Website maintenance is sold in vague terms surprisingly often. "Ongoing support" appears on the invoice, money leaves the account monthly, and nobody involved could describe precisely what is being done. Here is what a maintenance agreement should actually contain.

Dependency and security updates — applied and tested

A modern website depends on dozens of third-party packages. Vulnerabilities are found in them continuously, and the fix is nearly always to update. The important word in this section is "tested": applying updates blindly to a live site is how a working site becomes a broken one on a Friday afternoon.

What to ask for: a regular cycle, updates verified somewhere other than production first, and a written note of what was changed. If nobody can tell you when the site was last updated, it has not been.

Monitoring, with someone who responds

Uptime monitoring is close to free, so its presence is not the interesting part. The interesting part is what happens when it fires at nine on a Sunday evening. An alert that arrives in an unwatched inbox is not monitoring; it is a log.

  • Availability checks from more than one location.
  • Error tracking, so failures visitors hit are noticed even while the site stays up.
  • Certificate and domain expiry warnings, well in advance.
  • A named person who receives the alert and a stated expectation of when they act on it.

Backups that have been restored at least once

Almost everyone has backups. Far fewer have ever restored one. An untested backup is a belief, not a safeguard — and the moment you discover it was incomplete is invariably the worst possible moment.

Ask when the last restore test was performed, where backups are stored, and how far back they go. If the answer to any of those is uncertain, that is the first thing to fix.

An allowance for small changes

This is the part clients value most day to day: a price change, a new team member, a seasonal banner, a page that needs a paragraph adding. Without an agreed allowance, every small change becomes a quote, and small changes therefore stop happening. Sites decay by accumulation of tiny things nobody thought was worth an invoice.

A written response expectation

Not a guarantee with penalties — for a small business site that is usually theatre — but a plain statement of what happens when something breaks. Which channel to use, what counts as urgent, and roughly how quickly you can expect a human reply. Ambiguity here is the thing people are actually paying to remove.

And, quietly: do you own everything?

Worth checking once a year, whoever maintains the site. The domain should be registered to you. The hosting and deployment accounts should be in your name with your billing. The source code should be in a repository you can access. None of this implies distrust; it means that if the relationship ends, or someone becomes unavailable, your website continues to exist.

If any of those are held by someone else, sorting it out is a short administrative task today and a genuine crisis at the wrong moment.