Website Maintenance Agreement Template: What To Include

Do you really need a website maintenance agreement template, or can you just keep helping clients and invoicing each month?

You can keep things informal for a while, but it gets risky as soon as a client expects urgent fixes, extra pages, security work, hosting support or weekend help that you never priced in. A written agreement gives both sides a clear playbook.

If you're a web developer, designer or agency in Australia, your website maintenance agreement should do more than say you provide support. It should clearly set out what you're maintaining, how fast you'll respond, what costs extra, who controls hosting access, how backups work and when your monthly retainer gets paid.

What Is A Website Maintenance Agreement?

A website maintenance agreement is a service contract for ongoing website support after the build or redesign is finished, and is often treated as a support and maintenance agreement.

It can be used for regular updates, plugin maintenance, security patches, content changes, hosting management, backups, bug fixes, analytics support and general troubleshooting. You might call it a website support contract, web maintenance terms and conditions, a website retainer agreement or a website developer maintenance contract. The label matters less than what the document actually says.

For example, say Mia runs a small WordPress agency in Melbourne. She charges a client $950 plus GST per month for ongoing maintenance. The client assumes that includes unlimited design changes, emergency weekend support and fixing issues caused by the client's own marketing plugin. Mia thought the retainer covered up to 5 hours of weekday support, updates and backups. Without a written agreement, that gap can quickly become an unpaid invoice dispute.

A good maintenance agreement helps you avoid that problem by setting out:

• the websites, domains or platforms covered
• the included services and support hours
• your response times and support channels
• excluded work and extra charges
• hosting, access, backups and security responsibilities
• payment terms, minimum commitments and cancellation rights

Templates can be useful as a starting point, but they often miss the operational details that matter for your business model. A lawyer should tailor the document before you use it with clients.

Do You Need A Written Agreement For Website Support?

Yes, you should use a written agreement if you're providing ongoing website maintenance, hosting or support for a fee.

Technically, you can have a contract based on emails, invoices and conduct. The issue is proof. If you and your client later disagree about what was included, you may struggle to recover unpaid invoices or push back on extra work if the terms were never written down clearly.

This is especially important if you offer monthly retainers. Retainers can be great for cash flow, but clients sometimes treat them as an all-you-can-eat support package unless the boundaries are clear.

Your agreement should also fit within Australian contract and consumer law. Under the Australian Consumer Law, some business clients may receive consumer guarantees for services, including that services are provided with due care and skill and within a reasonable time if no time is fixed. You generally can't contract out of those guarantees where they apply.

You should also be careful with standard form contracts. The unfair contract terms regime under the Australian Consumer Law can apply to small business contracts, including where a party has fewer than 100 employees or annual turnover under $10 million. Since the 2023 reforms, unfair terms can attract significant penalties, not just be declared void.

That doesn't mean your agreement can't protect you. It means your terms should be balanced, clear and commercially sensible. For example, it's usually fair to exclude liability for problems caused by third party hosting downtime, client edits or unsupported plugins, provided the clause is drafted properly and doesn't overreach.

What Clauses Should Your Website Maintenance Agreement Template Include?

Your template should include the clauses that define the service, control scope creep and make day-to-day support easier to manage.

A practical website maintenance agreement template in Australia, or broader IT services agreement, might follow this structure:

1. Parties: Insert your business name, ABN or ACN, contact details and the client's details.
2. Websites Covered: List the domains, subdomains, CMS platforms, staging sites and hosting accounts included.
3. Services: Describe exactly what maintenance, hosting, monitoring, updates and support you provide.
4. Support Hours And Channels: State when support is available and whether requests must come through email, ticketing software or another system.
5. Response Times: Set realistic targets for urgent, high, medium and low priority requests.
6. Exclusions: List what isn't included, such as new features, redesigns, SEO strategy, copywriting, malware cleanup beyond a set allowance or third party outages.
7. Retainer And Fees: Set the monthly fee, included hours, hourly rate for extra work, GST treatment and invoice due dates.
8. Hosting And Access: Explain who owns and controls hosting, domain names, admin accounts, licence keys and credentials.
9. Backups And Security: State backup frequency, restoration process, update approach and client responsibilities.
10. Intellectual Property: Clarify who owns new code, templates, documentation and materials created during support.
11. Confidentiality And Privacy: Cover login details, customer data, analytics, databases and personal information.
12. Term And Termination: Set the minimum term, renewal, notice period and what happens on handover.
13. Liability: Set sensible limits, carve-outs and exclusions for things outside your control.
14. Dispute Process: Include a practical escalation process before either side ends the arrangement.

This outline isn't a finished legal document. It needs to be tailored to the way you actually deliver support, especially if you host client sites, access customer data, subcontract development work or also need a website development agreement.

How Should You Deal With Scope Creep And Monthly Retainers?

You should deal with scope creep by defining included work, setting a process for extras and making payment timing crystal clear.

Scope creep is one of the biggest pain points in website maintenance. It usually starts with a small request, such as changing a banner, installing a plugin or fixing a form. Then the client asks for a landing page, tracking setup, product upload and new integration, all under the same retainer.

