Website Maintenance Agreement Template: What Agencies Should Include

Offering website maintenance can be a brilliant recurring revenue stream for your agency. Instead of handing over a site and hoping the client comes back, you keep supporting the site month after month.

But ongoing support can also get messy quickly. A client might expect unlimited changes, urgent weekend fixes, security clean-ups, hosting help and plugin updates, all under one monthly retainer.

A clear website maintenance agreement helps you set boundaries from day one. It explains what you're responsible for, what the client needs to do, how quickly you'll respond, and when extra work will be charged separately.

What is a website maintenance agreement?

A website maintenance agreement is a contract that sets out the ongoing website support services you'll provide after a website has been built or taken over.

It's different from a website development agreement. A website development agreement usually covers a project with a defined build, launch date and deliverables. A maintenance agreement is about recurring support, such as updates, monitoring, small fixes, backups and helpdesk style requests.

For a UK web agency, the agreement will usually cover things like:

• What maintenance tasks are included each month
• How many support hours, tickets or requests are included
• Response times for different types of issues
• Who manages hosting, domains, plugins, themes and third party tools
• What happens if there's a cyber incident or site outage
• How extra work is quoted and approved
• Fees, payment dates and what happens if invoices aren't paid
• How either side can end the arrangement

Without a written agreement, you may struggle to recover unpaid invoices or push back on work that was never meant to be included. More importantly, your team can end up spending hours on urgent requests that aren't priced into the retainer.

The aim isn't to make the relationship feel rigid. It's to make the working relationship easier, because everyone knows what the retainer does and doesn't cover.

Do you need a website maintenance agreement template in the UK?

Yes, if you're providing ongoing website support in the UK, you should have a written agreement that's tailored to your services, clients and risk level.

A template can be a useful starting point, especially if you're trying to map out what needs to be covered. But web maintenance work has a lot of moving parts, so a generic template often misses the details that matter most.

For example, your agreement may need to deal with:

• Whether you're maintaining WordPress, Shopify, Webflow, custom code or another platform
• Whether you control the hosting environment or rely on a third party host
• Whether the client, your team or another agency can make changes to the site
• Whether you're providing security monitoring or just applying routine updates
• Whether your client is a business, charity, public body or consumer facing brand
• Whether you process personal data through forms, analytics tools or customer accounts

UK contract law gives you a lot of flexibility to agree your commercial terms, but the wording needs to be clear. If you're working with consumers, the Consumer Rights Act 2015 may also affect how your terms are interpreted, especially around fairness, transparency and service quality.

If you're dealing with personal data, UK GDPR and the Data Protection Act 2018 may also be relevant. For example, if you can access website enquiries, customer accounts or order data while maintaining the site, your contract may need data processing wording as well as your standard service terms.

What should a website maintenance agreement include?

A website maintenance agreement should include the scope of support, payment terms, response times, exclusions, data protection terms and a clear process for changes.

Here's a practical fill-in outline you can use to plan your agreement. This isn't a finished legal document, and a lawyer should tailor it before you use it with clients.

1. Parties: Write the legal names, company numbers if relevant, trading names and contact details for your agency and the client.
2. Website and platforms: Identify the website, CMS, hosting provider, domain, plugins, integrations and key third party tools.
3. Included services: List the exact support tasks included, such as plugin updates, CMS updates, backups, uptime checks, small bug fixes and content changes.
4. Excluded services: Spell out what isn't included, such as redesigns, new features, SEO campaigns, copywriting, paid ads, malware removal or emergency work unless agreed.
5. Support allowance: State the included hours, tickets, tasks or fair use limits for each billing period.
6. Response times: Set target response times for critical, high, medium and low priority issues.
7. Client responsibilities: Explain what the client must provide, including access, approvals, licence renewals, accurate content and prompt decisions.
8. Fees and payment: Set out retainer fees, billing cycle, VAT treatment if applicable, payment dates, late payment rights and rate cards for extra work.
9. Out of scope requests: Explain how extra work will be quoted, approved, billed and scheduled.
10. Security and incidents: Cover updates, vulnerabilities, malware, backups, incident reporting and limits on what you can guarantee.
11. Data protection: Include UK GDPR roles, processing instructions, confidentiality, security measures and breach notification duties where needed.
12. Intellectual property: State who owns new code, content, templates, tools and deliverables created during maintenance.
13. Liability: Set sensible limits on liability and carve-outs that shouldn't be limited, based on your specific arrangement.
14. Term and termination: Set the start date, minimum term, notice period and what happens on handover.

Your agreement should also work alongside your proposal or statement of work. If the proposal says one thing and the contract says another, that can create confusion when a client challenges a bill.

How should you deal with updates, hosting and security incidents?

You should deal with updates, hosting and security incidents by clearly splitting responsibilities between your agency, the client and any third party provider.

This is one of the biggest gaps in many web agency maintenance terms. Clients often assume that if they pay a maintenance retainer, you're responsible for anything that goes wrong with the site. That may not be fair if the issue is caused by the host, a plugin vendor, the client's own admin user, or another developer's code.

Update responsibilities

Your agreement should say whether you'll apply:

• CMS core updates
• Plugin, app or extension updates
• Theme updates
• Security patches
• PHP or server version updates
• Accessibility or browser compatibility fixes

It should also say whether you'll test updates before applying them, whether updates are done on a staging site, and what happens if an update breaks a feature.

