Skip to content

Running a website

Website maintenance contracts — 7 red flags to walk away from

A buyer's read of the UK website maintenance contract — what should be in it, the seven clauses that signal walk away, and what £50-£300 a month buys.

Verithora 27 May 2026 8 min read

If you have just been emailed a renewal quote for £180 a month and you are not sure what you are paying for, this is for you. So is the owner quoted £49 a month who is wondering what the catch is. UK maintenance contracts vary widely in scope and honesty; the price band is wide because what sits underneath it is wide.

This is a buyer’s read of the contract. What should be in it. What is grey. The seven clauses that mean walk away. And a checklist to take into any conversation with a provider.

Why maintenance contracts exist (and what they’re really paying for)

A live website is not a finished object. The platform it runs on ships security updates every two to six weeks. Plugins and themes update on their own schedules. The SSL certificate renews, the domain renews, the backups have to actually exist and actually restore. Content goes stale, forms break silently, Google changes the rules.

A maintenance contract pays for someone to handle that work so the site does not quietly stop earning. The honest pitch is dry: insurance plus janitorial plus a slow stream of small jobs. The dishonest version sells “performance optimisation” at agency rates for what is, in practice, monthly plugin updates.

The non-negotiable inclusions

A maintenance contract worth signing names the following, in plain English:

  • Hosting — the platform the site runs on, the tier, and what happens if it goes down. Not “premium cloud hosting.” A specific provider and tier you can look up.
  • SSL certificate — handled, renewed, monitored. Free on most modern hosts via Let’s Encrypt; this should not be a £15 a month line item.
  • Backups — taken on a stated frequency, retained for a stated number of days, and restorable. A backup that has never been test-restored is not a backup.
  • Security updates — CMS core, plugins, themes, dependencies. Patched on a stated cadence (weekly is typical; monthly is the floor).
  • Uptime monitoring — someone is told when the site goes down, and that someone is not you. The Sucuri 2024 Hacked Website Report is the canonical data on what happens when this work is skipped.

If those five are missing from the contract you are reading, the document is a pricing sheet, not a contract.

The grey-area inclusions

These are the line items where reasonable providers disagree, and where most overcharging hides:

  • Content updates — copy edits, new pages, image swaps. “Two updates a month, up to 30 minutes each” is honest. “Unlimited within reason” is not.
  • Design tweaks — colour changes, layout adjustments, new sections. Usually billed by the hour if the contract is silent.
  • Support hours — how many hours a month of “anything else” are included. Stated bluntly is good. “As required” is a polite way of saying nothing.
  • SEO work — local listings, meta updates, schema. Either named and scoped, or it does not exist. “SEO optimisation included” with no detail is the polite version of “we will check Yoast is green.”

A grey-area inclusion is fine if it is named and scoped. It becomes a red flag if the contract says “included” without a unit.

The 7 red flags that mean walk away

These are the clauses the provider hopes you will skim. They are the difference between a fair £79 a month and a £180 a month bill that should be £40.

Red flag 1 — A 12-month lock-in with hostile exit terms

What it looks like: “This agreement runs for an initial term of 12 months, automatically renewing for further 12-month terms unless cancelled by recorded post no later than 90 days before the renewal date.” The exit window is narrow, the notice is high, and there is no monthly rolling option.

What fair looks like: monthly rolling, or 12-month with a written 30-day exit window and no off-boarding fee. Our 30-day money-back guarantee is the same idea: the relationship has to earn its renewal.

Red flag 2 — Vague SLAs and undefined response times

What it looks like: “We aim to respond to support requests in a timely manner during business hours.” “Timely” is not a response time, and “business hours” is not defined.

What fair looks like: “We reply to support emails within two working days, Monday to Friday, UK time.” A response time you can put a stopwatch on. Ours is two working days, written into the services page, the same number we tell prospects on the phone.

Red flag 3 — “From £” or “starting at” pricing

What it looks like: “Maintenance from £49 a month.” The price you actually pay is £49 plus the SSL line item plus the security plugin plus the per-update fee plus VAT.

What fair looks like: one price, all in. We charge £49 or £79 a month, full stop, and the pricing page lists what is and is not in each tier. Annual prepay drops the price 10 per cent. No second invoice.

Red flag 4 — No named contact, no human at the end of the email

What it looks like: the contract names “the Provider” throughout and the email address is support@. You will not know who is doing the work until something goes wrong, by which point the queue is in front of you.

What fair looks like: one named person who replies to your emails, with one back-up if they are off. The agency model where you get an account manager who forwards your message to whoever is free is the silent version of this red flag.

Red flag 5 — They own the domain, the hosting, or the content

What it looks like: the domain is registered in the provider’s name (not yours), the hosting is on a shared account you cannot access, and the content lives in a platform you cannot export. Cancelling means starting over.

What fair looks like: domain in your name, DNS readable by you, content exportable in standard formats (Markdown, JSON, CSV) on request, with a documented hand-over. This is the same question that decides whether you own a pay-monthly website at all.

Red flag 6 — “Unlimited” anything

What it looks like: unlimited updates, unlimited support, unlimited revisions. The word means one of two things: the provider expects you to ask for almost nothing, or they will redefine “reasonable use” the first time you take them at their word.

What fair looks like: a named quantity. Two content updates a month. One new page a month. Two working-day response. Numbers tell you what to expect; “unlimited” tells you the provider has not done the maths.

