Website Maintenance Contract and SLA: What Should It Include?

A website maintenance contract should lock down at least four things: what is being maintained, how fast someone responds, who owns what, and what happens when you leave. The short version: a good contract describes the scope (updates, backups, security, small changes), ties an SLA to it with response times and uptime, settles ownership of your code, content and accounts, and includes a clean exit. A weak contract leaves exactly those points open, and you pay for that later with downtime, surprise invoices or a site you cannot take with you.

In this article you get a checklist of what belongs in it, which support levels are common, and the pitfalls B2B companies run into most often. The starting point is practical: you want a site that keeps running and keeps converting, without being tied to your supplier. If you want to read more broadly about having a site built and managed, start with our B2B website guide.

What exactly is a website maintenance contract?

A website maintenance contract is the agreement that governs how your site stays working, secure and up to date after launch. A website is not a one-off project but a living system: software ages, plugins get updates, browsers change and attackers constantly probe for weak spots. Without maintenance you fall behind on security, your site gets slower and small defects pile up into a big problem.

The contract makes explicit what would otherwise stay implicit. It describes who is responsible for updates, who responds when something breaks, and within what timeframe. The difference with a loose “we’ll take a look at it” is that you have rights and deadlines instead of goodwill. For a business-critical site that brings in leads, that is the difference between a few hours and a few days of downtime.

What should the scope include at a minimum?

The scope is the heart of the contract and should be concrete, not “general maintenance”. A complete scope typically covers these components:

• Software and plugin updates: keeping the CMS, themes, plugins or packages up to date, tested before they go live.
• Security: monitoring, patches for known vulnerabilities, and agreements about what happens in case of a hack or malware.
• Backups: how often a backup is made, where it is stored, how long it is kept and, more importantly, how quickly a backup can be restored.
• Uptime monitoring: actively watching whether the site is reachable and stepping in when it goes down.
• Performance: keeping an eye on the site staying fast. Slow loading times cost you conversions, so do not leave agreements about Core Web Vitals out of the picture.
• Accessibility: checks that updates do not introduce new barriers. Avoid the well-known accessibility mistakes, especially now that the requirements around this are getting stricter.
• Small content changes: editing text, adding a page, adjusting a form.
• Reporting: a periodic overview of what has been done and what the site is doing.

Above all, make clear what is not included. A new landing page, a redesign or a connection with your CRM is often extra work. That need not be a problem, as long as it is clear up front instead of afterwards on your invoice.

What is in an SLA and which levels exist?

An SLA (Service Level Agreement) firmly locks down the promised service levels: response times, resolution times, uptime and availability. Where the scope says what gets done, the SLA says how well and how fast. That is precisely the part that often sounds better spoken than it turns out on paper.

The core of an SLA consists of a few elements:

• Response time: within how much time you get a first reply after a report. Note: response time is not the same as resolution time.
• Resolution time or target time: within what timeframe a problem is solved or worked around, often depending on severity.
• Priorities: a distinction between a site that is completely down and a button that is misaligned. They should not get the same urgency.
• Availability: only during office hours or also outside office hours in case of an emergency.
• Uptime: the percentage of time your site should be reachable. A common norm for business sites sits around 99.9 percent, which comes down to a limited amount of downtime per year. The higher the guarantee, the more expensive, so match this to how critical your site is.

In terms of support levels, you usually see three flavours in practice. A basic level covers updates, backups and security with a response during office hours, suitable for a site that is important but not business-critical. A mid level adds faster response times, a fixed budget of hours for changes and better monitoring. A premium level offers short guaranteed response times, wider availability and proactive thinking about improvements. Choose honestly: a plumber does not need a premium contract, a SaaS company whose lead flow runs entirely through the site often does.

What about hour bundles and extra work?

An hour bundle is a fixed number of hours per month or quarter for small changes, and that is exactly where most surprises hide. A bundle is handy because you do not have to request a quote for every small change. But the details determine whether it is fair. So ask a few questions before you sign.

Do unused hours expire at the end of the period, or may you carry them over? Many contracts let hours expire, which means you pay for capacity you do not use. What happens if you go over your bundle: does a rate agreed in advance apply, or a higher extra-work rate? And how is time logged and reported, so you can check where your hours are going? A bundle without transparent logging is a blank cheque.

Also be clear about the boundary between maintenance and new development. Editing text falls under maintenance. Building a completely new section or a website migration belongs to project work with its own quote. A contract that leaves that boundary vague often ends in discussion.

Who owns your website, code and accounts?

Ownership is the pitfall that is least visible and hurts the most. You pay for a site, but that does not automatically mean everything is yours. So set out explicitly who owns the source code, the design, the content and, just as important, the accounts and domains around it.

Concretely, these things should be in your name or accessible to you: your domain name, your hosting, your CMS licences, your analytics, and the logins of third-party services. Too often the domain is registered in the supplier’s name, or only the agency has access to the hosting. That seems innocent until the collaboration ends and you cannot take your own site with you. Also ask whether the site is built on standard technology or on the agency’s own, closed system. The latter makes you dependent: no one else can pick it up.

The principle is simple: you should have the keys to your own house. An honest agency makes sure you are and stay the owner, even if you were ever to leave.

What should the exit clause contain?

An exit clause describes what happens when the collaboration ends, and its absence is a red flag. Nobody signs a contract intending to leave, but that is exactly why a good exit tests how fair the agreement is. An agency that is confident in its work makes leaving easy.

Watch these points:

• Notice period: how far in advance you have to cancel, and whether you do not unintentionally roll over silently into a long renewal.
• Handover: do you receive all files, code, content and access neatly transferred, and in what form?
• Cooperation with migration: does the agency help with the switch to another party, and at what rate?
• No hostage-taking: there should be no technical or contractual constructions that withhold your site or data until you pay.

A clean exit protects you against the scenario where you are stuck with a party that no longer delivers. It is, together with ownership, the part you may look at most sharply.

The short summary

A strong website maintenance contract covers scope, a concrete SLA with response times and uptime, clear ownership of code and accounts, and a fair exit. The pitfalls sit in vague hour bundles, unclear ownership and a missing exit clause. Match the support level to how business-critical your site is, and get everything that is promised verbally put on paper too. That way your site keeps running, secure and yours, and keeps delivering leads instead of problems.

Do you want your site to keep performing and converting after launch, without surprises in the small print? Take a look at our web design agency or plan your free intake and we will look together at what fits your situation.