Guide

Website maintenance contract template

The retainer argument starts in month four, and it is always the same argument. They thought maintenance included the new landing page. I thought it included the checks, the small edits we named, and a letter. Neither of us was lying. We never wrote the three lists down. This website maintenance contract template is that sheet, the one I send before the first invoice, with the blanks still in it.

I am not a lawyer, and this is not a law-firm contract. If the client has counsel, or the fee is large enough that a dispute would hurt, have a lawyer read the version you send. The PDFs that rank for this search already include backups, plugin updates, and security scans, as if every retainer does those jobs. Leave those lines out unless you do the work. RetainerProof does not take backups, does not update plugins, and does not run a security scan. The monthly letter is a different document. The blank for that letter is the maintenance report template. A filled shape, for a fictional shop, is the Harbor & Co sample. Harbor & Co is not a customer.

Name the plan before you describe the tasks

I use a short name the client can say out loud. Watch, Care, or Studio are the names I reach for. They are labels, not an industry standard, and you can rename them. Do not rename them halfway through a year. Watch means I notice and I write. Care means Watch plus the platform work I am allowed to do and a small change budget. Studio means Care plus a standing block for larger edits. The contract should say which name they bought, in the first lines, so a later email that says “can you just” has somewhere to land.

Watch fits when they edit the site themselves. A content edit on Watch is a quoted task, or a reason to move them to Care. Care is the usual retainer: the outside checks, the letter, the updates the plan names, and a counted set of small changes. “Small” has to be a sentence they could repeat. I write “one screen you can point at, or one sentence, image, or phone number on a page that already exists.” A new page, a new form, and a shop setup fail that test. Studio is Care with a larger block, still a number. Unlimited is the word I stopped putting in contracts. Write the number of slices, or the number of hours, and what happens when the number is gone. The next request is a project.

The contract

Copy this. Square brackets are the blanks. Delete any line that is not true for this client. A blank you leave in is better than a sentence you invented to look complete. Harbor & Co, further down, is a filled example so you can see the shape. It is not a customer, and the numbers are not a rate card.

WEBSITE MAINTENANCE CONTRACT

This contract is between [Provider legal name] ("Provider") and [Client legal name] ("Client").
It covers maintenance of the sites listed below. It is not a redesign agreement.
Effective date: [date]

1. Sites
- [https://example.com] ([WordPress / Webflow / Shopify / Next.js / other])
- Money path, if it is not the homepage: [URL]
A URL that is not on this list is not in the contract. Adding one is a change to this contract.

2. Plan and fee
Plan name: [Watch / Care / Studio, or your name]
Fee: [amount] per month, billed [day and method].
Late: included work pauses after [N] days unpaid. The site is not taken down.
First review: [date, usually twelve months out]

3. Included every period
- Outside checks on the public URLs above.
- Certificate date and domain date, written in the monthly report when they are close.
- A monthly report: the work that was done, then the checks. One link. No account for the client.
- [Delete if untrue: the platform updates this plan allows, then a look at the public pages.]
- [Delete if untrue: up to N small changes. A small change is one existing screen the client can point at.]
- Quiet months are still the plan. The checks and the report happen even when the client sends no request.

4. Change requests
Approves change requests: [name], up to [amount], without asking anyone else.
Priced in writing before the work starts:
- A new page, a new template, or a new section that is not a swap on an existing screen.
- A new integration: payments, a booking tool, a login, a form that talks to another system.
- Anything past the small-change count, or past [N hours] in the period.
Provider sends a price and a week. Provider does not start because an email said "quick."

5. Out of scope
- A security audit, a penetration test, or a malware cleanup.
- An uptime guarantee. A percentage in the report is what the checks saw. It is not a credit.
- Hosting bills, ad accounts, the email provider, and any vendor Provider does not have a seat on.
- Content the client has not sent.
- A rebuild, a redesign, or a new brand.
- [Delete if you do this work yourself: backups, plugin updates, and security scans. Leaving the line out means they are not included.]

