What belongs in a WordPress maintenance contract?

At minimum: the concrete scope (updates for core, plugins, and themes; backups with storage location and retention; monitoring), a response time with a named service-hours window, the arrangement for the hack case, a data processing agreement per Art. 28 GDPR, term and notice period, and the hourly rate for work outside the plan. Whatever is missing is not agreed in a dispute.

What should I watch for in the response time of a maintenance contract?

Two things. First, the service-hours window – a deadline without a window reads like around-the-clock but practically never applies that way; serious contracts name the hours (e.g. Mon–Fri, 8 am–6 pm). Second, the definition of response: it should mean a technician looks at the problem and gives an assessment – not an automated acknowledgement. A fixed resolution deadline is something nobody can seriously promise.

How long should a maintenance contract term be?

Short. Twelve-month minimum terms are common in the market but not necessary – a short starting phase of about three months (so onboarding pays off for the provider) followed by monthly cancellation is a fair model. Be wary of very fast deadline promises combined with long lock-ins: the term is then often the insurance for a promise that otherwise would not hold.

Do I need a DPA with the maintenance contract?

Yes, practically always. As soon as the provider can access personal data – and with maintenance including backups they inevitably can, since a WordPress site contains form submissions and user accounts – Art. 28 GDPR requires a data processing agreement. An NDA does not replace it. A provider who does not offer the DPA proactively has not sorted their obligations.

WordPress Maintenance Contract: What Belongs in It – What Doesn't

In short: A dependable WordPress maintenance contract puts six things in writing: the concrete scope (updates, backups with storage location, monitoring), response times with a named service-hours window, the hack case, a data processing agreement under Art. 28 GDPR, term and notice period, and the hourly rate for extra work. Whatever is missing is, in a dispute, not agreed.

A maintenance contract is a promise on paper: someone keeps your website current, secure, and running – and stands behind that promise. Whether the paper is worth anything is decided in the fine print. This article walks through the contract section by section: what belongs in it, which phrasings are warning signs, and how to make offers comparable.

For transparency: we sell WordPress maintenance contracts ourselves. This article is still written as a review aid, not as advertising – the criteria apply to every provider, us included.

The mandatory contents: without these, it’s a label, not a contract

1. The concrete scope. “Regular updates” is not an agreement. A usable contract names: updates for core, plugins and themes, the rhythm, and whether critical updates are tested via a staging environment. What a sensible scope looks like is broken down in What WordPress maintenance covers.

2. Backups with three details. Where do they live (separate from the hosting? Germany/EU?), how long are they retained, and – the most forgotten point – is the restore tested? A backup whose restore was never verified is a hope, not a service.

3. Response time with a service-hours window. More on this below – the point deserves its own chapter, because this is where most of the tricks happen.

4. The hack case. Is cleanup included or extra? At which hourly rate? And what exactly is delivered – cleanup and hardening are realistic; anyone promising “forensics” or a reliable data-exfiltration verdict is usually promising more than a maintenance provider can deliver.

5. A DPA per Art. 28 GDPR. Mandatory as soon as the provider can access personal data – which, with maintenance including backups, they always can. An NDA is something different and does not replace it.

6. Term, cancellation, hourly rate. How long are you bound, how do you get out, and what does work outside the plan cost? If the hourly rate is missing from the contract, it gets negotiated later – from the weaker position.

The SLA fine print: where contracts sound better than they are

The response time is the selling point of almost every maintenance contract – and the spot with the most silent restrictions. Three questions expose it:

“In which window does the deadline apply?” A “response within 4 hours” without a service-hours window reads like around the clock. It practically never means that: by industry convention, the clock starts with the report and runs only within service hours. Which is perfectly fine – a small team cannot honestly promise night coverage. What is not fine is leaving it unwritten. Serious contracts name the window (ours: Mon–Fri, 8 am–6 pm).

“What counts as a response?” The automated ticket acknowledgement after 30 seconds formally satisfies any deadline. What should be meant is the qualified response: a technician has looked at the problem and gives an assessment. And important for expectations: response is not resolution – when a problem is fixed depends on the problem, and a fixed resolution deadline is something nobody can seriously promise, because it can hinge on third parties (host, plugin vendor, payment provider).

“What backs the promise?” A striking market pattern: very fast deadlines often sit next to very long minimum terms – your lock-in then carries the risk of the promise. The reverse combination – honest deadlines, short commitment – is the customer-friendlier model, because the provider has to deliver anew every month.

Term and pricing structure

Starting phase instead of shackles: a short minimum phase (about three months, so onboarding pays off) followed by monthly cancellation is fair. A twelve-month lock-in needs a justification.
What is actually included: free hours or allowances – do they expire, do they carry over? And what does the hour beyond them cost?
Price reality: serious maintenance sits roughly between 30 and 400 € net per month depending on scope – the full picture including our plans is in What does WordPress maintenance cost?. Very cheap offers often cover nothing more than an automated plugin update – no tested backups, no monitoring, no humans behind it.

The checklist before signing

Are updates, backups (location, retention, restore test), and monitoring named concretely?
Does the response time come with a service-hours window – and is it defined what counts as a response?
Is the hack case settled – included or by effort, and at what rate?
Is a DPA attached without you having to ask?
How long is the lock-in, how short the notice period?
Is the hourly rate for extra work in the contract?
Do you get regular reports on the work actually done – or do you have to believe?
Does the whole thing fit your site? A shop needs different promises (checkout monitoring, shorter deadlines) than a company website.

Work through these eight points and offers become comparable – and you can tell within five minutes whether a contract has substance or a label.

An honest conclusion

A good maintenance contract is unspectacular: it names precisely what is delivered, honestly delimits what is not, and does not bind you longer than the trust carries. Distrust contracts that sound perfect – around the clock, everything included, resolution guaranteed. Trust contracts that tell you their limits unprompted. Those come from providers who intend to keep their promises.

Want a maintenance contract that passes this checklist itself? Our WordPress maintenance puts all eight points openly on the page – plans, service hours, prices, DPA. Questions? Drop us a line.