At a glance
- Maintenance covers updates, closing security vulnerabilities, backups, monitoring and small changes.
- A contract defines scope, deadlines and responsibilities instead of relying on ad-hoc requests.
- What matters are fixed deadlines for critical vulnerabilities, tested restores and defined response times.
- Access, source code and data belong to the company; switching providers has to be possible at any time.
Why maintenance is necessary
Content management systems like WordPress, ecommerce systems and their extensions get updates all the time, many of them closing security vulnerabilities. Programming languages like PHP retire older versions on fixed schedules. Certificates expire, browsers change their behaviour, and new rules such as the European Accessibility Act call for adjustments. Without upkeep, the risk grows every month.
What a maintenance contract should cover
- Updates
- A fixed cadence, monthly for example, with testing before rollout
- Security vulnerabilities
- A deadline for critical vulnerabilities, such as 72 hours after disclosure
- Backups
- Daily, stored separately from the server, with a defined retention period
- Restore
- Tested regularly, with a known duration
- Monitoring
- Availability, load time, forms and certificate expiry
- Response times
- Tiered by severity, with availability hours
- Report
- Monthly: what was done, what is open
- Hours budget
- Hours for small changes, with a rule for unused hours
- Exclusions
- What is not included, such as new development or copywriting
- Data protection
- A data processing agreement under Art. 28 GDPR if personal data is processed
- Ownership
- Access, source code and data with the company, handover documented
The example values are common figures, not requirements. What matters is that every point is covered at all.
Backups and the 3-2-1 rule
A backup only counts once restoring it works. The 3-2-1 rule is widespread: three copies of the data, on two different types of storage, one of them in another location. For websites, that means in practice: daily backups of files and database, storage with a second provider and a test restore at fixed intervals.
Reading response time and uptime correctly
Response time means: within this time, someone starts working on it. Fixing the incident can take longer; some contracts name a separate resolution time for that.
Availability is usually stated as a percentage per year. 99.9 per cent mathematically allows just under nine hours of downtime a year, 99.5 per cent almost 44 hours. What matters is how it is measured and whether planned maintenance windows count.
The incident plan
An incident plan defines who is informed in case of an outage or attack, who decides and in which order systems are restored. It includes current contact details, emergency access, the last verified backup and a template for informing the people affected.
If personal data is affected, such as enquiries from a contact form, a personal data breach generally has to be reported to the competent supervisory authority within 72 hours under Art. 33 GDPR. A plan that knows this deadline saves the decisive hours when it counts.
Keeping maintenance and development apart
Maintenance preserves a state: the website stays secure, available and working. Development changes it: new pages, new features, a new form. A contract that separates the two makes costs predictable. A fixed monthly fee for maintenance plus an hours budget for small changes is common; larger projects are agreed separately.
Warning signs
- There is no written scope of service.
- Domain, hosting or ad accounts are registered in the provider’s name.
- Nobody can say when a restore was last tested.
- Updates are only installed when needed, without a report.
- Only the provider holds the login details.
Frequently asked questions
Does a simple website need maintenance at all?
Yes, if less. Even a statically served website has a domain, a certificate, forms and dependencies that need upkeep and monitoring. For websites with a content management system, an online shop or a customer area, the effort is considerably higher.
What happens when switching providers?
With complete documentation, access in the company’s name and source code in your own hands, a switch is a plannable handover. If any of these is missing, it quickly turns into a rebuild.
What ongoing operations include is described in the Operations module; the minimum values are in the tech specs.