Maintenance and technical support

1C-Bitrix website support: we spot problems before your customers do

Updates, 24/7 monitoring, backups with verified restores, hack protection and development by the hour. The server, the code and the site are looked after by one team — 1C-Bitrix developers and the administrators of our own hosting.

Connect your site Packages and prices

Website maintenance: 24/7 monitoring spots a problem, an engineer finds the cause and fixes it, backups are verified, security is under control

24/7Zabbix monitoringsite, server, database, SSL and domain — the on-call engineer is alerted immediately

1 hResponse time from one hourto an incident on the Professional package, from three hours on the others

SIEMWazuh on our serversdetects attacks and malicious code on ONEHOST hosting

12Years with 1C-Bitrixwe know the core, modules, 1C exchange and payments inside out

Why it matters

What happens to a website without maintenance

A website is not ‘finished for good’ after launch: updates that close vulnerabilities keep coming, the database grows, bots and attacks change. Here are the four scenarios we see most often — all from our own work over the past few months.

Hacked through outdated code

Security

The core and modules have not been updated for years, and the passwords have never been changed. One day the site starts sending visitors to someone else’s pages, and search engines flag it as dangerous.

finding and removing malicious code;
closing the vulnerability the attackers used;
updates, password changes, file-change monitoring.

From our work: we cleaned web shells and 4,873 malicious .htaccess injections off an electronics distributor’s site; on a client’s server we found a hidden cryptominer disguised as a system process.

The site is slow and keeps going down

Performance

The catalogue has grown, but the server settings are still the ones from launch. The database reads the disk non-stop, memory runs out at peak hours — and the site returns a 503 error exactly when there are the most shoppers.

load analysis: database, cache, memory, bots;
tuning for the real data volume;
fixing heavy queries and scheduled jobs.

From our work: a tender portal read its disk at 128 MB/s for 38 days — an 8 GB database with a 128 MB cache. We raised the cache to 4 GB and disk reads dropped to zero.

Backups exist, but you can’t restore from them

Backups

Backups are ‘set up’, but the copies sit on the same server, the archive is corrupt or the database is missing from it. People find out on the day they need the backup.

daily database and file backups;
stored separately from the site;
regular checks: we restore a backup and make sure the site comes up.

Rule of thumb: a backup you have never restored from is a hope, not a backup.

The developer has left, tasks are piling up

Development

The freelancer has vanished, the studio has closed, the in-house programmer has quit. You need to change a banner, add a payment method or fix the 1C exchange — but there are no credentials and no documentation.

we take over the site with a code and access audit;
we run tasks with estimates in hours;
we document what was changed and where.

From our work: in an online store’s modules we found logs with customers’ full names and phone numbers open to anyone with a direct link — we locked them down and moved them out of the public folder.

What’s included

What we do every month

A subscription covers the work every website needs: monitoring, updating, protecting and keeping backups. Improvements and new features are billed by the hour — every client needs a different amount.

Updates

The 1C-Bitrix core and modules, server software. We install on a copy first, test the catalogue, cart, payments and 1C exchange, then roll out to the live site.

Moving to a newer PHP: a dedicated 1C-Bitrix and PHP upgrade service for sites that have not been updated in a long time.

24/7 monitoring

Zabbix watches site availability, server response, the database, the disk, and SSL certificate and domain expiry dates. Alerts go to the on-call engineer, not just to a mailbox nobody reads.

Fact: on ONEHOST hosting every server is monitored, and we also keep track of domain and hosting renewal dates.

Security

Malware scanning, file-change monitoring, protection against password brute-forcing and bots, a WAF and DDoS protection based on Cloudflare. We find where an attack came from and close the entry point, not just clean up the aftermath.

Fact: Wazuh SIEM on ONEHOST servers — a mass scan for the pearcmd vulnerability in September did not succeed on a single one of our sites.

Backups

Database and files every day, stored separately from the site, with restore checks. If something breaks after an update or someone else’s edit, we bring back a working version within minutes.

Where they are stored: on separate ONEHOST storage in Kazakhstan; for your own server — wherever we agree.

Performance

Database and cache settings for your data volume, disk space, slow queries, mobile page speed. We find the cause of a slowdown rather than blindly adding memory to the server.

Fact: wint.kz — mobile PageSpeed score 45 → 91–95, LCP 10.7 → 1.8 s after our optimisation.

Development and content

New sections and features, modules, banner and page design, catalogue and news updates, SEO. Your support hours are covered by every specialist in the studio, not a lone ‘website guy’.

