Website Maintenance in New Zealand

What you are actually buying

Maintenance is sold as a monthly fee and bought, in practice, as insurance against a specific and predictable event: your site being broken, out of date, or unreachable at a moment when it matters.

The arithmetic is unusually clear. A neglected site — three years of unpatched plugins, an old PHP version, no working backup — costs $3,000 to $12,000 to bring back to a safe state. That is before considering what happens if it is compromised, defaced, or quietly used to send spam until your domain is blacklisted.

At $150 a month you spend $1,800 a year to avoid that, and you get somebody who already knows your site when something goes wrong at 4pm on a Friday. For most businesses this is not a close decision.

The minimum worth paying for

Insist on all of these, itemised in the agreement:

• Updates on a schedule. Platform, plugins and themes, applied monthly at least, not when someone remembers.
• Off-site backups with a stated retention — thirty days is a reasonable minimum — held somewhere other than the same server.
• A tested restore. See below; this is the one that gets skipped.
• Uptime monitoring that alerts a person, so you are not the one who notices.
• SSL and domain renewal watched. Expired certificates cause a surprising share of outages.
• A monthly report saying what was actually done.

That last one matters. Without a report you are paying for something you cannot verify, and maintenance is the easiest service in the world to quietly not perform.

Ask when a restore was last tested

This is the single best question in the category, and the answers vary enormously.

Plenty of providers take backups. Far fewer have ever restored one. A backup job that has been failing silently for eight months looks identical to a working one right up until the afternoon you need it.

Ask:

• When did you last perform an actual restore?
• How long did it take?
• Where are the backups held, and could someone with access to the server delete them?
• How far back can we go?

A provider who tests annually and can tell you the number is worth more than one who is $40 a month cheaper.

Understand what counts as "included"

This is where most disagreements come from, so settle it before signing:

• Are content changes included, or billed? How many hours?
• Do unused hours roll over, or vanish at month end?
• What is the hourly rate beyond the allowance?
• Is a new page a content change or development?
• Is hosting included in the fee or billed separately?
• What happens if the site is hacked — is remediation included, or is that a new job?

That last question is worth asking plainly. Some agreements exclude exactly the event you thought you were insuring against.

Response times, and whether they include Friday night

A stated response time is only useful if it covers the hours when things break.

Ask what happens when the site goes down at 6pm on a Friday, on a public holiday, or during the Christmas period. Many small providers are one or two people, which is fine — but you should know whether the answer is Monday, because for an ecommerce business Monday is an expensive answer.

If the site takes orders, ask about weekend cover specifically and expect to pay for it.

Check who holds the keys before you commit

Three things are often assumed to be one thing and are frequently held by three different parties:

1. The domain name, at a registrar.
2. The DNS, which points the domain at your site and your email.
3. The hosting, where the site actually lives.

All three should be in your company's name, with your billing, and your provider granted access. An arrangement where the provider owns the domain or the hosting account is how a maintenance agreement becomes difficult to leave — and you find out at the worst possible moment.

If your domain ends in .nz you can check the registrar yourself in thirty seconds.

Ask what leaving looks like

Before signing, not after. You should be able to receive your code, your database, a current backup, and full access to hosting, DNS and domain — without a fee and without a difficult conversation.

A provider who answers that question easily is telling you they expect to keep you by being good. One who becomes vague is telling you something else.

Comparing five quotes

Read for:

• Who itemised what is included rather than describing "care"?
• Who has actually tested a restore, and could say when?
• Who was clear about response times outside business hours?
• Who provides a monthly report?
• Who answered the leaving question without hesitating?

Describe what the site is built on, how often you change content, whether it takes orders, and what happened last time something went wrong. Providers worth hiring will ask who currently controls your domain before they quote.