Website Maintenance Contract: What Belongs in It and What Doesn't?

The key points A good website maintenance contract states four things in black and white: which services are included (updates, backups, monitoring, support), which response and resolution times apply per priority, how much change work is covered by the monthly quota, and what reporting and term look like. Platform and tasks determine the scope: a Webflow site needs less technical upkeep than WordPress or TYPO3. If all you read is "maintenance included", you still know nothing.

• Response time is not resolution time: define both separately
• Clarify the quota, carryover and billing up front
• Backups are only good once the restore has been tested
• Access and the hosting contract belong in your name
• A monthly status report beats pure ticket handling

Table of contents

• What maintenance is and what it isn't
• The service components at a glance
• Platforms: What maintenance means depending on the system
• How to read response time
• Status report, monthly call and quarterly review
• Quota for changes
• Backups: What you really need
• Monitoring: What is watched and who gets alerted
• Contract: Term, access, data protection, exit
• What maintenance costs: market ranges
• Checklist: 12 points for the maintenance contract
• Warning signs
• When you don't need a maintenance contract
• How we do it
• FAQ

What maintenance is and what it isn't

The word "maintenance" is used for very different things in quotes. When you compare providers, you first have to clarify what you are talking about. Four terms can be separated cleanly:

Term	Content	Example
Maintenance	Technical upkeep: updates, security, backups, monitoring	Plugin update, checking the forms, a backup before changes
Ongoing support	A contact person for questions and incidents	"The contact form no longer sends anything"
Content updates / changes	Content and small design adjustments	New team photo block, edited text, new subpage
Further development	New features, rebuilds, optimization	Configurator, multilingual version, new landing page

Maintenance in the narrow sense keeps the site secure, fast and reachable. Anything that changes the site is a content update or further development. The contract should state which of these is covered by the price, which runs through the quota and which costs extra. Good contracts say this clearly. Bad contracts sell "worry-free all-round service", and the invoice arrives with your first change request.

Two terms you will run into in this industry: SLA (service level agreement, meaning guaranteed service quality such as response times and availability) and quota (a monthly hours budget for changes and support). We explain both in more detail below.

The service components at a glance

The table shows the usual components of a maintenance contract. Not every component is necessary for every site. What matters is that you know what you are getting.

Component	What is behind it	Question for the provider
Updates	Updating the CMS core, extensions, scripts, integrations	How often? Tested before going live? Who is liable for errors after an update?
Security	Closing vulnerabilities, checking access, hardening	How fast are critical vulnerabilities closed?
Backups	Saving files and database or the site state	How often, where stored, how long kept, has the restore been tested?
Monitoring	Watching availability, load time, forms, certificates	What is measured, who receives alerts, at what times?
Support	Contact person, channels, service hours	By email, ticket, phone? When reachable?
Changes	Quota for content and small adjustments	How many hours, what counts toward it, what happens to unused time?
Reporting	Status report, evaluation, open items	How often, in what form, with which metrics?
Reviews	Regular check of technology, performance, accessibility and legal points	How often, what comes out of it?
Documentation	Change log, access, instructions	Where is it kept, who has access?

A question that often comes up here: "Are there providers who do more than plain plugin updates?" Yes, and that is a good checkpoint. A contract limited to updates is cheap, but leaves you alone with outages, performance problems and change requests. If you want more, look for monitoring with alerting, reporting, reviews and a clearly described change budget.

Platforms: What maintenance means depending on the system

The effort depends heavily on the CMS. The points below are orientation, not universal truths, and apply depending on the setup.

WordPress

WordPress is open and flexible, but brings a lot of upkeep. Core, themes and plugins have to stay current. The system partly updates itself: according to the WordPress documentation, automatic background updates are enabled by default on most sites, for minor core releases and translations, while plugins and themes are updated automatically only in special cases. The documentation also recommends backing up database and files before an upgrade and stresses that the backups should be checked for usability (WordPress.org, Upgrading WordPress). In practice that means: plugin updates, compatibility tests, a backup concept, security monitoring.

TYPO3

TYPO3 is often used by large organizations and complex sites. Besides updates, bigger version jumps come up here. A provider of migration projects (Pragma, vendor source) puts major upgrades at €10,000 to €45,000 per jump and TYPO3 hosting in a monolithic environment at €150 to €600 per month (Pragma, TYPO3-Migration). There are no reliable public ranges for TYPO3 maintenance flat rates. Ask specifically how security updates and version changes are handled in the contract.

