Website maintenance subscription UK — what to look for

“Website maintenance” used to mean “we’ll patch your WordPress plugins on a Tuesday and email you a screenshot of the dashboard.” In 2026 it means a subscription bundle — build, host, patch, back up, edit, support — all on one invoice.

The question worth asking, before you sign up to anything monthly, is whether the subscription is a service or a payment plan with a service wrapper.

Those two products look almost identical on a landing page. They behave nothing alike at month seven, when something breaks. Here are the seven signals that separate them, in the order I’d run them against a shortlist.

Signal 1 — Named hosting and jurisdiction

Where, physically, is the server?

This is the first question because it’s the one that tells you the most about the rest. A provider who can name their host and region — “Vercel, London lhr1 region, EU control plane” or “Cloudflare Workers, EU data residency” or “AWS eu-west-2 London” — is a provider who has thought about UK GDPR posture, latency, and what happens if a US data-transfer regime changes.

A provider whose answer is “don’t worry about that, it’s all handled” is a provider who has either subcontracted hosting and doesn’t know, or doesn’t want you to know because the answer is “a shared US box on whichever reseller account is cheapest this quarter.”

For regulated verticals — clinics, solicitors, accountants, schools, anyone holding special category data under UK GDPR — this isn’t optional. The ICO expects you to know where your data processor sits. If the maintenance subscription provider can’t tell you, you can’t tell the ICO. Walk.

Signal 2 — Backup policy in writing

The phrase to listen for is “we back up regularly.”

That is not a backup policy. That is a vibe. Three follow-up questions force the vibe into a policy:

1. How often? Daily is the floor in 2026. Hourly is better for any site that takes bookings or payments.
2. How long are backups retained? 30 days is thin. 90 days is the working minimum. 365 days is what you want if you ever have to roll back a slow-burn problem (a content change a staff member made two months ago that nobody noticed broke the conversion flow).
3. When was the last restore actually tested? Backups that have never been restored are a hope, not a backup. A serious provider can name the last test date.

If all three answers come back specific, you’re dealing with an operation. If any of them come back as “we’d have to check” — walk.

Signal 3 — Response time SLA

What’s the response window when you email — 12 hours, 24, 48? Weekdays only? Bank holidays? After-hours?

And — quietly the most important — who replies?

A subscription where the reply comes from a rotating ticket queue (“Hi, this is Marcus, I’ll be your support agent today”) is operationally very different from one where the reply comes from the same person every time. Both can work. They produce very different experiences. The first is cheaper to scale; the second is harder to scale but means the person fixing the bug already knows your site, your sector, and which page does your booking.

Ask. Then ask what happens after 5pm. Then ask what happens on a Saturday when the contact form starts bouncing. The honest answer is rarely “instant 24/7” for any UK SMB price point — but “24 hours weekdays, best-effort weekends, same person” is a fine answer. “We aim to get back to you” isn’t.

Signal 4 — In-scope vs out-of-scope clarity

This is where most maintenance subscriptions quietly break.

A “monthly content update” can mean any of the following, depending on the provider:

• One paragraph swap, on one existing page.
• One existing page edited, no new pages.
• One new page added per month, capped at 500 words.
• “Anything that takes us less than 30 minutes.”
• “Anything reasonable.”

Those are five different products at the same price.

Specific scope = specific service. Vague scope = scope creep, friction, and a quiet pattern of small add-on invoices that eventually become the reason you cancel. Before you sign, get the in-scope list in writing — preferably on a public page, not a salesperson’s email. If they won’t publish it, they’re keeping the option to renegotiate it later.

The corollary question: what’s out-of-scope, and what does out-of-scope cost? A new e-commerce checkout, a third-party booking integration, a full brand refresh — these aren’t maintenance. They’re projects. A serious provider will tell you that upfront and quote them separately. A less serious one will absorb them into the subscription, then either burn out delivering them or quietly stop delivering anything else that month.

Signal 5 — Files handover on cancellation

If you cancel in month 24, what do you walk away with?

The answers fall into three honest tiers, and one dishonest one:

• Best: the full source — HTML, CSS, JS, content, database export, deploy instructions — delivered as a zip or a Git repository you own. Some providers (UK Web Marketing included) gate this on having paid the build back; the files transfer at month 13, once £540 of subscription has covered the actual build cost.
• Acceptable: a content export (text, images, structured data) plus DNS pointing, so you can rebuild elsewhere without losing the body of work.
• Thin: “We’ll point your domain wherever you want.” You get nothing else.
• Walk-away signal: “The site goes offline 30 days after cancellation and we retain the IP.” This is a payment plan dressed as a subscription. You paid for 24 months of work and the work isn’t yours. Don’t sign this.

