A one-off WordPress tune-up for Singapore businesses: Core Web Vitals work for mobile, a firewall and malware scanning, hardened logins and a before-and-after report. From S$800, on any host.
Google runs a full test on both devices. This usually takes 20 to 40 seconds.
A real person replies within one business day, Mon–Fri, to talk through the fixes.
A one-off, five-day service for WordPress sites: we tune Core Web Vitals on mobile, add a firewall and malware scanning, harden logins, audit accessibility to WCAG 2.2 AA and report before and after, with a 30-day recheck. Works on any host, fastest on Nerb hosting.
Google’s three measures of how a page feels to a real visitor: LCP (loading) 2.5 seconds or less, INP (responsiveness) 200 milliseconds or less, CLS (visual stability) 0.1 or less. Each is judged on real Chrome visits over 28 days, and a page passes only when all three are green.
LCP
Loading. How long until the biggest thing on screen, usually the hero image or headline, appears.
Good 2.5 s or lessNeeds improvement 2.5 to 4 sPoor over 4 s
What usually breaks itSlow server response, uncompressed hero images, render-blocking scripts and fonts.
INP
Responsiveness. The delay between a tap or click and the screen reacting.
Good 200 ms or lessNeeds improvement 200 to 500 msPoor over 500 ms
What usually breaks itHeavy JavaScript, page builders, chat widgets and third-party tags.
CLS
Visual stability. How much the layout jumps while loading, so you tap the wrong thing.
Good 0.1 or lessNeeds improvement 0.1 to 0.25Poor over 0.25
What usually breaks itImages without dimensions, late fonts, injected banners and ads.
0 to 100
A lab estimate from Lighthouse on a simulated mid-range phone. Good for finding fixes, not the pass mark.
0 to 49 poor50 to 89 needs improvement90 to 100 good
Our target on every tune-upPassing Core Web Vitals on mobile in Google’s field data, reported before and after.
Source · Google, Web Vitals on web.dev: good LCP, INP and CLS thresholds, at the 75th percentile of page loads, for mobile and desktop.
Three audits, one engineer with server access, one report. No retainer required.
We measure with real Singapore mobile data, then fix what matters: server response, caching, a Cloudflare CDN with Singapore edge nodes, images, scripts, fonts and layout shifts. Before-and-after numbers, not a plugin install.
Sample · Core Web Vitals, illustrative before and after, mobile
A Cloudflare firewall and bot blocking, malware cleanup of files and database, updates, two-factor logins and least-privilege admin accounts. A verified off-site backup comes first.
Sample · illustrative firewall log, not a client site
We audit against WCAG 2.2 AA (contrast, alt text, keyboard, form labels, focus) and fix what we find in the theme. Accessible pages are also easier for search engines and AI assistants to read.
Sample · illustrative accessibility audit, not a client site
Because most Singapore visitors arrive on a phone, most WordPress breaches start with an unpatched plugin, and a data breach here runs on a legal clock.
11,334
new WordPress vulnerabilities were disclosed in 2025, up 42% on 2024; 91% were in plugins.
165
ransomware cases were reported in Singapore in 2025 (159 in 2024), with SMEs disproportionately affected.
Source · Cyber Security Agency of Singapore, Singapore Cyber Landscape 2025/2026
3 days
is the PDPA deadline to notify the PDPC once a breach is assessed as notifiable (significant harm, or 500 or more people).
Source · Personal Data Protection Act, Part VIA; PDPC Guide on Managing and Notifying Data Breaches
0.1 s
faster mobile load time lifted retail conversion rates by 8.4% in a Google and Deloitte study.
First we contain it: malware cleanup of files and database. Then we close the way in and request blacklist removal if the site was flagged. On a Nerb hosting and maintenance plan, a hacked site is a critical issue: we clean it up and restore it from the daily off-site backups if needed.
Malware cleanup of files and database, restored from a clean backup if needed.
We find the entry point, update core, theme and plugins, and add two-factor logins.
If Google or browsers flagged the site, we request removal.
One page on what happened, what we changed and what’s next, for a PDPA breach assessment.
On Nerb hosting, your server logs, resource graphs, firewall events and backups are already in front of us, so troubleshooting starts in minutes, not after a support ticket.
PHP and database logs, CPU and memory graphs, firewall events.
We change server, caching and firewall settings directly. No third-party ticket.
Edit pages and posts from ChatGPT, Claude or WhatsApp, live straight away with no approval step. How it works
Every item below, on any WordPress site, with the numbers to prove it.
LCP, INP and CLS fixed at the source.
WebP or AVIF, correct sizes, lazy-loading, compressed CSS and JavaScript.
Page and object caching plus a CDN with Singapore edge nodes.
Cloudflare WAF and bot rules block brute-force, spam and known exploits.
Files and database scanned and cleaned; blacklist removal requested.
Two-factor login, limited attempts, least-privilege users, file permissions, updates.
Contrast, alt text, keyboard, forms and focus fixed in the theme.
Sitemap, schema and metadata checked, plus the report and 30-day recheck.
Five business days from scan to report, on a staging copy first.
We check mobile Core Web Vitals, visible security gaps and accessibility, then reply with the findings and a fixed quote.
A verified off-site backup first. Then speed, caching and CDN, firewall, malware cleanup, updates, logins and accessibility.
We release the changes, re-test on phone and desktop, and send the before-and-after report.
Google’s field data covers a rolling 28 days, so we recheck once real visitors have used the tuned site.
Nerb’s tune-up is from S$800 one-off, scoped to site size and complexity, quoted after the free scan. It covers speed, security and accessibility together.
For a WordPress site that is slow, exposed or both.
Move the tuned site to Nerb, and the same team looks after it.
What Singapore business owners ask before they book a tune-up.
Speed is one ranking signal among many, so no one can promise a position. The bigger effect is on people: fewer leave before the page loads and more complete your forms. A Google and Deloitte study found 0.1 seconds faster mobile load time lifted retail conversion rates by 8.4%.
No. We work on a staging copy first, after a verified off-site backup, so your live site keeps running. On day 5 we release the changes and re-test the live site.
No single service can, and we don’t claim to. The tune-up puts in place the technical controls the PDPA and Cyber Essentials expect of a website: patched software, a firewall, two-factor logins, tested off-site backups and an incident report. Cyber Essentials certification comes from a CSA-appointed body, and PDPA compliance also covers your policies, consent and staff practices.
The tune-up is priced for WordPress, where we have server and code access. On those platforms speed work is mostly at the theme, app and image level. Send us the URL and we’ll quote separately.
Until the site changes. New plugins, scripts and content can slow it down again, and new weaknesses keep appearing: Patchstack counted 11,334 new WordPress vulnerabilities in 2025. That’s why we recheck at 30 days, and why ongoing updates matter.
No, the tune-up works on any host. It’s faster and lasts longer on Nerb hosting: the logs and firewall events are already in our hands, and the same team keeps the gains. Hosting & Maintenance plans start from S$650 a year, and we move sites from any host.
Send us your URL. A real person replies within one business day, Mon–Fri, with the findings in plain English. No obligation.
A real person replies within one business day, Mon–Fri, with your scan results.
