A website maintenance vendor contract should spell out covered work, response times, updates, backups, security duties, and exit terms. A service agreement is the written contract that turns those promises into enforceable duties. Vague care plans create disputes about what counts as maintenance and what costs extra. Clear language helps owners of WordPress, Drupal, and custom sites compare vendors and hold them accountable.
Table of Contents
- What should the scope of work include?
- How should response times and support work?
- How are updates, backups, and security handled?
- Who owns what, and how does the contract end?
What should the scope of work include?
Define covered tasks by name, such as core updates, plugin or module updates, uptime monitoring, small content edits, and performance checks. Also list frequency, such as weekly updates or monthly reports, so expectations are testable.
List exclusions with the same care. Redesigns, new features, copywriting, SEO work, and paid-ad management usually fall outside routine maintenance and need separate pricing.
- Covered systems and domains
- Included task types and time limits
- Excluded work and how extras are quoted
- Who supplies licenses, hosting access, and content
How should response times and support work?
Set priority levels for common events, such as a full outage, a broken checkout form, and a minor text change. Tie each level to a response target and a resolution target, plus support hours and contact method.
Explain emergency handling for nights, weekends, and holidays. A practical clause names how to report an outage, who acknowledges it, and when status updates arrive.
How are updates, backups, and security handled?
Require tested updates rather than one-click updates on a live site. The agreement should describe staging, visual checks, and rollback steps when an update breaks layouts or integrations. Backups need location, frequency, retention, and restore duties.
State who keeps off-server copies, how long copies last, and who performs a restore after failure or attack. Security duties should cover malware scans, firewall or login protection, user-access reviews, and incident notice. Ask for prompt notice of suspected breaches and clear steps for cleanup, passwords, and service restoration.
Who owns what, and how does the contract end?
Confirm that the client keeps ownership of the site, content, accounts, and data. The vendor should provide admin access, licenses in the client's name where possible, and documentation of changes.
End the agreement with term length, renewal rules, fees, and cancellation notice. Include a handover duty: return credentials, files, backups, and records within a set time, with cooperation during transfer to a new vendor.
