What a website or app maintenance retainer should actually include

A website or app is not finished at launch. Software it depends on gets security fixes every week, certificates expire, platforms change their rules and content goes stale. Maintenance is the work of keeping it safe, working and current. A retainer is the promise to do that work on a schedule, with defined response times.

Why maintenance got harder in 2026

Security certificates now expire twice as fast. Browsers and certificate authorities agreed to shorten the life of the SSL/TLS certificates that put the padlock on your site. Since 15 March 2026, a newly issued certificate lasts at most 200 days. That falls to 100 days from 15 March 2027 and 47 days from 15 March 2029. Manual yearly renewal is already obsolete; by 2029 it will mean a renewal every six or seven weeks. A retainer should include automated renewal and monitoring, so a lapsed certificate never shows your customers a security warning.

Data protection obligations arrive in May 2027. Under the DPDP rules, businesses must keep reasonable security safeguards, report personal data breaches and retain logs for at least a year. Your website and app are where most of that data lives. See our DPDP article.

The retainer checklist

Security

• Core, theme, framework and plugin or library updates, applied on a set schedule and tested on a staging copy first
• Critical security patches applied within a stated time, not "next month"
• Firewall and malware scanning, with a named person alerted
• Access review: remove old admins, enforce two-factor authentication

Backups and recovery

• Automated daily backups of files and database, stored off the server
• Retention of at least 30 days of backups
• A test restore at least every quarter. A backup that has never been restored is a hope, not a backup.

Availability

• Uptime monitoring every few minutes, with alerts
• SSL certificate and domain renewal tracking, automated where possible
• Hosting, email deliverability and DNS kept healthy

Performance and compatibility

• Monthly speed and mobile check, with fixes for regressions
• Browser and operating-system compatibility after major updates
• For mobile apps: updates for new Android and iOS versions and app store policy changes, which otherwise remove apps from the stores

Small changes

• A defined number of hours each month for content updates and minor changes, with a clear rate for anything beyond

Reporting

• A short monthly report: updates applied, incidents, uptime, backups verified, hours used

Response times: put them in writing

These are typical figures for a small business, not a standard. Whatever you agree, write it down, and agree what happens if it is missed.

Ownership: the clause most retainers skip

Before you sign, confirm that your business, not the agency, owns and controls:

• The domain name, registered in your name, with your email as the owner contact
• The hosting and cloud accounts, or at least admin access to them
• The code repository and design files, with copyright assigned to you in writing
• Analytics, Google Business Profile and ad accounts
• An exit clause: on termination, the agency hands over credentials, code and documentation within a set number of days

If the agency disappears, this is the difference between a two-day handover and rebuilding from scratch.

How to judge a proposal

A credible retainer proposal names the tasks and their frequency, states response times by severity, includes backup restore testing, explains how certificates are handled, gives a monthly hours allowance and an overage rate, and says who owns what. A proposal that says "maintenance: ₹X per month" and nothing else is a support phone number, not a retainer.

The honest summary

Maintenance is cheap insurance that looks like an expense until the day it is needed. Pay for tasks, schedules and response times you can check, test the backups, automate certificates now that they expire every 200 days, and make sure you own the keys to everything.