Red flag 7 — Hidden ancillary fees in the small print

What it looks like: clauses for “additional plugin licence costs at cost plus 20 per cent,” “domain admin fee,” “SSL renewal admin fee,” “annual review fee.” Each one is small. Together they can add 30 to 60 per cent to the monthly headline.

What fair looks like: the monthly fee is the whole bill. If something is genuinely extra (a new domain, a paid plugin the client chose), it is named at point of quote and charged at cost, not at cost plus.

What “support” actually means in the small print

Read the support clause word by word. “Support” can mean any of: replying to your emails, fixing things that break, making changes you request, or none of the above. A serious contract names what is included, how to invoke it, and how fast they respond, in one paragraph, in English. If you cannot summarise the clause in a sentence after reading it, it is doing work for the provider, not you.

Pricing reality — £50 to £300 a month is the UK range

The EdTheDev 2026 UK maintenance cost guide puts the small-business band at £25 to £100 a month; Respect Experts’ package guide puts the broader range at £50 to £300 a month. Both are observed market positions, not authoritative figures. The honest read of the band: £25 to £50 a month is maintenance only and assumes you do your own content; £50 to £150 a month is maintenance plus some content; £150 a month-plus is a full managed service or an agency retainer with project-management overhead.

Most UK SMBs in the £500k to £10m turnover band sit at the £49 to £79 a month mark for a properly managed site. The sister post on what a small business website actually costs in the UK breaks the wider price picture down by line item.

A 9-question checklist to take into any contract conversation

Read the document, then ask the provider the following in a single email:

  1. What exactly is included in the monthly fee, line by line?
  2. What is not included, and what does it cost when I ask for it?
  3. What is the response time for a support email, in working hours?
  4. Who, by name, will be replying to my emails?
  5. How do I cancel, in writing, and what is the notice period?
  6. What do I keep on the way out — domain, content, code, analytics history?
  7. Where is my data stored, and how is it backed up?
  8. What happens if the site is compromised — who pays for the recovery?
  9. When was the last security update applied to the site you are about to take over?

A serious provider answers those nine in one reply, in plain English, within two working days. A provider who needs to “check with the team” on whether you own your own content is telling you the answer.

How we structure this, and why monthly-rolling beats annual

We do monthly-rolling. £49 a month for Essentials, £79 a month for Growth, £0 setup, 30-day money-back guarantee, 10 per cent off if you pay the year up front. The reason it is monthly is the same reason a fair contract is monthly: a relationship that has to earn its renewal each month is one where the provider stays sharp. A 12-month lock-in is a tool for keeping a customer who has already decided to leave.

The site itself runs on a static stack, which makes the maintenance shape different from WordPress — there is no database to compromise, no plugins to keep current, no nightly cron job to babysit. We build sites like Sameday Jetwash once and then the monthly work is mostly content and the occasional small fix, not constant patching. That is what makes £49 to £79 a month work without cutting corners.

If you are renewing a contract this month, run the nine-question checklist against your current provider and ours, side by side. If we are the better answer for a business in Reigate or the wider Surrey corridor, reply to start.

Questions

Frequently asked

How much should a small business pay for website maintenance in the UK?

The market range we see in 2026 is roughly £25 to £100 a month for a small business site at the lighter end, and £50 to £300 a month for sites that include real content work, security monitoring, and a named support contact. EdTheDev's 2026 maintenance guide cites a similar £25 to £100 small-business band; Respect Experts' package guide sits in the £50 to £300 broader range. These are observed market positions, not a primary-source statistic. If a quote sits well above £300 a month for a brochure site, ask which line items justify the gap.

Should I sign an annual contract or monthly rolling?

Monthly rolling is the safer default for an SMB unless the annual saving is at least 10 to 15 per cent and the cancellation terms are reasonable. If the only way out of an annual contract is to write to a postal address, give 90 days' notice, and pay an off-boarding fee, the discount is not real. A fair annual contract has a written 30-day exit window early in the year and a plain-English description of what you keep on the way out.

What's the difference between maintenance and a managed website?

Maintenance is patching what is already there — security updates, plugin updates, backups, SSL renewals, occasional copy edits. A managed website is a partner who keeps the site working as your business changes, which means content updates, new pages, page-speed work, and minor design tweaks are part of the monthly fee, not an extra invoice. Most £40 a month packages are maintenance only; £49 to £79 a month should buy genuine management.

Can I do website maintenance myself?

You can do some of it. Backups, plugin updates, and SSL renewals are roughly 30 minutes a week on a WordPress site if you know what you are doing. The trade-off is that one missed update can let an attacker in, and a compromised site usually costs more to recover than two years of maintenance. The honest test is whether you will actually do it, every week, when the rest of the business is busy.

What happens to my website if I cancel maintenance?

On a static site (the kind we build) it keeps working until the domain or hosting bill goes unpaid, because there is no database to compromise and no plugins to update. On a WordPress or similar CMS site, it usually keeps working for a few months and then something breaks — a plugin update fails, a security hole gets exploited, or the SSL certificate lapses. The risk compounds quietly. If a provider is cancelling on you, get a fresh backup and a domain-control hand-over the same week.

Need someone to actually run your site?

That is what we do. £49 or £79 a month. £0 setup. 30-day money back.