Website Maintenance Contract: What to Include (With SLA and Monitoring)

· 6 min read

If your maintenance contract only says "maintenance and technical support" for a fixed monthly amount, you've already written the reason a client will sooner or later try to cut it. Not because the work you do isn't worth that amount — it almost always is worth more — but because the contract doesn't say what they're buying. A single, generic line is the first item to disappear when the client reviews the budget: they don't know what they'd lose, so they have no reason to keep it.

Why "maintenance" written like that is the first thing to go

At the annual renewal, a client who sees a single line compares it with the only reference they have: the cost of hosting, which is often ten times lower. It isn't a fair comparison — hosting doesn't update plugins, doesn't run backups, doesn't tell you when the site is down — but it's what people do when they have no other way to judge. The problem isn't the price: it's that the contract never gave them the items to judge it by.

The fix isn't writing more text. It's splitting the single line into named items, each with a stated reason to exist.

The four families of items a serious contract separates

Almost everything that falls under "maintenance" for a website groups into four families:

Technical updates. CMS, plugins, themes, dependencies. It's the most invisible work of all: if you do it well, the client notices nothing — which is exactly why it needs to be named explicitly, not taken for granted.

Backups. Regular copies, with a stated retention policy (how many days back you can go) and, ideally, a restore test done at least once, not just promised.

Security. Monitoring for known vulnerabilities, security updates prioritised over feature updates, handling of any incident (a compromised site, malware).

Monitoring and SLA. The part this article is about: knowing whether the site is up or down, how quickly you find out, and what happens after you find out.

Separating these four families into distinct lines of the contract — even just as a bulleted list under the "maintenance" heading, if you don't want to invoice them separately — changes the perception: the client no longer sees an undifferentiated fixed cost, they see four jobs with a name each.

What to write for each item (without legalese)

You don't need a law-firm contract to be clear. Simple, verifiable sentences that say what actually happens are enough:

Technical updates. We check and apply CMS, plugin and theme updates on a [monthly/weekly] schedule. Critical security updates are applied within [48 hours] of their release.

Backups. Full site backup on a [daily] schedule, kept for [30] days. On request, we restore a previous copy within [1 business day].

Security. We monitor known vulnerabilities in the installed components. If the site is compromised, we step in within [stated time] to secure it and to inform the client.

What they have in common: every sentence has a number or a time, not an adjective ("regularly," "promptly"). A number can be checked, an adjective can't — and that's exactly the difference that makes a contract credible rather than just generically reassuring.

Monitoring deserves its own item, not a line inside the others

Of the four families, monitoring is the one most worth separating, for a practical reason: it's the only one the client can see working, rather than just trusting that it happens. A backup is never seen, if all goes well. Neither is a security update. Monitoring, on the other hand, produces something tangible — a status page, an uptime history, an alert that arrives before an angry phone call — and that something justifies the price better than any paragraph of contract.

Hiding it inside an undifferentiated "maintenance package" means throwing away the one item that proves itself.

What never to promise (if you're an agency of 3-15 people)

This is where many contracts write cheques they can't cash, usually by copying the language of an enterprise host:

The right promise for a small agency works on three distinct, honest levels: detection time (how quickly you know), first response time to the client (how quickly you write to them, not how quickly you fix it), and the stated intervention time with your real coverage hours. Detection is the easiest promise to keep with a tool — and the hardest by hand, because it requires someone to check the site at the exact moment it goes down. The three times, with an example paragraph ready to adapt, are written out in full in the article on what to promise in an SLA.

A sample contract line for monitoring

Monitoring and alerting — €15/month Continuous checks on the site's availability from multiple independent locations, with confirmation before an alert is generated. Email notification within 60 seconds of a confirmed outage. SSL certificate expiry reminders at 14, 7 and 1 days. Public status page, with the agency's branding, available to the client at any time.

With twelve clients on this item, that's €180/month in revenue. If the tool you use to deliver it costs €59/month, it pays for itself with four clients — from the fifth onwards it's margin, with no work beyond the initial setup for each new site.

Make it real, not just written down

A contract line only holds up if something is actually working behind it: continuous checks that don't depend on someone at the agency remembering, multi-location confirmation before alerting (a false alarm sent to a client costs more credibility than the item earns on the invoice), and a status page the client can open without having to call you.

Building it in-house, site by site, works for a few clients; beyond about ten it becomes the very work you were trying to sell, not the work you really want to be doing. That's exactly the problem Statuo solves: monitoring from multiple locations with cross-confirmation, a status page with the agency's branding, an alert within a minute of the outage being confirmed — ready to resell with the contract line described above, without building it from scratch. The free trial lasts 14 days, no credit card required.

Web Agency SLAs: What to Promise Clients (and What Not To)

How to write an SLA a small web agency can actually keep: why you shouldn't promise uptime percentages, and the three response times to commit to instead.

How to Add Uptime Monitoring to Your Maintenance Fee (Without Devaluing the Service)

How to sell uptime monitoring as its own line in your website maintenance fee: what to charge and how to pitch it without it looking like a hidden price hike.