Rate: 20 000 ₸/hour for planned tasks and 30 000 ₸/hour for urgent ones — estimated before work starts.

How support works

The database went down at night. What happens next

Support is not ‘email us and we’ll reply on Monday’. Getting from a monitoring alert to a report takes hours, and routine work goes on without you having to be involved.

Support diagram: a monitoring alert or request, diagnosis, fix, verification, report; routinely — updates, backups, security, performance

Scroll the diagram sideways →

1Our own hosting

ONEHOST — servers in Kazakhstan run by the same team. No need to referee between the hosting provider and the developer over whose problem it is.

2We know 1C-Bitrix inside out

We have been implementing and extending 1C-Bitrix since 2014; the payment modules, instalment plans and 1C exchange are our own. We understand the code, not just the settings.

3A dedicated manager

One person on WhatsApp takes your tasks, estimates them in hours and keeps track of deadlines. You don’t have to explain everything again to each specialist.

4Transparent hours

Every task has an estimate before it starts and the actual hours after. At the end of the month you get a report: what was done, how many hours, what the risks are and what we recommend.

Tools:ZabbixWazuh SIEMCloudflareWAFBitrixEnvFastPanel1C-BitrixPHP · MariaDBGit

Packages

Website maintenance pricing

A package means monthly maintenance and guaranteed response times. Development and content are not included and are billed by the hour for the actual time spent. Prices are per month, excluding VAT.

Basic

50 000 ₸ / month

A corporate website or a small store that needs to stay secure and in the loop.

updates and backups
24/7 Zabbix monitoring
incident response time — 3 hours

Choose

Standard

90 000 ₸ / month

An active online store with regular tasks and orders coming in every day.

everything in Basic
a dedicated manager
root-cause analysis of failures

Choose

For online stores

Professional

150 000 ₸ / month

A store where an hour of downtime means lost orders and wasted ad spend.

24/7 security monitoring
WAF, DDoS protection, bot filtering
incident response time — 1 hour

Choose

Custom

from 300 000 ₸ / month

High-traffic stores and portals, multiple sites, special turnaround requirements.

everything in Professional
urgent tasks — work starts within 2 hours
SLA terms set in the contract

Discuss

What’s includedBasicStandardProfessionalCustom

1C-Bitrix platform updates✓✓✓✓

Server software updates (Linux)✓✓✓✓

24/7 Zabbix server monitoring✓✓✓✓

Server resource optimisation✓✓✓✓

Backups: setup, verification, restore✓✓✓✓

Priority task handling✓✓✓✓

Root-cause analysis of site outages—✓✓✓

Dedicated manager on WhatsApp—✓✓✓

24/7 security monitoring, analysis and tuning——✓✓

Cloudflare-based DDoS protection——✓✓

WAF firewall, bot attack analysis and filtering——✓✓

Incident response time3 hours3 hours1 hour1 hour

Planned tasks: response time / work starts within1 day / 3–5 days4 hours / 2 days2 hours / 1 day2 hours / 1 day

Urgent tasks: work starts within—1 business day2-hour response2 hours

Times are in business days and hours; incidents picked up by monitoring are handled around the clock.
Development, design, content and SEO are not included in packages and are billed by the hour: 20 000 ₸ for planned work, 30 000 ₸ for urgent work.

20 000 ₸per hour of planned work

30 000 ₸per hour of urgent tasks

Support hours are covered by every specialist in the studio: content editors, front-end and back-end developers, designers, SEO specialists, analysts and Bitrix24 implementation consultants. You get an estimate before work starts and the actual hours in the report.

B24

Need Bitrix24 support?

The packages on this page are for websites. Bitrix24 portals have their own packages, run by our Bitrix24 integrators and administrators.

Cloud Bitrix24 supportintegrator hours, portal audit, new tools from releasesfrom 40 000 ₸ per month → On-premise administrationupdates, backups, server monitoring and securityfrom 60 000 ₸ per month →

From our work

What we have found and fixed

Real cases from client sites over the past few months. We do not name companies unless they have given permission.

45 → 91–95mobile PageSpeed

Wint.kzOnline storeOptimisation

Store speed and orders in Bitrix24

We optimised loading: desktop 48 → 97, LCP 10.7 → 1.8 s, layout shift down to zero. Along the way we checked security and tidied up the server. Orders now turn into Bitrix24 deals automatically.

View the case →

128 → 0MB/s of disk reads

Tender portalMySQLServer

A portal thrashed its disk for 38 days

An 8 GB database was running with a 128 MB cache — a hosting panel setting was overriding ours. We found which configuration file took precedence and raised the cache to 4 GB: disk reads dropped to zero and pages began loading faster.

