What a maintenance retainer buys, line by line

Dependency and platform updates owe you a changelog, with versions and dates. Backups owe you a restore that was actually performed, dated. Uptime and error monitoring owe you incidents, with duration. Core Web Vitals tracking owes you the Search Console report, read. Index and coverage review owes you the page indexing report, with what changed. Content changes owe you pages edited, with dates.

The first row is the one that justifies the recurrence rather than the price. OWASP's Top 10 carries Vulnerable and Outdated Components as a category because disclosure is continuous: nothing about a site being finished stops its dependencies from aging. Rows four and five are the two that are facts about your site rather than interpretations of it, and both live in an account you own.

Worth it when the six rows above are happening and you can see them. Not worth it when the invoice says "SEO and maintenance" and the deliverable is a PDF.

The question that settles it: what did you do last month, and what changed because of it? An agency doing the work answers in versions, dates and URLs. An agency not doing it answers in adjectives.

Two things that commonly sit inside a maintenance fee and should not: hosting resold at an invisible markup, and the build amortized into perpetuity. The second is the expensive one.

What a maintenance plan is not: growth. Patching, backups and monitoring keep a site from decaying. They do not make it answer more questions than it did last year, and a retainer sold as maintenance that is expected to produce growth is a disagreement waiting to happen.