Website Maintenance AMC in India: What Should Actually Be Included

A business owner we spoke with last year had signed an "AMC" for their website that, on paper, cost very little. A year later, the site went down for four days because nobody had a current backup, the WordPress version was two major releases behind, and the developer who originally built the site had stopped answering calls. The AMC document existed. What it actually covered turned out to be almost nothing — a vague promise of "support" with no defined scope.

This is the recurring problem with website AMCs in India: the term gets used loosely enough that two businesses paying for "maintenance" can be receiving wildly different levels of actual protection. This guide breaks down what an Annual Maintenance Contract for a website should genuinely include, what it typically does not cover, and why skipping this ongoing work quietly compounds risk over time.

Quick Answer

What an Annual Maintenance Contract Should Actually Cover

An AMC exists to keep a website running safely and reliably between larger projects — it is not a substitute for a redesign, and it is not simply a support hotline. The core value of a properly scoped AMC is that it catches problems before they become visible failures: a plugin vulnerability gets patched before it's exploited, a backup gets taken before something breaks, and a slow page gets flagged before it starts costing conversions.

A website that already has a solid foundation is a separate conversation from ongoing maintenance — if a site is due for a bigger structural rethink rather than routine upkeep, our website redesign checklist covers what a proper pre-launch process for that looks like. AMC picks up after that point, keeping a site healthy for the months and years it runs without a full rebuild.

Security Patches and Software Updates

Every piece of software a website runs on — the CMS core, plugins, themes, server-level dependencies — receives periodic security updates as vulnerabilities are discovered and patched. Left unapplied, these known vulnerabilities become an open door, since attackers routinely scan for sites running outdated, unpatched versions of common software. A properly run AMC applies these updates on a defined schedule, tests that nothing breaks as a result, and keeps a record of what was updated and when.

This matters more than it might seem from the outside. A website that looks fine on the surface can be running software with a publicly documented vulnerability for months, simply because nobody was responsible for checking. Security updates are rarely the most visible part of an AMC, but they're arguably the most important.

Uptime Monitoring and Backup Schedules

A website that's down isn't generating leads, isn't processing orders, and isn't building trust — every minute of unplanned downtime has a real cost. Uptime monitoring means an automated system checks the site at regular intervals and alerts someone the moment it goes down, so the response starts within minutes rather than whenever someone happens to notice the site is unreachable.

Backups are the safety net for everything else. A site can be hacked, a plugin update can go wrong, a database can get corrupted — and in every one of these scenarios, a recent, tested, restorable backup is what turns a disaster into an inconvenience. The right backup frequency depends on how often the site's content or data changes:

A backup that has never been tested for restoration isn't a real safety net — it's an assumption. Part of a properly run AMC includes periodically confirming that a backup can actually be restored, not just that a backup file exists somewhere.

Content Updates and Plugin/Dependency Updates

Most businesses need small content changes more often than they expect — a new price, an updated service description, a changed phone number, a seasonal banner. A basic AMC typically includes a defined allowance of these minor content updates each month, handled without needing to negotiate a separate quote for every small change.

For CMS-based sites specifically — WordPress being the most common example — plugin and theme updates deserve their own attention within an AMC, separate from core security patching. Plugins are frequently the weakest link in a WordPress site's security, and an AMC that only patches the CMS core while ignoring an outdated plugin stack is leaving the most common attack surface unaddressed.

We've inherited more than one website where the "maintenance" the client was paying for turned out to mean someone occasionally logging in to check it hadn't crashed. That's not maintenance — it's a false sense of security with a monthly invoice attached.

Niraj Kumar Patel, Founder, Rivavya

Performance Monitoring

A website's load speed doesn't stay constant on its own — image libraries grow, plugins accumulate, and server resources get consumed by things unrelated to the original build. Performance monitoring as part of an AMC means periodically checking page speed and Core Web Vitals metrics, and flagging when something has quietly degraded enough to start affecting user experience or search rankings, rather than waiting for a visible slowdown or a drop in traffic to prompt an investigation.

What a Basic AMC Typically Does NOT Include

This distinction matters because it's a common source of friction between businesses and their maintenance provider — a business assumes "maintenance" means any work on the website, while the provider has scoped the AMC around routine upkeep only. Getting clear, in writing, about what falls inside versus outside the AMC before signing avoids this disagreement later. If a larger project comes up mid-contract — a new page template, an added booking feature — that's reasonably quoted and handled separately from the AMC itself.

Why Skipping Maintenance Creates Compounding Risk

The risk of skipping website maintenance rarely shows up immediately, which is exactly why it's easy to deprioritize. A site with unpatched software doesn't necessarily get hacked in week one — but the exposure sits there, growing, until eventually it does. A site without recent backups doesn't necessarily lose data tomorrow — but when something eventually does go wrong, there's nothing to restore from. An integration that silently breaks after a platform update on the other end — a payment gateway, a shipping API, a CRM connection — can go unnoticed for weeks if nobody is actively monitoring for it.

These risks compound rather than staying flat over time. A site that's one CMS version behind is a minor gap; the same site three major versions behind, with a stack of unpatched plugins, is a meaningfully larger attack surface and a much harder, more expensive problem to fix retroactively than it would have been to prevent incrementally.

A Practical Way to Evaluate an AMC Before Signing

1. Ask for the exact scope in writing — which specific tasks are included, and at what frequency
2. Confirm backup frequency and, separately, whether backup restoration is ever actually tested
3. Ask how uptime monitoring works and what the response time is when the site goes down
4. Clarify how many hours or content changes per month are included before extra charges apply
5. Confirm whether plugin and dependency updates are included for CMS-based sites specifically
6. Get clear on what counts as "project work" outside the AMC, so scope disputes don't arise later

An AMC that can't answer these questions clearly is likely to be the vague, low-value kind — a monthly or annual line item with little concrete protection behind it. This is a different conversation from choosing the underlying platform itself; our custom website vs template website guide covers that earlier decision, which does affect how much ongoing maintenance a site is likely to need.

Who Actually Needs a Formal AMC

• Ecommerce stores — payment processing, inventory, and checkout flows are too business-critical to leave unmonitored
• Lead-generation business sites — downtime or broken forms directly cost enquiries, as covered in our piece on a poor website losing you customers
• CMS-based sites with multiple plugins — more moving parts means more that can silently break or become vulnerable
• Franchise or multi-location businesses — a single vulnerability or outage can affect brand perception across every location
• Any site handling customer data — data protection expectations make security patching non-negotiable, not optional

A simple, rarely updated static site with no forms, no ecommerce, and no sensitive data has a lower-stakes maintenance profile — but "lower-stakes" doesn't mean "none." Even a basic site benefits from periodic security patching and a working backup, since the cost of neglecting both is disproportionate to the cost of maintaining them properly.

In-House vs Outsourced Maintenance

Some businesses handle website maintenance in-house, particularly if they already employ someone technical. This can work well when that person genuinely has the time and expertise to stay current on security patching, but it often quietly fails when maintenance becomes a background task squeezed in between other responsibilities — updates get delayed, backups get skipped during busy periods, and the informal nature of the arrangement means nobody notices until something breaks.

Outsourcing maintenance to a dedicated provider trades that informal risk for a defined scope and accountability — the AMC document itself becomes the record of what's supposed to happen and how often. This tends to suit businesses without in-house technical staff, or those who'd rather have a specialist handling security patching than a generalist team member fitting it in around other work. Neither approach is universally correct; the right choice depends on whether the business genuinely has the internal capacity to treat maintenance as a real priority rather than an afterthought.

Frequently Asked Questions