Within 48 hours of a patch being released, across every site I host or maintain. That window is deliberate. When a security fix is published, the vulnerability it fixes becomes public knowledge at the same moment, and automated scanners start hunting for sites that have not applied it within hours, not weeks. Patching is not something I fit in when the schedule allows; it is a standing commitment with a number attached, so you can put it in your own security documentation and mean it. If a patch needs testing against your specific customisations first, that testing happens inside the same window, not instead of it.
A security patch is also an announcement. The moment Umbraco publishes a fix, anyone who reads the release notes knows exactly what was broken in every site that has not yet updated. The race between you and the people scanning for unpatched installs starts at publication, and it is not a race you win by scheduling maintenance for the end of the month. Two days is long enough to apply a patch carefully and short enough to matter.
Every site on my managed hosting and every site on a support and maintenance plan. It covers Umbraco core security releases and security updates to the packages your site actually uses, which is where many otherwise well-run sites quietly fall behind: the CMS is current but a form package from 2021 is carrying a known hole.
Speed does not mean recklessness. Patches are applied to a copy of the site first when the change is anything beyond trivial, and every site has verified backups, restore-tested rather than assumed, so even a badly behaved patch is a reversible event. This is routine plumbing when it is somebody's actual job, and a recurring emergency when it is nobody's.
People usually ask about patch speed because an audit, an insurer or a client questionnaire is asking them. If you need to write down who patches your site and how fast, and the honest current answer is "nobody, eventually", that is fixable this week. A support plan gives you a named person, a 48 hour number and a paper trail, which is normally exactly what the questionnaire wants to see.
Tell me what you're working on and I'll come back within one working day.
A specialist Umbraco developer offering freelance / contract services to a wide variety of clients across the UK
Maesgwyn, 3 Claremont rd,
Llandudno, North Wales, LL30 2UF