Server support

4,873malicious injections removed

DistributorHack1C-Bitrix

Large-scale hack of an online store

Web shells in various folders and thousands of malicious .htaccess injections. We cleaned the site, checked the core against a reference copy, locked the attackers out and provided a plan for changing passwords and finding the root cause.

Security

0successful attempts

ONEHOST hostingSIEMPrevention

A mass attack that failed

In September an automated scan for the pearcmd vulnerability swept across our sites. Wazuh SIEM logged the attempts, and a check showed the technique had worked on none of them — unnecessary components were not installed and risky settings had been disabled in advance.

Prevention rather than cure

Website development →Search engine optimisation →All projects →

Onboarding

How we take a site on for maintenance

It does not matter who built the site or where it is hosted. The first two weeks go into getting to know it from the inside — after that we take responsibility for it just as we do for our own projects.

Request and access 1–2 days

Access to the site, hosting, domain and repository, if there is one. We make sure you keep full owner rights and agree on communication channels.

Onboarding audit up to 2 weeks

Core, module and PHP versions, changes to the core code, malicious code, backups, load, errors in the logs. The result is a list of risks ranked by severity and what to fix first.

Monitoring and backups in the first week

We connect monitoring, set up backups and test restores. From then on incidents are spotted by the on-call engineer, not by your customers.

Maintenance under your package every month

Updates, security, performance and hourly tasks through your dedicated manager. Anything urgent — by phone and on WhatsApp.

Report once a month

What we did, how many hours we spent, what incidents occurred and how they were resolved, and what we recommend for the next month.

What the package includes

1C-Bitrix and server software updates;
24/7 monitoring and incident response within the package’s response times;
backups with verified restores;
server resource optimisation;
security according to the package: from updates to WAF and SIEM;
task priority, a manager and a monthly report.

What is billed by the hour

improvements, new sections and features;
design of banners, pages and promotions;
catalogue content, news, copywriting;
SEO and analytics beyond setting up tracking;
moving to a newer PHP version and major upgrades — as a separate service;
cleaning up a site after a hack that happened before onboarding.

FAQ

Frequently asked questions

You didn’t build our site. Will you take it on?

Yes, that is a common situation: sites come to us from other studios and freelancers. We start with an onboarding audit — reviewing the code, versions, backups and security — and tell you honestly what should be fixed right away.

Our site isn’t on your hosting. Is that a problem?

No. We maintain sites on any hosting and on client servers — we just need access. On ONEHOST hosting we can do more: monitoring, SIEM and backups are already set up, and the server administrator is on the same team.

What is included in a package and what is billed separately?

A package covers the regular work: updates, monitoring, backups, security and response times. Development, design, content and SEO are billed by the hour: 20 000 ₸ for planned and 30 000 ₸ for urgent tasks, estimated before work starts.

How quickly will you respond to an incident?

An incident picked up by monitoring reaches the on-call engineer immediately. The package response time ranges from one hour on Professional to three hours on Basic and Standard. Custom response times are set in the contract.

Do you only work with 1C-Bitrix?

1C-Bitrix is our main platform and the one we know most deeply. We also maintain sites on Astro, WordPress and custom PHP. For Bitrix24 there are separate packages: cloud support and on-premise administration.

Who owns the access credentials and the code?

You. We work under our own accounts, which you can disable at any time, and we never change the owner’s passwords without agreement. If you end the service, we hand over everything we changed along with the documentation.

Can we skip the package and pay by the hour only?

Yes, we handle one-off tasks at the hourly rate. But without a package there is no monitoring, no backups and no guaranteed response times: we will hear about a problem from you rather than before you.

Our site has already been hacked. What should we do?

Get in touch straight away. We will preserve a copy for analysis, clean out the malicious code, find out how the attackers got in and close that door. The clean-up is estimated separately by the hour, and afterwards we recommend a package with security monitoring so that it does not happen again.

Connect your site

Send us your site’s address — we’ll suggest a package

We’ll look at what the site is built on, where it is hosted and what shape it is in from the outside. Then we’ll suggest a package and explain what we will check during onboarding.

We reply within one business day.
If your site is down or has been hacked right now, call us and we’ll deal with it urgently.
We work under a contract with our LLP, payment by invoice; offices in Almaty and Astana.

Have a task list or a description of the problem? Send it to info@oneit.kz (PDF, DOCX, XLSX up to 20 MB) — and mention it in your message.