Website maintenance subscription UK: what to look for

“Website maintenance” used to mean “we will patch your WordPress plugins on a Tuesday and email you a screenshot of the dashboard.” In 2026 it means a subscription bundle, build, host, patch, back up, edit, support, all on one invoice.

The question worth asking, before you sign up to anything monthly, is whether the subscription is a service or a payment plan with a service wrapper.

Those two products look almost identical on a landing page. They behave nothing alike at month seven, when something breaks. Here are the seven signals that separate them, in the order I would run them against a shortlist.

Signal 1: Named hosting and jurisdiction

Where, physically, is the server?

This is the first question because it is the one that tells you the most about the rest. A provider who can name their host and region, “Vercel, London lhr1 region, EU control plane” or “Cloudflare Workers, EU data residency” or “AWS eu-west-2 London”, is a provider who has thought about UK GDPR posture, latency, and what happens if a US data-transfer regime changes.

A provider whose answer is “do not worry about that, it is all handled” is a provider who has either subcontracted hosting and does not know, or does not want you to know because the answer is “a shared US box on whichever reseller account is cheapest this quarter.”

For regulated verticals (clinics, solicitors, accountants, schools, anyone holding special category data under UK GDPR) this is not optional. The ICO expects you to know where your data processor sits. If the maintenance subscription provider cannot tell you, you cannot tell the ICO. Walk. Our EU-sovereign by design approach explains how we answer that question by default, and the GDPR-friendly stack we build on names every vendor and region.

Signal 2: Backup policy in writing

The phrase to listen for is “we back up regularly.”

That is not a backup policy. That is a vibe. Three follow-up questions force the vibe into a policy:

1. How often? Daily is the floor in 2026. Hourly is better for any site that takes bookings or payments.
2. How long are backups retained? 30 days is thin. 90 days is the working minimum. 365 days is what you want if you ever have to roll back a slow-burn problem (a content change a staff member made two months ago that nobody noticed broke the conversion flow).
3. When was the last restore actually tested? Backups that have never been restored are a hope, not a backup. A serious provider can name the last test date.

If all three answers come back specific, you are dealing with an operation. If any of them come back as “we would have to check”, walk.

Signal 3: Response time SLA

What is the response window when you email: 12 hours, 24, 48? Weekdays only? Bank holidays? After-hours?

And, quietly the most important, who replies?

A subscription where the reply comes from a rotating ticket queue (“Hi, this is Marcus, I will be your support agent today”) is operationally very different from one where the reply comes from the same person every time. Both can work. They produce very different experiences. The first is cheaper to scale; the second is harder to scale but means the person fixing the bug already knows your site, your sector, and which page does your booking.

Ask. Then ask what happens after 5pm. Then ask what happens on a Saturday when the contact form starts bouncing. The honest answer is rarely “instant 24/7” for any UK SMB price point, but “24 hours weekdays, best-effort weekends, same person” is a fine answer. “We aim to get back to you” is not.

Signal 4: In-scope vs out-of-scope clarity

This is where most maintenance subscriptions quietly break.

A “monthly content update” can mean any of the following, depending on the provider:

• One paragraph swap, on one existing page.
• One existing page edited, no new pages.
• One new page added per month, capped at 500 words.
• “Anything that takes us less than 30 minutes.”
• “Anything reasonable.”

Those are five different products at the same price.

Specific scope = specific service. Vague scope = scope creep, friction, and a quiet pattern of small add-on invoices that eventually become the reason you cancel. Before you sign, get the in-scope list in writing, preferably on a public page, not a salesperson’s email. If they will not publish it, they are keeping the option to renegotiate it later.

The corollary question: what is out-of-scope, and what does out-of-scope cost? A new e-commerce checkout, a third-party booking integration, a full brand refresh: these are not maintenance. They are projects. A serious provider will tell you that upfront and quote them separately. A less serious one will absorb them into the subscription, then either burn out delivering them or quietly stop delivering anything else that month.

Signal 5: Files handover on cancellation

If you cancel in month 24, what do you walk away with?

The answers fall into three honest tiers, and one dishonest one:

• Best: the full source, HTML, CSS, JS, content, database export, deploy instructions, delivered as a zip or a Git repository you own. UK Web Marketing operates on no lock-in, cancel any time: there is no contract that holds your site hostage, so if the relationship ends, the work is yours to take elsewhere.
• Acceptable: a content export (text, images, structured data) plus DNS pointing, so you can rebuild elsewhere without losing the body of work.
• Thin: “We will point your domain wherever you want.” You get nothing else.
• Walk-away signal: “The site goes offline 30 days after cancellation and we retain the IP.” This is a payment plan dressed as a subscription. You paid for 24 months of work and the work is not yours. Do not sign this.

