Why do web agencies charge monthly instead of one-time?

Security patching of dependencies recurs, because new vulnerabilities are disclosed continuously. Field performance monitoring recurs, because it is measured on real visitors over a rolling window. Index and coverage monitoring recurs, because Google re-crawls and re-decides. Content that answers new questions recurs, because the questions change.

Design does not recur: a finished design is finished. Page build does not recur, beyond once per page. Information architecture does not recur until the business changes.

The top half is a retainer. The bottom half is a project, and an agency charging monthly for the bottom half is charging you rent on a delivered asset.

On the first row specifically: OWASP's Top 10 lists Vulnerable and Outdated Components as a category in its own right. The point is not that your site is insecure today. It is that “today” moves, and nothing about a site being finished stops its dependencies from aging.

On the second: the Core Web Vitals thresholds are published and numeric — good LCP at 2.5 seconds or less, INP at 200 milliseconds or less, and CLS at 0.1 or less, assessed at the 75th percentile of real page loads. Those are field measurements over a rolling window, which is why the number moves without the code moving, and Search Console's Core Web Vitals report is where the drift becomes visible.

On the fourth: Google's creating helpful, reliable, people-first content is the standard the content half is judged against, and it is a standard about the page, not about a publishing cadence. Monthly blog posts are not what it asks for.

Ask for it itemized in hours or deliverables, because the phrase covers both real work and nothing at all. A fee you cannot decompose is a fee you cannot evaluate.

Dependency and platform updates should arrive as a changelog, with versions and dates. Backups should arrive as a restore that was actually tested, dated. Uptime and error monitoring should arrive as incidents, with duration. Core Web Vitals tracking should arrive as the Search Console report, read rather than screenshotted. Search Console coverage review should name what fell out of the index and what was done. Content changes should name pages changed, with dates.

What does not belong in it: hosting resold at a markup you cannot see, "SEO" with no named deliverable, and the build itself amortized into perpetuity. Google’s own SEO starter guide is a public document; a retainer that delivers only its contents is reselling free advice.

The question that settles it: what did you do last month, and what changed because of it? An agency doing the top half of the table above answers in specifics. An agency doing the bottom half answers in adjectives.

And the ownership question sits underneath this one. A retainer you cannot leave is not a retainer, it is a dependency.