Agencies
What Should a Website Maintenance Retainer Actually Include?
Ric Hall, CRO— AI-assisted and reviewed prior to publication.
A website maintenance retainer should include software updates (WordPress core, plugins, themes) applied on staging then production, daily off-site backups with 30-day retention, uptime monitoring with alerts, and defined response times for outages. Security scans, SSL monitoring, and small content edits belong in standard tiers.
What clients assume is included
Clients expect someone tests updates before they go live (gruffygoat.com), but many basic plans automate everything without human review. Automated care plans costing $50 to $150 a month typically include scheduled updates, backups, and uptime monitoring, but nobody looks at the site, updates go out untested, and fixes cost extra.
The gap appears when a plugin update breaks a contact form or a page builder produces layout errors after a minor release. Clients assume "maintenance" means someone caught the problem. What they paid for was a script that ran the update at 3 AM and moved on.
Security is another mismatch. Plans that include malware removal guarantee that cleanup is covered if the site is infected, while plans without it charge separately for this service, which can cost hundreds to thousands of dollars per incident (seoninja.com). A $75 monthly plan that scans for malware but does not remove it leaves the client with a four-figure bill the first time something slips through.
Backup testing rarely happens unless the contract names it. A typical small business site should retain daily backups for 14 to 30 days, weekly backups for 8 to 12 weeks, and monthly backups for 6 to 12 months, with an additional backup before major changes such as a CMS upgrade, redesign launch, migration, plugin replacement, or server configuration work (blog.kodu.cloud). The backups exist, but restore tests are missing. You discover the backups are corrupt when the client needs one.
What does it actually cost to do the work?
The whole process takes 15 to 30 minutes for a straightforward brochure site (fatlabwebsupport.com) when you batch weekly updates, review changelogs, apply the changes, and verify forms and the homepage. That assumes nothing breaks. When something does, debugging and rollback can add an hour or more.
Security patches should be updated within 24 to 48 hours, as attackers begin scanning for vulnerable sites almost immediately after a plugin vulnerability is disclosed, and millions of exploit attempts have targeted known plugin flaws a full year after patches were available (fatlabwebsupport.com). This means off-cycle work outside your normal update window, which most $100 retainers do not price in.
Monitoring tools add to the base cost. Uptime monitoring services range from UptimeRobot's free 50-monitor tier with 5-minute checks to Better Stack at $29 per month annually for up to 30-second intervals, StatusCake at $20.41 per month annually with 1-minute paid checks, and Site24x7 starting at $9 per month with 1-minute frequency on the entry paid plan (uptimerobot.com). White-labeling those reports for clients requires a paid tier or custom integration work.
Backups need off-site storage and retention that meets compliance requirements where applicable. HIPAA mandates that healthcare organizations retain data for at least six years, PCI-DSS stipulates a one-year retention period for transaction logs, and GDPR requires businesses to retain data no longer than necessary to serve its intended purpose. If you manage sites in regulated industries, your standard 30-day retention does not meet the requirement, and neither does your contract language.
How to price what you sell
For most small businesses, a professional website maintenance plan runs $75 to $200 per month, roughly $900 to $2,400 per year, buying human-tested updates, layered backups, real-time security monitoring, and developer-level support at the tier where maintenance actually prevents downtime rather than just automating it.
Build your tiers around what breaks and what gets tested. A basic plan can automate low-risk plugins, while high-risk plugins such as page builders, e-commerce platforms like WooCommerce, and membership systems warrant waiting 24 to 48 hours after a major release unless the update is clearly a security patch, since a bug in a page builder can produce the white screen of death and a bug in WooCommerce can halt all sales.
Standard plans should name staging environments, response times, and what counts as included support versus billable work. Basic tiers cover software updates, offsite backups, uptime monitoring with alerting, and a monthly report, while standard tiers add small content changes, security scanning, SSL and domain expiry tracking, and a defined response time, with premium tiers adding performance monitoring, staging-tested updates, an uptime SLA, and a same-day response commitment.
