What to Put in a Website Maintenance Contract

The short answer: a maintenance agreement is not a list of tasks. It is the answer to one question — what happens when something breaks? Six things belong in writing: what is covered and how often, how fast you get a first response, whether cleaning a hacked site is included or billed separately, how often backups run and whether a restore has been tested, how many hours of changes are included each month, and what you receive if you leave.

The six clauses worth having in writing

Everything else in a maintenance agreement is detail. These six decide whether the arrangement works when it is tested:

1. Scope and frequency — which tasks, and how often each runs.
2. First response time — how fast a human acknowledges a problem, and whether weekends count.
3. Security incidents — is cleanup included, or a separate quote?
4. Backups — how often, kept how long, and whether a restore is ever tested.
5. Included hours — a number, not a phrase.
6. Ownership and exit — whose name is on the domain, and what you get back.

Scope: what is covered, and how often

“Ongoing care” is not a scope. A usable scope reads like a schedule: software and plugin updates on a stated cadence, backups daily or weekly, monitoring continuous, a form and checkout test monthly, a report monthly.

Just as important is the other half of the scope — the list of things that are not included. New features, new pages, redesigns, content writing and platform migrations are almost always separate. A quote that only lists inclusions is telling you half the story.

Response time, and the second number nobody asks for

“Response time” is usually the time to acknowledge and start triage — not the time to fix. Those are two different numbers, and a quote that gives only one is leaving room for interpretation later.

Ask:

• How fast is the first response, and does it apply on weekends and public holidays?
• Is there a separate target for restoring service when the site is down?
• Who actually responds — the person who sold you the plan, or a support queue?

A two-hour acknowledgement with a next-business-day fix is a very different promise from a two-hour fix. Both are legitimate; only one of them is what most buyers assume they bought.

Security incidents: decided before, not during

Being hacked is the worst possible moment to negotiate price. Decide in advance whether malware removal, recovery and re-listing with search engines are inside the monthly fee or billed separately.

It is reasonable for a maintenance plan to cover triage, isolation and stopping the damage, while quoting full cleanup and rebuild separately — that work varies enormously by site. What is not reasonable is leaving it undefined. If your agreement is silent on security incidents, treat cleanup as extra and ask for a written price range.

Backups: frequency, retention, and who tests the restore

“We take backups” is not a commitment. A commitment looks like this: taken nightly, kept 30 days off-site, and restored within a stated window — with a test restore at least quarterly.

The test matters more than the schedule. A backup that has never been restored is an assumption, not a safety net. Ask how often a restore is actually verified, and by whom.

Included work: hours, not adjectives

Content changes are the single biggest source of scope disagreements. Most plans include some monthly allowance; most plans fail to define “small”.

Two hours a month is unambiguous. “Minor updates” is a future argument. Ask three things: the number of included hours, the hourly rate for work beyond them, and what happens when you go over — a bill, or a plan upgrade?

Ownership and access

Owning the code is not the same as controlling the site. Four things decide it:

• The domain registration — whose name and email are on it.
• The hosting account — whose billing and whose control panel.
• The admin logins — do you hold them, always, or only on request?
• The most recent backup — can you get a copy without asking permission?

If any of those sit with a supplier, you do not fully control the site; you control the arrangement. The fix is small and worth doing early: put the domain and hosting in your own name, keep your own email as the recovery contact.

We describe how we handle access, credentials and change records on Security & Website Access.

The exit clause

A notice period is not inherently bad — it is part of what allows a provider to commit to response times and staffing. What matters is that the term, the notice period and the handover are written plainly.

The exit clause should answer: how much notice either side gives, what happens to fees already paid for a period already started, and exactly what you receive and within how many days — files, logins, and the latest backup.

Red flags in a maintenance quote

Four questions that surface what a quote is hiding

1. What is the first response time when my site goes down, and does it apply on weekends?
2. If my site is hacked, is cleanup included or billed separately?
3. How many hours of changes are included each month, and what is the rate beyond them?
4. If I leave, what do I receive, and how soon?

Any provider should be able to answer all four in writing. If the answers only arrive verbally, that is the answer.

How this applies to our own terms

This article is written to be useful against any quote, so it is fair to apply it to ours:

• Scope and included hours are published per plan, with standard task credits listed so there is nothing to negotiate after the fact. See Plans & Pricing.
• First response is 2 hours on business days. That is an acknowledgement and triage window — not a fix time, and not 24/7 coverage.
• Security incidents are handled to a defined triage and containment credit; malware removal, full cleanup and recovery are a separate scope, quoted before we proceed.
• Backups are checked and restore-verified as part of the service, because a job status is not evidence.
• Ownership: your domain, hosting and files stay in your name. We describe the access rules on Security & Website Access.
• Term and exit: an initial term, then monthly renewal, with a defined notice period. Fees for a period already started are not refunded; if you prepay annually and cancel within 30 days, the unused difference is refunded. These terms are stated in our Terms of Service.

We publish these because an agreement is easier to trust when you can read it before you need it. If something in your own agreement is unclear, that is worth resolving now rather than during an incident.

Where to go next

Website Maintenance Contract FAQ