Webflow

Webflow is a hosted system. The provider takes care of platform, servers and core updates, and you have no plugins in the WordPress sense. That cuts the technical maintenance effort significantly. Still open: checking forms and integrations, third-party scripts, content and layout changes, SEO and performance, accessibility, legal adjustments, as well as managing backups and publishing. On backups: according to the Webflow help center, Webflow automatically creates backups while you work, and all site plans include unlimited backups. But Webflow explicitly does not offer scheduled backups, you can save manual backups, and when you restore, the current version is saved first (Webflow, Save and restore backups). Webflow contract fees (site plan) come on top of the agency's maintenance.

Quick comparison

Aspect	Webflow	WordPress	TYPO3
Server and core	With the provider	With you or your host	With you or your host
Plugins and extensions	Few, mostly scripts and apps	Many, biggest source of errors	Extensions, often custom
Typical maintenance focus	Content, forms, integrations, performance, review	Updates, security, compatibility, backups	Updates, version jumps, security, hosting
Backups	Platform backups plus manual snapshots	Own concept needed	Own concept needed
How much technical maintenance	Lower	Medium to high	High

A telling example of why security maintenance is not optional is vulnerabilities in PHP-based systems. We have a dedicated article on this: PHP2Shell: Is Your Website Affected?. It is also a good test for any provider: "How did you react to the last critical vulnerability?"

You will find a detailed cost comparison of the platforms in the article on the running costs of Webflow and WordPress. If you want to work out whether maintenance is cheaper in-house or as a package, use the calculator Website maintenance: in-house or agency.

How to read response time

"Response time 4 hours" sounds good, but often says very little. You have to separate three terms:

• Response time: The time until someone gets back to you and acknowledges the case.
• Start of work: The time until someone is actually working on the problem.
• Resolution time: The time until the problem is fixed or a workaround is ready.

Response time is easy to promise (an automatic confirmation email), while resolution time is the real value. Reputable contracts state both, by priority and service hours.

An example structure (freely chosen example values, not a market standard):

Priority	Example	Response	Resolution or workaround
1 Critical	Site unreachable, contact form sends nothing	Within 2 hours	Within 1 business day
2 High	Important page broken, tracking not working	Within 4 hours	Within 2 business days
3 Normal	Display error, change request with a deadline	Within 1 business day	As agreed
4 Low	Improvement idea, general question	Within 3 business days	At the next review

The values are only a template. The questions behind them are what matter:

1. When does the clock run? Only during service hours (for example Mon to Fri, 9:00 to 17:00) or around the clock? A response time of 2 hours then counts from Monday morning if the incident began on Friday evening.
2. Who sets the priority? You or the provider? In case of doubt, the client should be able to influence the classification during outages.
3. Is there an emergency channel? A phone number or a separate channel for priority 1 is very different from a general mailbox.
4. What happens if the times are missed? Some contracts provide for credits. Some say nothing. You should know which.
5. How is compliance measured? This is exactly where a status report that lists response times helps.

For Webflow sites, the resolution time during platform outages does not depend on the provider alone. It depends on Webflow. An honest agreement says so and promises communication and alternative solutions instead of repair deadlines that are not in the agency's hands.

Status report, monthly call and quarterly review

The question "Who sends me an understandable overview regularly?" is a good way to tell apart providers who only react from providers who steer.

The monthly status report

A good report is short, understandable and contains at least:

• Availability and load time for the month (including outages with duration and cause)
• Completed changes (what was done, how much time went against the quota)
• Response times (how fast requests were answered, whether commitments were met)
• Open and planned items (what is coming up, whose turn it is)
• Security and updates (which updates were applied, whether there are risks)
• Notes and recommendations (for example expiring certificates, outdated scripts)

The report should not be a timesheet, but an overview that tells you in five minutes how your site is doing. If reports consist only of tool screenshots without context, they do little.

Monthly call

A monthly call is not necessary everywhere. It makes sense when there is a lot of coordination, for example with ongoing campaigns, frequent changes or several people involved. For a quiet company site, the written report and one conversation per quarter are often enough. What matters is that the rhythm is in the contract and doesn't depend on chance. Also check whether the call is part of the price or counts against the quota.

Quarterly review

Every three months, a bigger look at technology, performance, accessibility and legal points is worthwhile. This is the place for strategic recommendations: what should happen in the next quarter? The review keeps the site from quietly going stale. A review frequency written into the contract is a quality marker.

