by whom. So you can always trace what happened, even years later.

Who, what, when

Every change with date, description and author, whether from you, your team, an agency or a freelancer. So you keep track even with many people involved.

Back in seconds.

If something goes wrong, the website is switched back to the last clean version. Individual changes can be undone selectively, without losing anyone else’s work.

A clean handover

New staff or a new agency start with a documented website and a complete dossier. No knowledge locked in one person’s head, no dependence on individuals.

At a glance

Before. After.

Until now
With the Doppelgänger
Testing changes
Directly on the live website, visible to everyone
On the exact copy, invisible to visitors
When something goes wrong
Searching, repairing, hoping, under time pressure
Switching back in seconds
Updates
Rare, because risky
Regular, because tested first
Monitoring
You notice when a customer calls
Nightly security checks, run automatically
Backups
Only your hosting’s
Hosting backup plus an independent, encrypted second backup
Costs compared

Updating by hand isn’t cheaper. It just happens less often.

An example calculation: four update rounds a year by hand, the Doppelgänger and a single incident compared.

Updates by hand4 × a year
€900€1,600€3,640
a year, about €75 per montha year, about €133 per montha year, about €303 per month
4 rounds 2.5 h4 h7 h €90/h€100/h€130/h
  • Tested directly on the live website
  • No way back in seconds when something breaks
  • Nobody checks between rounds
The Doppelgänger12 to 24 × a year
Monthly flat fee
tailored to the scope, plus a one-time setup

Per update round less than two hours of a developer’s time, and every round is tested first.Usually costs about as much as four rounds by hand, but updates three times as often and checks every update on the copy first.Less than four update rounds a year at an agency, and monthly instead of quarterly.

  • Every update checked on an exact copy first
  • Version control and rollback in seconds
  • Nightly security checks and an encrypted second backup
When it goes wrong1 incident
€7,690 to €21,350€7,690 to €21,350€11,450 to €34,200
cleanup, forensics, rebuildcleanup, forensics, rebuildnot counting fines and lost sales

For a week the website redirected visitors to casino sites. Five websites on the same server were infected, and so were the host’s backups.For a week the website redirected visitors to casino sites. Five websites on the same server were infected, and so were the host’s backups.For weeks, card details were skimmed at checkout through an outdated extension. It was the bank that reported it.

See the case See the case See the case

Example: 2 to 3 hours per round including backup, updates, clicking through and small fixes, at a median freelance developer rate of €90. Example: 3 to 5 hours per round for WordPress with WooCommerce or a page builder, at €100 an hour. Example: 6 to 8 hours per round for minor updates (an agency’s estimate), at an agency rate of €130. Incident costs: the example calculation from the case, without lost sales. Sources: freelancermap 2025, Patchstack 2026.

Case studies Twelve typical incidents with a cost calculation, and what the Doppelgänger catches. up to €34,200 per incident View
In detail · WordPress

What WordPress involves.

A WordPress website rarely consists of WordPress alone. Plugins, theme, page builder and WooCommerce come from different vendors and are updated independently. That is where most conflicts arise, and the Doppelgänger catches them before your visitors see them.

Core, plugins and theme

WordPress, every plugin and your theme are updated on the Doppelgänger and clicked through before they go live. Premium plugins with their own license key included.

WooCommerce through to checkout

Updates to WooCommerce and its extensions are tested along the complete order process. Outdated template overrides in the theme show up before they cause errors in the live store.

Page builders and the block editor

Elementor, Divi or the block editor: after every update the layouts are compared with the live website on desktop, tablet and phone. Shifted spacing or missing elements show up before your visitors see them.

New PHP versions

When your host retires a PHP version, the Doppelgänger runs on the new one first. You know which plugin causes trouble before your host switches.

Multisite and several languages

WordPress multisite installations and multilingual websites using WPML or Polylang are copied, tested and published as a whole.

Forms that do not send by accident

Contact forms, newsletters and interfaces to your CRM can be tested safely on the Doppelgänger. Outgoing emails are intercepted, so no test ends up with a real recipient.