6. Access and confidentiality
- Provider gets a seat in Provider's name. Not the password that also opens billing.
- Registrar owner: [name]. Certificate owner: [name].
- Previous maintainer, if any, stays until [date], then comes off.
- Each party keeps the other's logins and unpublished work private, and uses them only for this contract.

7. How we talk
- Requests go to [email]. A chat message is a note until it is in that inbox.
- Included requests: a reply within [N business days].
- If a check says the site is down, Provider looks the same day Provider sees the alert.
- Provider does not promise a night watch. A person paged at 03:00 is a different product.

8. The monthly report
- It reports the period. It does not add scope.
- If a check could not see the site, the report says unverifiable, not "up."
- The client may forward the link.

9. Term and ending
- Monthly, until one party ends it in writing, with [30] days' notice.
- At the first review the parties read this contract against the year and keep it or rewrite it.
- Ending stops future checks. It does not delete reports already sent.
- The site, its files, and its content belong to the client.
- Provider hands over [an export, the admin seats, the repo].
- Provider keeps the site running where it is for [N days] after the last paid day.
- Moving to a new host or a new maintainer is its own quoted job.
- Provider removes Provider's seats once the client confirms the move.

10. Liability
- Provider performs the included work with ordinary professional care.
- Provider is not liable for indirect or consequential loss, including lost sales during an outage.
- Total liability is limited to the fees paid under this contract in the [3] months before the claim.
- This is a working scope sheet. It is not a substitute for the client's own lawyer.

11. Law
Governed by the law of [state or country]. The blank is on purpose.

Signed: [Provider name, date]
Signed: [Client name, date]

Two signatures are enough. If procurement wants terms of service stapled on, staple them. Do not let the attachment replace the sites list, the included list, and the out-of-scope list. Those three lists are the part they will actually read.

A filled contract, so the blanks are obvious

Harbor & Co is a made-up shop. I am showing the decisions, not a deal I closed. The price is a round number so the arithmetic is visible. Use yours. The live report for this same fictional shop is at /demo.

WEBSITE MAINTENANCE CONTRACT
Provider: Northline
Client: Harbor & Co. Email answers go to Nora Hale, [email protected]
Effective: 1 April 2026

1. Sites
- https://harbor.example (WordPress)
- Money path: https://harbor.example/wholesale

2. Plan and fee
Plan: Care
Fee: 240 dollars per month, billed on the 1st.
Late: included work pauses after 14 days unpaid. The site stays up.
First review: 1 April 2027

3. Included
- Outside checks on both URLs.
- Certificate and domain dates in the report when either is inside 30 days.
- A client page for the month. One link. No account for Nora.
- Plugin and theme updates on the second Tuesday, then a look at the public homepage and the wholesale page. That work is Northline's, in the tool that can see WordPress. It is not a security scan.
- Up to four small changes. A small change is one screen Nora can point at.
- Quiet months are still the plan.

4. Change requests
Nora can approve up to 300 dollars. Above that, her business partner too.
A new page, or a new wholesale tier, is quoted before anyone starts.

5. Out of scope
Security audit, malware cleanup, uptime credits, their email host, their ad account, and copy they have not sent.
Backups are not in this contract. If Northline later checks that a host backup finished, that is a line in the report, not a promise here.

6. Access
Administrator user named Northline. Not Nora's login.
Registrar: Nora. Certificate: the host.
Previous freelancer stays an admin until 15 April 2026.

7. How we talk
Requests to [email protected].
Included requests: three business days.
A down alert: looked at the same day. Not overnight.

8. The report
One secret link. Scope stays in this contract.
If a check could not see the site, the report says unverifiable.

9. Ending
Monthly, 30 days' notice.
Nora gets an export and keeps her own admin seat.
The site stays where it is for 14 days after the last paid day.
A move to a new host is quoted.
Reports already sent stay.

10. Liability
Ordinary care. No indirect loss. Liability capped at fees paid in the prior 3 months.

11. Law
Left as [Nora's state] until she names it.

Signed: Northline, 1 April 2026
Signed: Nora Hale, 1 April 2026

Read it out loud. If you stumble on “four small changes,” the number is wrong. Nora should be able to forward this without you on the call.