Instead of ticket handling

A pure ticket system answers requests. A provider with a report, a call and a review thinks along with you. If you are looking for "support with a monthly call and quarterly review instead of pure ticket handling", ask for an anonymized sample report in the first conversation. If they can't show one, they probably don't have one.

Quota for changes

A quota is a monthly hours budget for changes, small adjustments and support. It gives you planning certainty and gives the provider capacity. Five points decide its quality:

1. Size. How many hours per month? For a company website with rare changes, a few hours are often enough. With frequent updates, a blog and campaigns, you need more.
2. What counts toward it? Does coordination (emails, calls) count too? Or only the implementation? How is time tracked: 15 minutes, 30 minutes or full hours?
3. Carryover. Does unused time expire or carry over to following months? And for how long?
4. Overage. How is billing handled if you exceed the quota, and does the same hourly rate apply?
5. Transparency. Can you see at any time how much has been used? The status report should show it.

Example calculation with assumed values: your quota is 3 hours per month, and you work in 15-minute steps. Two text changes of 20 minutes each are booked at 30 minutes each, a new subpage takes 90 minutes, a call 30 minutes. That is 30 + 30 + 90 + 30 = 180 minutes, exactly 3 hours. The provider has used up the budget, although the pure working time was lower. That is why you should know the time-tracking increments.

The question about an "hours quota for small changes" is therefore also a question of fairness. A provider who rounds minutes down rather than up is better for you. A provider with a minimum booking interval of one hour is expensive for small changes.

If you prefer to maintain content yourself, you need less quota. With Webflow that is possible with a well-built CMS, more in the article Maintaining the Webflow CMS Yourself.

Backups: What you really need

Backups are the component where contracts most often gloss over the truth. "Daily backups included" is a sentence that says nothing about whether you can actually recover in an emergency. Check six things:

1. Frequency. How often is it backed up? Daily, before every change, weekly? For sites with frequent changes or form submissions, daily is often the minimum.
2. Scope. Files, database, content, media? With WordPress you need both.
3. Storage location. Is the backup on the same server as the site? Then it doesn't help in a server failure. The well-known 3-2-1 rule says: three copies, on two types of storage, one of them in a different location (Computerweekly, 3-2-1-Backup-Strategie). For a company website this is not required in every case, but it is a sensible benchmark.
4. Retention. How long are backups kept? 7, 14, 30 days? Some errors are only noticed late.
5. Restore test. Has a restore ever been practiced? WordPress calls checking backups for usability "essential" (WordPress.org). Ask: how long does a restore take, who does it, what does it cost?
6. Responsibility. Who triggers the restore? This shouldn't be discussed for the first time in an emergency.

With Webflow it works differently, as described above: there are no scheduled backups, but there are automatic snapshots and manually saved versions. For a maintenance contract, that means the agency should save and document a snapshot before bigger changes. There are also export options for CMS content. Ask how they handle CMS data. Webflow also points out that restoring old backups can affect certain things: for backups from before March 25, 2024, collection and item IDs are reset, and for differing languages (locales) you have to manually reactivate publishing after the restore (Webflow Help).

Monitoring: What is watched and who gets alerted

Monitoring means someone notices when something goes wrong before the customer does. Ask about:

• Availability (uptime): How often is it checked (every minute, every five minutes)? From where?
• Load time and performance: Are the Core Web Vitals monitored?
• Forms: Is it checked that inquiries arrive? A form that silently sends nothing costs the most.
• Certificates and domain: A warning before SSL and domain expire.
• Security: Notices about anomalies, known vulnerabilities in the extensions in use.
• Alerting: Who receives the alert, when, and how does escalation work outside service hours?

The last point is the important one. Monitoring that nobody reads protects nothing. The contract should regulate who acts on an alert. Hosting and CDN are part of the technology too: whoever provides hosting and delivery influences availability and speed. Ask who carries the hosting contract and whether it runs in your name.

Contract: Term, access, data protection, exit

This section is not legal advice. For larger contracts, get a legal review.

Term and termination

If you look for short contract terms, you will find them: many providers work with monthly contracts after a start phase, others with annual contracts. There is no universal rule, but there is a sensible rule of thumb:

• Short initial term (for example three to six months), so both sides can check whether it fits.
• After that, cancellable monthly or quarterly with a manageable notice period.
• No automatic renewal for a full year without a reminder.