Your agreement should separate maintenance from new work. Maintenance might include minor bug fixes, CMS updates, plugin updates, uptime checks and small text or image changes. New work might include new page builds, design changes, custom development, ecommerce features, speed optimisation projects or integrations.

A Simple Retainer Example

Imagine Liam's agency provides a $1,200 plus GST monthly retainer. It includes 6 hours of support per month, with unused hours expiring at the end of the month. Extra work is charged at $180 plus GST per hour after written approval.

In March, the client uses 4 hours on updates and troubleshooting. No extra invoice applies. In April, the client asks for updates, a landing page and checkout changes. The work takes 10 hours. Liam applies the 6 included hours, gets written approval for the extra 4 hours and invoices $720 plus GST for the additional work.

That outcome is much easier to manage if the agreement already says:

• whether retainer hours roll over or expire
• whether unused hours are refundable
• what happens if the client exceeds the included hours
• when written approval is needed for extra work
• whether urgent work attracts a higher rate
• whether there's a minimum term, such as 3, 6 or 12 months
• how much notice either side must give to cancel, for example 30 days

Late payment also needs a clear clause. You can set due dates, suspension rights and recovery costs, but the terms should be reasonable and consistent with the Australian Consumer Law and any unfair contract terms risks.

What Should You Say About Hosting, Access, Backups And Security?

You should spell out who is responsible for hosting, access, backups and security because these issues are where blame can shift quickly.

If you manage hosting as part of an IT support services agreement, the client may assume you're responsible for all downtime, performance issues, cyber incidents and data loss. If the client controls hosting, you may not be able to fix issues quickly without proper access. Your agreement should close that gap.

Hosting And Admin Access

State whether hosting is provided by you, arranged through a third party or managed by the client. Then cover practical access points, including:

• who owns the hosting account and domain name
• who holds admin credentials and licence keys
• whether the client must use multi-factor authentication
• who can approve plugin, theme or CMS changes
• what happens if access is revoked or credentials are changed
• how access is handed back when the agreement ends

As a rule, your client should own their domain name and core business accounts. If you hold accounts on their behalf, your agreement should explain what happens on exit so the handover doesn't become messy.

Backups, Updates And Security

Be specific about backups. For example, you might say you take daily backups retained for 14 days, with one restoration attempt included per month. Or you might say backups are the hosting provider's responsibility and your role is limited to checking that backup settings are active.

Security clauses should cover CMS updates, plugin updates, unsupported software, malware, passwords and third party integrations. You should also state that no website can be guaranteed to be completely secure.

If you access personal information, such as customer databases, form submissions or ecommerce records, privacy obligations may matter too. The Privacy Act 1988 applies to many businesses, including businesses with annual turnover over $3 million and some smaller businesses in specific sectors. Your agreement should require both sides to handle personal information securely, limit access and notify each other promptly if there's a suspected data breach.

What Happens If Something Goes Wrong?

If something goes wrong, your agreement should tell both sides what to do first, how to prioritise the issue and when extra charges apply.

Website issues are stressful because they can affect sales, bookings and reputation. A clear support process keeps everyone calm and gives you a fair chance to fix the problem.

Start with priority levels. For example:

• Critical: the website is down, checkout isn't working or there's a suspected security incident.
• High: a key feature is broken, but the site is still operating.
• Medium: a non-critical bug or content issue needs attention.
• Low: general changes, advice or minor updates.

Then set response times. Be careful with the wording. A response time isn't the same as a fix time. You might commit to responding to critical issues within 2 business hours during support hours, but you may not be able to promise a full fix in that window, especially if the issue is caused by hosting, payment gateways, DNS, third party plugins or the client's own changes.

Your agreement should also require the client to give you useful information, such as screenshots, affected URLs, error messages, what changed recently and login access where needed.

If there's a security incident or suspected data breach, keep records of:

• when the issue was discovered
• who was notified and when
• what systems, pages or data were affected
• what immediate steps were taken
• what advice was received from hosting providers, security tools or other specialists

Where the incident involves personal information, the Notifiable Data Breaches scheme under the Privacy Act 1988 may require an assessment and, in some cases, notifications. Whether that applies depends on the client, the information involved and the seriousness of the risk, so it's worth getting tailored advice quickly.

Key Takeaways

• A website maintenance agreement should set clear boundaries around support, hosting, updates, security and payments.
• Monthly retainers work best when you define included hours, excluded work, extra rates and whether unused hours roll over.
• Response times should be realistic and should separate replying to a request from actually fixing the issue.
• Hosting access, backups and security responsibilities need to be written down before something goes wrong.
• Your terms should be fair and tailored to Australian law, including the Australian Consumer Law, privacy obligations and unfair contract terms rules.
• A template is only a starting point. The agreement should match the way your agency actually delivers website support.

If you'd like help with your website maintenance agreement, hosting and support terms, monthly retainer clauses or privacy and security obligations, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.