Two lines the contract templates leave out

The contract templates that rank for this search are mostly legal clauses: payment, liability, termination with notice. Two questions keep coming up from people who run these plans, and none of the templates I read answers them.

The first is who can say yes. In an r/webdev thread on maintenance contracts, mtedwards pointed out that at larger clients, the person who approves spending often does not know what needs updating, and the person who needs the update cannot wait for a budget sign-off. A monthly plan fixes that only if the contract names who can approve a change request, and up to what amount. That is the "Approves change requests" line.

The second is what happens when they leave. In an r/Wordpress thread on offboarding, redlotusaustin said they hand over a full copy of the site and the rest is on the client. mishrashutosh keeps a site running for up to a week so the client can move it, and said plainly that you never hold a site hostage. barnez_d said a client would expect to pay for the migration itself. In an older r/web_design thread, a client moved hosts and the contract had not covered it. LVWH's reply was that if it is not in the contract, it basically does not exist. The "When the plan ends" block puts all four answers in before anyone is upset.

What the monthly letter is allowed to say

The letter proves the month. It does not renegotiate the plan. Outcome lines first, then one technical note if they might ask how, then the checks. A quiet month is still the plan, which the contract already says. How to write it is on making the work visible. The emails are on quiet-month emails.

I do not put a service credit in the letter because a probe missed an hour. Homepage probes run every 15 minutes by default, and as often as every 30 seconds if you set that per site. That is one server, not a multi-region monitor. If they need a faster watch, they should keep one. That percentage is not a website maintenance SLA.

Access, written so you can leave

I want a seat in my name, not the password that also opens their billing and their email. On WordPress that is an administrator user. On Webflow it is a role that can do what the plan says I will do. The registrar and the certificate are often different people. Write both names. If you do not hold a login, say so in the access block. The previous maintainer stays until a date. I do not delete them on the morning of the kickoff. I have deleted the only person who knew where a backup lived, and I am not doing it again.

When a request does not fit

I answer in the lane, not in a mood. The reply I reuse:

This is a change request, not one of the four small changes.
What you asked for: a new wholesale page with a downloadable price list.
Included would have been: swapping the PDF link on the page that already exists.
Price to do the new page: [amount], in the week of [date].
I have not started. Say yes and I will.

The middle line is the one that keeps the relationship. You show the version that would have been included, then you stop. Starting the work while you wait for the yes is how the change lane collapses. The price has to be the sentence.

What I will not sign

I will not sign an uptime SLA I cannot enforce. I will not sign “24/7” if I sleep. I will not sign a security audit because the client’s insurer asked for the word maintenance. A care plan is not a vulnerability assessment. The product I use for the letter does not scan for malware, does not update plugins, and does not take backups. If the plan includes plugin updates, those happen in the tool that can see the inside of WordPress, and the agreement should name that tool or at least name the job. The client page is the letter. It is not the place the updates run.

I will not sign “all reasonable changes.” Reasonable is the fight. I will not sign “the website and related systems” without a URL list. Related systems is how you inherit their email, their ads, and a checkout you have never logged into. A new URL is a change to the contract.

Term, notice, and the page they keep

Thirty days is what I put in the notice blank unless their procurement already has a number. They keep the links already sent. Say that, so a departure does not become a demand to delete the only record of the year. The first review is a meeting. The sheet for it is the annual care plan review.

FAQ

Plans are Starter at $9/month for up to 5 sites, Studio at $29/month for up to 25 sites, and Agency at $79/month for up to 100 sites. Starter, including a trial, keeps a small Powered by RetainerProof link on the client digest and the public status page. Studio and Agency remove that link. Prices are on the pricing page.

Related guides

• Reporting for agencies
• Beyond WordPress
• Maintenance report template
• ManageWP alternative
• Uptime report
• Prove retainer value
• Care-plan reporting
• Client status pages
• MainWP alternative
• Quiet-month emails
• Reporting tools
• ManageWP alternatives
• Annual review
• Status page comparison
• Client work log

Also see pricing and a sample client digest.