Website maintenance contract: what should it include for your site and app?

A website maintenance contract sets out what your provider commits to after launch: updates, backups, monitoring, fixes and improvements, with measurable response times. It applies to mobile apps too. Well drafted, it protects your security, your visibility and your independence.

Why is maintenance not optional?

A website relies on a CMS, plugins, a server-side language and certificates that keep changing:

• Security: vulnerabilities in CMSs and plugins are fixed through updates; without them, the site stays exposed.
• Compatibility: every PHP version reaches end of support; according to php.net, PHP 8.2 stops receiving security fixes after 31 December 2026. On mobile, since 28 April 2026 Apple has required apps submitted to the App Store to be built with Xcode 26, and since 31 August 2026 Google Play has required new apps and updates to target Android 16.
• Continuity: under the schedule adopted by the CA/Browser Forum, the maximum lifetime of SSL/TLS certificates fell to 200 days in March 2026 and will drop to 47 days in 2029, so renewal must be automated and monitored.
• Performance and SEO: slow pages, errors or a hacked site damage both user experience and search rankings.

The four types of maintenance

Inspired by the ISO/IEC 14764 standard, this classification helps separate what the fixed fee covers from what is billed on top.

Type	Purpose	Examples
Corrective	Fix a malfunction	Form no longer sending, error page
Preventive	Avoid outages and vulnerabilities	Updates, backups, monitoring
Adaptive	Keep up with the technical environment	New PHP, iOS or Android version, store requirements
Evolutive	Improve or add features	New page, payment module, CRM connector

What should the contract include?

Scope

Websites, apps, environments (production, staging) and third-party services covered, stating whether hosting is included.

Updates

CMS core, plugins, themes, PHP version and dependencies, tested on staging before going live. For apps: compatibility with new iOS and Android versions, compliance with store requirements and crash monitoring.

Backups

Frequency, an off-site copy with another provider, retention period and regular restore tests. A backup that has never been restored is only a hypothesis.

Monitoring

Uptime with alerts, malware detection, SSL certificate and domain name expiry dates: a forgotten renewal can take down both the website and email.

Service levels (SLA)

Distinguish response time (work begins) from resolution time (service restored, with a workaround if needed), counted in business hours or 24/7. The table below is an example to negotiate, not a standard:

Severity	Example	Response	Resolution
Critical	Site down, payments blocked, site hacked	Within 1 business hour	Within 4 business hours
Major	Key feature impaired (quote form, customer area)	Within 4 business hours	Within 2 business days
Minor	Display glitch, limited impact	Within 1 business day	Next scheduled release

An availability commitment, such as 99.9% per month (about 43 minutes of downtime), depends on the host: it only makes sense if your provider also hosts the site.

Included hours and improvements

Hours included per month or year, rollover of unused hours, the rate beyond that and the quotation process for new features.

Reporting

A monthly or quarterly report: updates applied, incidents, backups checked, measured uptime, recommendations.

Ownership, documentation and reversibility

Domain name, hosting, Apple Developer and Google Play Console accounts, source code repository: everything must be in your name, with your own admin access. The contract should require up-to-date documentation and, when it ends, the handover of code, access and backups within a set timeframe.

Data protection

A provider with access to personal data acts as a processor: set out its confidentiality, security and breach notification obligations. If the GDPR applies to your processing (customers in the European Union, for example), its Article 28 makes such a contract mandatory; also consider Tunisian law.

Red flags

• No written response times.
• Domain name, hosting or store accounts in the agency’s name, with no admin access for you.
• Backups stored on the same server and never tested.
• Unlimited maintenance with no defined scope.
• No exit or reversibility clause.

Questions to ask before signing

• Who does the work, during which hours, and how do you report an incident?
• Are updates tested before going live?
• Where are backups stored, and when were they last tested?
• How do you get your code, access and data back when the contract ends?

FAQ

What is the difference between a warranty and maintenance?

The warranty covers, for a period set in the development contract, the fixing of defects present at delivery, at no extra cost. Maintenance then takes over on an ongoing basis: updates, monitoring, adaptations, improvements.

How often should a website be backed up?

In line with how often it changes: daily for an online shop, weekly for a stable brochure site, and always before an update. The 3-2-1 rule (three copies, two media types, one off-site) remains a good benchmark.

Can you switch maintenance providers?

Yes, if you hold the access, code and documentation. Plan a transition period during which the outgoing provider hands over backups and history to the new one.

Does a small brochure website need a maintenance contract?

Yes, even a light one. A brochure site on a CMS also receives security patches, and an expired certificate or domain name makes it unreachable. A plan limited to updates, backups and monitoring is often enough.

Hand your website maintenance to Uteek

Uteek maintains websites and apps: security updates, backups, monitoring, fixes and improvements. You remain the owner of your site, domain name and access. For mobile apps, we handle updates for new iOS and Android versions and crash monitoring. Explore our web development services or tell us about your website.