A website maintenance agency sells something most buyers cannot inspect: the absence of problems. Updates applied, backups taken and tested, security patched, forms still submitting, speed not quietly degrading. Because the deliverable is invisible when it works, this is one of the easiest services to under-deliver on and one of the easiest to overpay for. This guide names what a maintenance retainer should actually contain, how to tell a genuine one from a hosting invoice with a support email attached, what moves the monthly price, and how to vet a provider on evidence it has already published.
What a real maintenance retainer contains
Six things separate maintenance from hosting. First, updates: core software, plugins, themes and dependencies applied on a stated schedule, tested on a staging copy rather than on your live site. Second, backups that are taken off the same server and, crucially, restored periodically to prove they work, because an untested backup is a hope rather than a plan. Third, security: patching, monitoring, and a stated response when something is compromised. Fourth, uptime and performance monitoring with someone actually receiving the alert. Fifth, a defined amount of small change work each month, measured in hours or tickets. Sixth, a written response time for when something breaks. If a proposal is missing the staging environment, the restore test or the response commitment, it is a hosting plan with a friendlier name.
What moves the monthly price
Platform complexity comes first. A brochure site on a mainstream content system is inexpensive to keep healthy; a store with payment integrations, a membership site, or a custom application with its own dependencies is not, because every update carries a risk of breaking a transaction. The second input is response commitment: an agency promising a same-day fix during business hours must hold capacity for you, and capacity is what you are paying for. The third is included change work, which is where retainers differ most: two hours a month and ten hours a month are different products. The fourth is compliance and risk, since a site handling payments or personal data needs more careful patching and a documented incident process. Ask for the numbers behind each: update cadence, backup frequency and retention, restore test interval, monitoring interval, response target, and included hours.
How to vet a provider on its own evidence
Hold candidates to what they have already published. Ask for the maintenance plan page with the tiers on it, and if there is none, ask for the floor price and what it includes in writing. Ask for two clients on the same plan you would be on and speak to them about what happened the last time something broke, which tells you more than any uptime figure. Ask when they last restored a client backup and what the restore took. Ask what monitoring they use and who receives the alert at two in the morning. Finally, ask what the monthly report shows: a real one lists updates applied, backups verified, issues found and time used, so you can see the work you cannot otherwise observe.
Ownership, access and the exit
Maintenance relationships end, and the terms decide how expensive that is. Confirm in writing that you own the domain, the hosting account, the code and the content, and that you hold administrative access rather than being a user on the agency's account. Ask whether the site runs on any proprietary components the agency licenses, because those do not travel and can turn a routine move into a rebuild. Ask for backups to be delivered to storage you control, not only to the agency's. On exit, a professional handover is a copy of the site, the database, the credentials and a short document naming the stack and any custom work. Agree that up front, when goodwill is high, rather than during a dispute.
Questions people ask about website maintenance agency
Is maintenance different from hosting?
Yes. Hosting is the server your site runs on. Maintenance is the human work of keeping the software current, backed up, monitored and repaired. Many hosts bundle automatic updates, which is useful but not the same as someone testing an update on staging and noticing when your contact form stops sending.
How often should updates be applied?
Monthly is a reasonable baseline for routine updates, with security patches applied as soon as they are released. What matters more than cadence is that updates are tested on a staging copy first and that someone checks the critical paths, forms, checkout and login, afterwards. Ask for that check to be named in the plan.
What should I expect in a monthly report?
Updates applied and to what, backups taken and whether any were restore-tested, uptime and any incidents, security events, performance changes, and how much of the included change time was used. If the report is a single green tick, ask for the detail. Invisible work needs visible evidence.
How much change work should be included?
Enough to cover the small edits that would otherwise pile up: copy changes, a new page, an image swap. Two hours a month suits a stable brochure site; a business that publishes regularly or runs campaigns needs more. Check how unused hours are treated and what the rate is once the allowance is exhausted.