Premium retainers at $400 and up should include same-day fixes, e-commerce checkout testing after updates, and priority support. If the client runs transactions, the retainer needs to cover revenue protection, not just uptime. ActiScore's pricing (/pricing) reflects a similar model for audit visibility: agencies pay for what they scan and report, not a flat enterprise tier that bundles unused features.
What should monthly reports include?
Monthly reports should show what was updated, when it was updated, whether it was tested, and what broke. Version numbers matter when you need to trace a regression. Uptime percentage is table stakes, but uptime with incident timestamps tells the client when they were exposed.
Security reports need specificity. "SSL expires in 14 days" is actionable. "Security is good" is not. If you run scans for SPF, DMARC, DKIM, HSTS, or CSP, the report should show the record or header value, not a green checkmark. Clients in regulated industries need evidence they can hand to an auditor.
Performance metrics should include Core Web Vitals if the site depends on search visibility. The free AI-visibility check (/check) shows whether Claude, ChatGPT, Gemini, and Perplexity name the business when someone asks who to hire, and that matters more to most small business clients than a Lighthouse score. If your retainer includes SEO monitoring, tie it to something the client can verify.
Break the report into sections that match your contract tiers. Updates applied, backups verified, monitoring alerts, support requests handled. If the client is paying for five hours of content edits per month and used two, show it. If they triggered an out-of-scope fix that you billed separately, document it there so the invoice matches the evidence.
Time-stamped logs are the difference between "we do backups" and proof you can produce when a client asks. Compliance-focused clients need this from day one. The rest will need it eventually. Build the guide (/guide) into your onboarding so clients know what they are buying and what sits outside the retainer before they sign.
Common questions
What's the difference between automated and human-tested website maintenance?
Automated maintenance plans costing $50 to $150 per month typically run updates, backups, and uptime monitoring through scripts without anyone reviewing the site. Human-tested maintenance means someone reviews changelogs, applies updates to a staging environment first, verifies forms and key pages work, and catches problems before they reach your live site. The gap appears when a plugin update breaks a contact form or produces layout errors—automated plans push the update at 3 AM and move on, while tested plans catch the issue before visitors see it.
Does website maintenance include malware removal or just scanning?
Many maintenance plans include malware scanning but not removal, leaving you with a separate bill that can cost hundreds to thousands of dollars per incident. Plans that guarantee malware removal cover cleanup if your site is infected, while plans without it only alert you to the problem and charge separately for the fix. A $75 monthly plan that scans for malware but does not remove it means you will face a four-figure bill the first time something slips through, so check whether your contract includes removal or just detection.
How quickly should security updates be applied to my website?
Security patches should be updated within 24 to 48 hours because attackers begin scanning for vulnerable sites almost immediately after a plugin vulnerability is disclosed. Millions of exploit attempts have targeted known plugin flaws a full year after patches were available, which means delays create real risk. This requires off-cycle work outside normal update windows, and most $100 retainers do not price in emergency security updates. Standard maintenance schedules that batch updates weekly leave you exposed when a critical patch is released mid-cycle.
How long should website backups be retained?
A typical small business site should retain daily backups for 14 to 30 days, weekly backups for 8 to 12 weeks, and monthly backups for 6 to 12 months, with an additional backup before major changes like CMS upgrades, redesigns, migrations, or plugin replacements. If you operate in a regulated industry, retention requirements are longer: HIPAA mandates at least six years for healthcare organizations, PCI-DSS requires one year for transaction logs, and GDPR requires retention no longer than necessary for the intended purpose. Standard 30-day retention does not meet compliance requirements, and your contract language needs to reflect industry-specific obligations.
What should be included in monthly website maintenance reports?
Monthly reports should show what was updated, when it was updated, whether it was tested, and what broke, with version numbers included so you can trace regressions. Uptime percentage is standard, but uptime with incident timestamps tells you when you were exposed. Security reports need specifics like SSL expiry dates in days, not vague statements that security is good. If you run scans for SPF, DMARC, DKIM, HSTS, or CSP, the report should show the actual record or header value. Time-stamped logs are the difference between claiming you do backups and producing proof when you need to restore a site or meet a compliance audit.