The legal frame: under the Consumer Contracts Regulations 2013 you have a 14-day cooling-off right on distance-sold services. Beyond that, what you own is whatever the contract says you own. Read the contract.

Signal 6 — ICO registration and data-processor agreement

For any regulated practice — and increasingly for any site running a contact form that captures health, legal, financial, or family information — the provider must be registered with the ICO and willing to sign a data-processor agreement (DPA) under UK GDPR Article 28.

The two-minute test:

1. Ask for their ICO registration number. (UK Web Marketing’s, for instance, is on the credentials page.) You can verify any number live on the ICO register.
2. Ask whether they have a standard DPA they can send you, or whether they’ll counter-sign yours.

If the answer to either is “a what?” or “we don’t really do that”, you’ve found a provider who isn’t operating at a level appropriate for regulated work. That isn’t a judgement on their craft. It’s a judgement on what risk they’re transferring to you. Walk.

Signal 7 — Performance baseline

Performance is the one signal that’s measurable from the outside, before you sign anything.

A serious provider will commit to a Core Web Vitals target — typically LCP under 1.5 seconds, INP under 200ms, CLS under 0.1 — and publish a Lighthouse score on their own marketing site that backs it up. The reason: Google’s own research (Daniel An, Think with Google, February 2017) found mobile bounce rises 106% as load time goes from 1 second to 6 seconds. Performance is not a vanity metric. It’s a revenue line.

Without a target, “fast” is marketing. Run your shortlist through PageSpeed Insights before you book a call. If their own site is at LCP 4.2 seconds, they will not build yours at 0.9.

The cheap signal nobody markets: founder-led delivery

There’s one structural signal that explains why the maths on a £45/month subscription can be real rather than a loss-leader, and it doesn’t show up on most comparison pages.

If the person who replies to your email is the person who builds your site, you’ve cut out the layer that creates most of the cost.

In an agency model, the project manager who talks to you isn’t the developer who codes it isn’t the designer who designed it isn’t the account director who scoped it. Each of those roles is a salary, a margin, a meeting, and a Slack hand-off. The hand-offs are where most agency budgets actually go — not the code.

A founder-led, operator-led subscription collapses those hand-offs into one person who already understands your site, your sector, and what you said three months ago. That’s why a single tier at £45/month is sustainable when the same scope of work, agency-routed, costs £3,000–£15,000 upfront plus £150–£500/month retainer — £8,400 to £33,000 over three years.

It also caps the model. A founder-led service has a ceiling on how many sites one operator can credibly run. UK Web Marketing’s ceiling is roughly 90+ live UK small-business sites today; past a point, you stop taking new clients and start building Bespoke, or you hire and become an agency. Either is fine. The model is honest about which one it is.

The seven signals, as a one-pass filter

Run a shortlist through these in order. Any single walk is enough.

1. Hosting + jurisdiction named — server, region, control-plane location.
2. Backup policy — frequency, retention, last restore date.
3. Response SLA — window, who replies, weekends.
4. In-scope written — specific scope per month, out-of-scope price list.
5. Files handover — what you own on cancellation, on what timeline.
6. ICO + DPA — number on the public register, standard DPA available.
7. Performance target — Core Web Vitals committed, their own site passes.

If a provider passes all seven, you’ve found an operationally serious managed website service. The price will tend to land somewhere in the £40–£200/month range depending on what’s bundled. Whether you go Foundation at £45 or Growth Engine at £195 is then a question of what work the site has to do for you — not a question of whether the subscription is real.

If a provider passes fewer than four, you’ve found a payment plan with a service wrapper. The marketing page may look identical. The product is not.

---

→ Run the 7-signal audit against your current provider or shortlist. One pass, no commitment. If you’re already weighing managed website service options, the 3-year UK maths and the complete 2026 guide are the natural next reads.

Last updated: 3 June 2026. Operator: TicketWave HQ Ltd, company no. 17143167, registered Pudsey, Leeds LS28 6LE. Author: Jordan Gilbert — Technical Co-Founder & Interim CTO, Loughborough engineering + HarvardX (GSD1x). Attribution to UK Web Marketing appreciated, not required.