Related guides

Running WordPress safely

Security
Cyber Resilience Act: what it means for your website or online store (and what it does not)
Who the CRA obliges, who it does not, and what changes indirectly for website and store owners.
Learn more
Staging
Staging environments: host staging, plugin or your own server?
Four approaches compared: isolation, data protection, rollback and suitability for stores.
Learn more
Costs
Website maintenance: What does it really cost?
Maintenance contracts compared, hours per update round, and what a single incident can cost.
Learn more
WordPress
Critical error after a WordPress update: how to get your website back
Recovery mode, switching a plugin off via FTP, rolling back a version and preventing it in the future.
Learn more
Security
NIS2 for small businesses: covered or not, and what your customers are asking now
Who NIS2 covers directly, what customers ask suppliers, and how to answer website questions with evidence.
Learn more
WordPress
How to update WordPress safely without putting your website at risk
Why postponing is risky and which routine keeps core, plugins and WooCommerce safe.
Learn more
Security
Online store hacked: what to do now
First steps for Shopware and WooCommerce: skimmers, payment providers, customer data, reporting.
Learn more
Security
PHP2Shell: what the critical PHP flaw means for your website
What the PHP flaw allows, who is affected and why this time your host has to act.
Learn more
Security
PHP2Shell: what to do now
Check the PHP version, ask your host, protect the site meanwhile, look for signs of a break-in.
Learn more
Security
Security in the age of AI: what changes for your website
What AI changes about attacks on websites, what is proven, and which defenses really help.
Learn more
Security
Updates are mandatory: what the GDPR requires of website and store owners
What Art. 32 GDPR requires for updates, backups and access, and what supervisory authorities say about it.
Learn more
Security
WordPress hacked: what to do now
First steps, signs, backup or cleanup, the Google warning and the reporting duty.
Learn more
Shopware
From Shopware 5 to Shopware 6: how to get the migration right
What moves over, what has to be rebuilt and how to keep your search rankings.
Learn more
Costs
Shopware Community Edition over €1 million in sales: what now?
What you lose above €1 million GMV, what Rise costs and why switching systems is rarely cheaper.
Learn more
Shopware
From Shopware 5 to WooCommerce: how to get the move right
When WooCommerce fits, what moves over and how to protect your rankings and customer accounts.
Learn more
Shopware
How to update Shopware 6 without putting your store at risk
Patch, minor or major: a checklist for backups, staging, extensions and rollback.
Learn more
Shopware
Replacing Shopware 5: which alternative fits your store?
Shopware 6, WooCommerce, Shopify, JTL-Shop and Magento: costs, effort and which one fits whom.
Learn more
Shopware
Shopware 6 update failed? Causes, the way back, security updates
Narrow down the cause, restore safely, and why security updates cannot wait.
Learn more
Getting started

What it takes to get started.

You give me one login, and I set up everything else.

One login

SSH access or a login to your hosting control panel is enough. That is all I need from you.

Two to three days

I copy your website to the Doppelgänger, install the plugin and set up the nightly checks. After two to three days, everything is ready.

A quote for your website

Costs depend on your project. After a first review of your system, you get a quote.

Frequently asked questions

What you might still want to know.

Also worth a look:
Does the Doppelgänger work with my WordPress host?

As a rule, yes. Your website stays with your host, and the Doppelgänger is added as a server of its own. Which access I need, I’ll go through with you in our first call.

Are plugin updates applied automatically?

Not without testing. Every update is tested on the Doppelgänger first. Security updates then usually go live within 24 to 48 hours, all others on the agreed schedule. More in the guide Updating WordPress safely.

Does this work with WooCommerce too?

Yes. With WooCommerce I also test the complete order process and check your theme’s template overrides. Customer data and orders are anonymized on the Doppelgänger.

Is the Doppelgänger a staging plugin?

No. Staging plugins create a copy on the same hosting as the live website. The Doppelgänger is a server of its own in Germany, with version control, security checks and automated publishing. Your website only runs a lightweight plugin for publishing and sync. The differences in detail are in the guide Staging environments compared.

What do you need from my hosting provider?

SSH access, meaning technical access to the server your website runs on, and access to the database. Publishing and the nightly file comparison run through it. Many hosting providers include SSH and let you set it up in a few clicks, or I can do it for you. If your plan has no SSH access, I will tell you in advance what is possible instead.

Where is the data stored? What about data protection?

Everything in Germany: the Doppelgänger runs password-protected in the Falkenstein data center (Saxony), and the encrypted nightly backups are stored there too. Personal data is anonymized on every copy, in line with the GDPR.

What does the Doppelgänger cost?

A monthly flat fee based on the size and requirements of your website, plus a one-time amount for the setup, both set in the service agreement. For comparison: a single hacked website, or one that is down for days, usually costs considerably more than a year of Doppelgänger.

How long is the contract term?

The term is set in the service agreement. And if you ever switch: you hand over a cleanly documented website with a complete dossier.

Next step

Let’s talk about your WordPress website.

In a short conversation I find out what your website needs, how the switch works and what it costs. No obligation, no rush.

The Doppelgängerby jbraucker

Developed by Julian Bräucker, Düsseldorf. Servers in Germany.

Cover for your website. © 2026 Julian Bräucker · jbraucker.com Data center in Falkenstein, Germany