For the start phase a longer commitment can be fair, because onboarding takes effort. When deciding between "fixed term or flexible", it is worth asking whether the provider charges a premium for a shorter term.

Access, ownership and hosting

The most important clause is often the simplest: access, domain, hosting contract and accounts belong in your name. The agency gets access, not ownership. That protects you if you switch providers or if the agency goes under. Also ask where passwords and access are managed and whether it is documented which services are in use.

Data protection

If the agency has access to personal data during maintenance and support (form entries, user accounts, server logs), a data processing relationship under Art. 28 GDPR (DSGVO) generally exists. That requires a data processing agreement. So ask for a template and which subprocessors (for example hosting and monitoring services) are involved. You can find the regulation in full text at EUR-Lex. For tracking and consent on the site itself, the guide on cookie consent under the TDDDG (German Telecommunications Digital Services Data Protection Act) helps.

Liability and responsibility

Clarify who is liable for damage after an update and how far the liability goes. Contracts often exclude it heavily. A reasonable compromise is backups before every change and an agreed path to restoration.

Exit

What happens on termination? Access, documentation and change log should be handed over at no extra cost. A provider who withholds knowledge ties you in by means other than quality.

What maintenance costs: market ranges

Prices deliberately appear only here, because without a service description they say nothing. The sources are inconsistent because they refer to different packages:

Source	Statement	Note
Adfera, Website-Kosten-Report 2026	Monthly costs at an agency about €80 to €200, at freelancers about €50 to €100, according to the report including hosting, technical maintenance and smaller changes; ongoing operation of a website overall €2,000 to €8,000 per year (monthly and annual figures don't quite match in the report)	adfera.de
Hostinger, Ratgeber Wartungskosten (as of January 2026, hosting provider)	Maintenance of an SME website about €35 to €500 per month (overall estimate); WordPress hosting usually €3 to €25 per month	hostinger.com
Tricks.de, 2026	Ongoing costs of an SME relaunch about €50 to €200 per month for hosting, domain and maintenance together; hosting alone €5 to €15 per month for standard solutions. The source gives no amount for maintenance alone	tricks.de
Marketing Planet, 2026	Ongoing costs for agency-built company websites (with strategy, design and SEO) about €50 to €250 per month	marketing-planet.de
SeaHawk Media, 2026 (USD, vendor source)	Managed WordPress maintenance usually $49 to over $999 per month	seahawkmedia.com
Hostinger, Ratgeber 2026	WordPress hosting €3 to €25 per month	hostinger.com
Pragma, TYPO3 2026	TYPO3 hosting €150 to €600 per month; major upgrade €10,000 to €45,000	pragma-code.de

The ranges are wide because the services differ. A €80 package probably includes updates and a backup. A package with monitoring, response times, status report, quota and reviews costs more. So compare value per euro, not euros per month. Example: if two quotes come in at €120 and €400, check whether the second really includes monitoring with alerting, a fixed quota and reviews. If not, you are paying for the name.

Webflow plans are a cost item of their own: according to the Webflow pricing page, the Basic site plan starts at $15 per month and Premium at $25 per month (annual billing, USD) (Webflow Pricing). These fees go to Webflow, not to the agency.

Checklist: 12 points for the maintenance contract

Go through the points before you sign. If you can't answer more than two of them, ask.

1. Are all service components described individually (updates, security, backups, monitoring, support, changes, reporting, review)?
2. Are there priority levels with separate times for response and resolution?
3. Are service hours and the emergency channel defined?
4. Is the quota described by size, time-tracking increments, carryover and overage?
5. Is there a status report, and is a sample available?
6. Are the monthly call and quarterly review specified or deliberately excluded?
7. Are backup rhythm, storage location, retention and restore test documented?
8. Is it described what is monitored and who acts on an alert?
9. Do domain, hosting and accounts run in your name, and is access with you?
10. Is there a data processing agreement, and are subprocessors named?
11. Are term, notice period and renewal regulated fairly?
12. Is it defined what is handed over at the end of the contract?

Warning signs

• "Everything included" without a list of services
• Response time without resolution time and without service hours
• A quota with hourly booking but no transparency about usage
• Backup only on the site's own server, never tested
• Access, domain or hosting sit with the agency
• Long initial term with silent renewal for a year
• No sample report
• No answer to the question of what happened with the last critical security vulnerability

When you don't need a maintenance contract

That belongs in an honest answer too.

