A website is not one object. It is a CMS, a set of plugins, a server, a hosting plan, a domain, an SSL certificate, a database, and a pile of content, and each of these ages at its own speed. The domain expires on a fixed date. The plugin needs a patch next month. The SSL certificate lapses quietly in the background.
Maintenance means somebody is named as responsible for each of those parts. A plan that does not say who watches what is a support number with a price attached.
What There Is to Look After
Before comparing plans, it helps to know the list. A reasonable plan covers most of these:
- Updates to the CMS, themes and plugins
- Security scanning and cleanup if something is found
- Backups, stored away from the web server
- Uptime monitoring with alerts
- SSL certificate and domain renewal reminders
- Speed checks on a regular schedule
- Broken links and form testing
- Small content edits
If a proposal mentions only "technical support" and "bug fixes," most of this list is probably missing.
Ask for It in This Shape
When two vendors send two plans, they rarely look alike, which makes comparison hard. Turning each one into the same table solves that.
| Item | What to get in writing |
|---|---|
| Updates | How often, and whether they are tested on a copy before going live |
| Backups | Frequency, how long they are kept, where they are stored, and whether a restore has ever been tried |
| Security | What is scanned, and whether cleanup is included or billed separately |
| Monitoring | Who gets the alert, and how fast someone responds |
| Renewals | Whose name the domain and hosting are registered in |
| Changes | How many small edits per month, and what counts as small |
A vendor who can fill every row without hedging has probably done this before.
Hours or Scope?
Plans come in two main forms. One sells a bank of hours each month. The other lists a fixed set of tasks for a fixed fee.
Hours suit sites that change often, because you can spend them on whatever comes up. The risk is that routine work, like updates and backups, quietly eats the bank, and you are left with little for the changes you wanted.
Fixed scope suits sites that mostly need to stay healthy. You know what you are paying for, and the routine tasks are not competing with your requests.
Neither is better in general. What matters is that the plan says which one it is.
Promises That Cost Nothing to Write
Some phrases sound reassuring and commit the vendor to very little.
"24/7 support." Ask for the response time. Someone answering the phone at midnight is not the same as someone fixing the problem by morning.
"Unlimited changes." Ask what happens on the third large request in one week. Unlimited usually comes with a quiet definition of fair use.
"SEO included." Ask for the deliverables. Reports, keyword work, page-level fixes, or just a monthly email?
"Regular backups." Regular is not a number. Daily, weekly, and monthly are very different levels of protection.
Who Holds the Keys
This part has nothing to do with price, and it is where most of the pain in later disputes begins. Check whose name the domain is registered under. Check who owns the hosting account. Check whether you, not only the vendor, have admin access to the CMS and to the backups.
If the vendor controls all of it and the relationship ends badly, you may have a hard time proving the site is yours. Putting ownership into the contract on day one costs nothing, and fixing it after a falling-out costs a great deal. If your site came from an agency, a short conversation with whoever handles your web development can settle this in one email.
Pricing Without the Monthly Illusion
Monthly figures look small. Ask for the yearly total and what is included in it, then divide the cost by the tasks in the table above. A cheaper plan that covers three rows is not cheaper than a dearer one that covers six. It is simply less.
Also check what is excluded. Cleanup after a hack, restoring from a backup, and moving to a new host are often billed separately, and they tend to be needed at the worst possible moment.
Before You Sign
- Every item in the table above is named, not implied.
- Response times are given in hours, not adjectives.
- Backups are stored off the server, and a restore has been tested at least once.
- The domain and hosting accounts are in your name.
- You hold admin access to the CMS.
- The contract says what is excluded and what that costs.
- You know how to leave: notice period, handover of credentials, handover of backups.