Hosting dependencies

If the client manages hosting, your agreement should make it clear that you can't control the host's uptime, server performance, backup systems or support response times.

If you manage hosting for the client, your terms should be more detailed. You may need to cover storage limits, fair usage, server maintenance windows, backups, restoration limits and what happens if the hosting provider changes its terms or pricing.

Security incidents

Be specific about what you'll do if the site is hacked, infected with malware or taken offline. For example, you might agree to investigate during business hours and provide a quote for clean-up work, rather than including unlimited emergency remediation in the monthly fee.

If personal data may have been compromised, UK GDPR may require action quickly. A data controller generally needs to report a personal data breach to the Information Commissioner's Office within 72 hours of becoming aware of it, unless the breach is unlikely to risk people's rights and freedoms. If you're acting as a processor, you usually need to notify the controller without undue delay.

Your contract should identify the parties' UK GDPR roles. If the client is the controller, the client should decide whether ICO notification is required, while you must notify and support them without undue delay if you're acting as processor. Your agreement can also explain who communicates with affected users and what practical support you'll provide.

What counts as out of scope work?

Out of scope work is anything the client asks you to do that isn't included in the agreed maintenance services, support allowance or response commitments.

This clause is what protects your retainer from turning into unlimited labour. It also helps your client budget properly, because they know when a separate quote is coming.

Common out of scope requests include:

• New pages, landing pages or templates
• Design refreshes or brand updates
• New functionality, such as booking tools, membership areas or payment flows
• Major ecommerce changes, such as product migrations or checkout changes
• SEO strategy, content writing or blog production
• Paid advertising, analytics strategy or conversion rate optimisation
• Fixing work done by the client or another supplier
• Malware removal or incident response beyond routine security updates
• Accessibility audits or compliance remediation
• Work needed because a third party platform, plugin or API has changed

Say Amira runs a small web agency in Manchester. Her client pays £650 plus VAT per month for up to 4 hours of support, with a 2 business day response time for normal requests. The client then asks for a new checkout integration that Amira estimates will take 10 hours.

If her agreement is clear, Amira can say: the first 4 hours of routine support are covered by the retainer, but the checkout integration is a new feature. She sends a change request at £90 per hour plus VAT, with an estimated 10 hours, and starts once the client approves it in writing.

That approach is much easier than arguing after the work is done. Your agreement should require written approval before extra work starts, whether that's by signed quote, email approval or an approved ticket in your project management system.

How should you set response times and support levels?

You should set response times by issue priority, not by promising to fix every issue within the same timeframe.

There's a big difference between acknowledging a support request and resolving it. Your agreement should avoid vague promises like "urgent support included" unless you define what that means.

A simple priority structure might look like this:

• Critical: The live site is down, checkout is unavailable, or a serious security issue is suspected.
• High: A key function is impaired, but the site is still mostly usable.
• Medium: A bug or content issue affects the client experience but doesn't stop trading.
• Low: A minor change, advice request or non-urgent fix.

You can then attach service level targets and response times to each level. For example, you might respond to critical issues within 4 business hours, high issues within 1 business day, medium issues within 2 business days and low issues within 5 business days.

Be careful with 24/7 promises. If your agency doesn't genuinely have out of hours cover, don't offer it casually. If you do offer emergency support, say whether it costs extra, what counts as an emergency, and how the client must contact you.

Your service level agreement should also say that resolution times may depend on factors outside your control, such as hosting support, plugin vendors, DNS propagation, platform outages or the client providing access.

This keeps your support promise commercially realistic while still giving the client confidence that their requests won't disappear into a black hole.

How much should a website retainer agreement cost?

The cost of a website retainer agreement depends on the level of tailoring you need, the complexity of your services and how much risk the contract needs to manage.

There are usually three ways agencies approach this.

Using a free template

A free web maintenance contract template can help you see the common headings and start thinking about scope. The risk is that it may not reflect your pricing model, support process, data protection role, liability position or the platforms you work with.

If you use a free template, don't just change the names and send it out. At a minimum, check every clause against how your agency actually works.

Using an online fixed fee legal service

An online legal team can tailor the agreement to your services for a fixed fee, so you know the cost before you start. This can suit agencies that want a practical contract without hourly billing uncertainty.

You should expect the process to cover your maintenance packages, inclusions, exclusions, response times, data protection position, payment terms and termination process.

Using a traditional firm

A traditional firm may bill by the hour, which can make sense for more complex arrangements, larger clients or higher risk infrastructure work. The main thing is to confirm what's included in the scope of services, who will draft the agreement and how revisions are handled.

Whichever route you choose, the cost of the contract should be weighed against what it protects. If one unclear retainer leads to months of unpaid extra work, a tailored agreement can pay for itself very quickly.

Key Takeaways

• A website maintenance agreement is different from a website build contract because it covers recurring support, response times and ongoing responsibilities.
• Your agreement should clearly define included work, excluded work, client responsibilities, fees and out of scope approval processes.
• Updates, hosting and security incidents need special attention because many problems depend on third party platforms, plugins and providers.
• If you handle personal data while maintaining a site, UK GDPR and the Data Protection Act 2018 may affect your contract terms and breach response process.
• Templates can help with structure, but your agreement should be tailored to your agency's actual maintenance packages and support model.

If you'd like help with your website maintenance agreement, web agency support terms, data protection clauses or out of scope change process, you can reach us at 08081347754 or team@sprintlaw.co.uk for a free, no-obligation chat.