A manufacturer’s owner sent a one-line message late last September: the site is down, and a customer just called to ask whether the company had closed. He rang the hosting provider first; the machine was running normally. Then he rang the developer who built the site; that number had been disconnected. The contract showed the server, the code and the filing sitting with three different parties, and nobody responsible for whether the site could open at all. It stayed down for two and a half days, right before a tender deadline.

Uptime monitoring and response time: if the contract has no deadline, there is no promise

Many maintenance packages advertise round-the-clock support that in practice means one shared inbox. A marketing coordinator finds a blank homepage at nine in the morning, sends an email, and hears back at three in the afternoon that the service was restarted. Meanwhile a seasonal campaign is running, the ad account keeps spending, and visitors land on an empty page.

The business impact is concrete: a day of budget spent, zero conversions, and prospects assuming the company has shut. Workable terms name the numbers — how fast someone responds during business hours, how quickly an urgent fault is handled, whether nights and public holidays are covered. The difference between a clause that states this and one that does not is measured in hours and in wasted ad spend.

Backups: whether they exist, where they live, how fast they restore

Ask whether backups exist and the answer is almost always yes. Ask which machine they sit on, and the answer is usually the same server, the same disk. That is the same as having none.

Three situations actually happen to businesses: an editor deletes a whole product category, an upgrade leaves pages scrambled, or someone uploads a pile of unfamiliar files into the site. All three depend on a backup, and a backup only counts once a restore has been tested. A trading company lost over six hundred product specifications and three years of enquiries, with no usable copy; two staff spent a fortnight retyping, and new enquiries went unanswered the whole time. The service list should state backup frequency, how many restore points are kept, whether copies are stored off-site, and how long recovery takes.

Security and malware cleanup: agree on responsibility in advance

Businesses usually learn about an injected redirect from a customer. The site opens on a phone and jumps to an unfamiliar page, a search engine flags it as risky, and the purchasing manager picks up the phone to a blunt question about what is wrong with the website.

Beyond embarrassment, ad reviews get rejected, branded searches carry a warning, and a deal under discussion quietly stalls. Cleanup, resubmission and re-indexing commonly take two to three weeks, and enquiries dry up for that entire period. The maintenance contract should specify whether monitoring and file cleanup are included, who handles an intrusion, whether a re-test follows, and what happens if the same problem returns.

Programme updates and small page changes: the item that quietly disappears

A single line reading “routine maintenance” hides a lot. The marketing coordinator wants a new product image in the homepage slider, a new phone number in the footer, a temporary campaign page. The reply is that this counts as a new requirement and will be quoted separately. The campaign schedule stalls right there.

Once or twice is tolerable; across a year it becomes its own budget line, because every change is invoiced and any outside help must be briefed on the business from scratch. Three questions settle it: how many hours of small changes are included each month, how overruns are priced, and who verifies the change after it goes live.

Domain, filing and certificate expiry dates: who is watching

Domains, SSL certificates and filing updates each carry their own deadlines, usually scattered across an administrator, a finance contact and the original developer. None of them holds the full picture.

When a certificate lapses, the browser stops visitors at a security warning before they ever see the product. An expired domain takes down both the website and company email, and recovery means re-verification and fresh review. There is no technical difficulty here, only an unwatched date. A proper service keeps a register, warns ahead of renewal, and can be handed over cleanly when staff change.

A named contact and a monthly report: knowing who to call

Many companies report faults by tagging someone in a group chat. One person handles a blank page, another handles a login failure, and nobody can say what changed last week. A single problem circulates among three people and is still “under investigation” two days later.

Maintenance should be verifiable. A named contact plus a monthly report covering availability, backup records, incident handling and a list of changes lets an owner judge whether the fee is worth paying, and gives them evidence when something goes wrong. Without it, maintenance is only a verbal assurance.

Why the annual fee ranges from a few thousand to tens of thousands

A standard corporate brochure site commonly falls in the low thousands per year; sites with e-commerce, multiple languages, membership or external integrations often run beyond ten thousand. The gap is not about attitude. It reflects site size and page count, server specification and bandwidth, whether content work is included, the response-time tier, and whether legacy code must be taken over.

Cheap packages usually cover only “the server is on and renewals are reminded”. Code-level changes are billed separately and security incidents sit outside the scope. Compare item by item instead of comparing totals: what is listed, what is marked to be quoted separately, and what is not mentioned at all. Two contracts priced the same can differ enormously in real value.

What a maintenance contract really buys is someone accountable for the site staying usable. Asking six questions before signing, and writing the answers into the terms, is worth more than saving a few thousand yuan. Xi’an Zunyun Technology has built websites, applications and custom PHP systems since 2015, and also takes on website maintenance and hosting; site size, legacy code and change frequency can be assessed before any plan is set.