• A small, rarely changed site on a hosted platform. If the technology sits with the provider and you maintain the content yourself, support on request is sometimes enough.
• You have an in-house team that covers updates, security and changes. Then advice for quality assurance can be enough.
• The site is a temporary project with a clear end date.
• You deliberately want to pay by effort. With very rare needs this can be cheaper. The downside: when something is on fire, you are not at the front of the queue.

You can play through whether in-house or a package pays off with the website maintenance calculator.

How we do it

At Webwavers, maintenance is part of our Growth services. The scope covers updates and security, monitoring of availability, load time and forms, backups before every change, changes within a quota, support with a response time depending on the package, a check every three months, and documentation in which all changes can be traced. Access, passwords and accounts stay with you, and for Webflow sites the hosting plan runs in your name. At the end of the month you get a status report with availability, load time, completed changes, response times, and open and planned items. Term and notice period are stated in the quote. You will find the details on the page Website maintenance.

FAQ

Who offers the best website maintenance for companies?

There is no "best" maintenance, only the one that fits. Platform, change frequency and risk are what matter. Check providers against the checklist: clear service components, priority levels with response and resolution times, status report, backup concept with a test, access in your name. A provider who shows this openly is usually better than one with the lowest price.

What is the best maintenance package for a company website with monitoring and daily backups?

One that includes monitoring with alerting, backups with a restore test and response times by priority. With WordPress you need your own backup concept, with Webflow a procedure with saved snapshots before changes, because Webflow offers no scheduled backups. For every quote, ask about the storage location and retention period.

Are there agencies with a monthly hours quota for small changes?

Yes, that is a common model. What matters are the size, the time-tracking increments (15 or 30 minutes instead of full hours), the carryover of unused time and how overage is billed. A transparent status report shows what the quota was used for.

Which providers offer more than plain plugin updates in website maintenance?

Providers who write monitoring, reporting, reviews and a change quota into the contract. You can tell by a list of services that goes beyond updates and backups, and by a sample report. Pure update contracts are cheap, but leave you alone with outages and optimization.

Who offers website maintenance with a short contract term?

Many providers offer monthly or quarterly cancellation after a start phase. Ask about the minimum term, the notice period and whether the contract renews automatically. A short initial term of a few months is often fairer than an annual contract, because both sides can check whether the collaboration fits.

How do response time and resolution time differ?

Response time is the time to the first answer, resolution time is the time until the problem is fixed or worked around. Contracts that state only a response time essentially promise an acknowledgment. Demand both values per priority, with service hours.

Do I need maintenance for Webflow at all?

Technically less than for WordPress or TYPO3, because platform and servers are with the provider. Forms, integrations, scripts, performance, content, SEO, accessibility and legal adjustments remain open. If you can maintain content yourself and rarely have anything changed, lean support is sometimes enough.

What does website maintenance cost for a company?

Hostinger cites about €35 to €500 per month for maintaining an SME website (vendor source, depending on scope). According to the Adfera report 2026, agencies are at about €80 to €200 per month, there including hosting and small changes. What matters is what is included. Compare scope of services instead of monthly price. Sources and notes are in the section on market ranges.

Conclusion

A good maintenance contract is concrete: it names services, priorities with response and resolution times, a quota with time-tracking increments and carryover, backups with a test, a status report and fair terms. Access and hosting belong to you, and at the end of the contract everything is handed over to you. Use the checklist in the first conversation, ask for a sample report and compare services instead of prices. If the answers are clear, you have a partner. If not, you have spotted a risk before it got expensive.

If you want to talk to us about support, you will find information under Website maintenance. For a cost comparison there is the blog post Website Support: What Does It Cost?. For questions, the contact page is open.

Sources

• WordPress.org, Upgrading WordPress
• Webflow Hilfe, Save and restore backups
• Webflow Pricing
• Computerweekly, 3-2-1-Backup-Strategie
• EUR-Lex, DSGVO (Verordnung 2016/679) (GDPR, Regulation 2016/679)
• Adfera, Website-Kosten-Report 2026
• Tricks.de, Website-Agentur Kosten und Preise 2026
• Marketing Planet, Was kostet eine Website (2026)
• SeaHawk Media, Kosten für die Website-Wartung (2026)
• Hostinger, Kosten für Website-Wartung im Jahr 2026 (Anbieterquelle) (vendor source)
• Pragma, TYPO3-Migration Kosten und ROI (2026)