The legal frame: under the Consumer Contracts Regulations 2013 you have a 14-day cooling-off right on distance-sold services. Beyond that, what you own is whatever the contract says you own. Read the contract.

Signal 6: ICO registration and data-processor agreement

For any regulated practice, and increasingly for any site running a contact form that captures health, legal, financial, or family information, the provider must be registered with the ICO and willing to sign a data-processor agreement (DPA) under UK GDPR Article 28. (You can read our own Article 28 data-processor agreement as an example of what a straight answer looks like.)

The two-minute test:

1. Ask for their ICO registration number. (UK Web Marketing’s, for instance, is on the credentials page.) You can verify any number live on the ICO register.
2. Ask whether they have a standard DPA they can send you, or whether they will counter-sign yours.

If the answer to either is “a what?” or “we do not really do that”, you have found a provider who is not operating at a level appropriate for regulated work. That is not a judgement on their craft. It is a judgement on what risk they are transferring to you. Walk.

Signal 7: Performance baseline

Performance is the one signal that is measurable from the outside, before you sign anything.

A serious provider will commit to a Core Web Vitals target, typically LCP under 1.5 seconds, INP under 200ms, CLS under 0.1, and publish a Lighthouse score on their own marketing site that backs it up. The reason: Google’s own research (Daniel An, Think with Google, February 2017) found mobile bounce rises 106% as load time goes from 1 second to 6 seconds. Performance is not a vanity metric. It is a revenue line.

Without a target, “fast” is marketing. Run your shortlist through PageSpeed Insights before you book a call. If their own site is at LCP 4.2 seconds, they will not build yours at 0.9.

The cheap signal nobody markets: founder-led delivery

There is one structural signal that explains why the maths on a founder-led monthly retainer can be real rather than a loss-leader, and it does not show up on most comparison pages.

If the people who reply to your email are the people who build your site, you have cut out the layer that creates most of the cost.

In an agency model, the project manager who talks to you is not the developer who codes it is not the designer who designed it is not the account director who scoped it. Each of those roles is a salary, a margin, a meeting, and a Slack hand-off. The hand-offs are where most agency budgets actually go, not the code.

A founder-led subscription collapses those hand-offs: the people you deal with already understand your site, your sector, and what you said three months ago. That is why website management that starts from £49/month, scaling to a full acquisition engine as the work grows, is sustainable when the same scope of work, agency-routed, costs £3,000 to £15,000 upfront plus £150 to £500/month retainer, which is £8,400 to £33,000 over three years.

It also disciplines the model. A service like this only works if every site on the books can credibly be run to this standard, so the standard sets the pace at which new work comes on, not the sales pipeline. UK Web Marketing currently looks after hand-built UK small-business sites across a range of industries, with one accountable partner on every one of them. The model is honest about that.

The seven signals, as a one-pass filter

Run a shortlist through these in order. Any single walk is enough.

1. Hosting + jurisdiction named: server, region, control-plane location.
2. Backup policy: frequency, retention, last restore date.
3. Response SLA: window, who replies, weekends.
4. In-scope written: specific scope per month, out-of-scope price list.
5. Files handover: what you own on cancellation, on what timeline.
6. ICO + DPA: number on the public register, standard DPA available.
7. Performance target: Core Web Vitals committed, their own site passes.

If a provider passes all seven, you have found an operationally serious managed website service. The price can start low: named-operator custodianship of a site you already have begins at £49 a month, quoted to your business, rising for the content, CRO, and growth work that has to win you customers, depending on what is bundled, and services may vary. Whether you sit at the lighter end or the fuller end is then a question of what work the site has to do for you, not a question of whether the subscription is real. The way to find your own number is not to pick a package off a page: it is to book the free 7-signal audit, then, if the site is doing real commercial work, the paid Marketing and Automation Deep-Dive at £300, which gives you a written audit and a fixed quote and is credited in full against any build you go on to commission.

If a provider passes fewer than four, you have found a payment plan with a service wrapper. The marketing page may look identical. The product is not.

---

→ Run the 7-signal audit against your current provider or shortlist. One pass, no commitment. If you are already weighing managed website service options, the 3-year UK maths, the complete 2026 guide, and the breakdown of website management vs maintenance are the natural next reads.

Last updated: 29 June 2026. Operator: TicketWave HQ Ltd, company no. 17143167, registered Pudsey, Leeds LS28 6LE. Author: Jordan Gilbert, founder of UK Web Marketing, 20+ years building websites since 2006. Attribution to UK Web Marketing appreciated, not required.