Website AMC in India: What a Maintenance Contract Should Include

A website AMC (Annual Maintenance Contract) is a yearly agreement in which a provider keeps your website secure, updated, backed up and working. A good one covers software and plugin updates, security patching, tested backups, uptime monitoring, SSL and domain renewals, an allowance for content changes, performance checks, defined response times and regular reports.

The difference between a useful AMC and a disappointing one is rarely in the headline. It is in the detail: what counts as maintenance, how quickly someone responds when the site goes down, and who controls the accounts. This guide explains what to look for, what is usually excluded and which questions to ask before you sign.

What is a website AMC?

A website AMC is a fixed-term service agreement, usually renewed every year, that covers the ongoing care of a website after it has been built. It turns maintenance from an ad hoc, call-when-broken arrangement into a defined scope with agreed response times.

Websites are not finished when they go live. Content management systems, plugins, themes, frameworks and server software receive regular updates, many of them security fixes. Certificates and domains expire. Contact forms stop delivering email after a hosting change. Without someone clearly responsible, these small issues pile up until one of them takes the site offline or exposes customer data.

An AMC is most useful for businesses that rely on their website for enquiries, bookings or sales and do not have an in-house developer. It applies to WordPress sites, custom-built sites, online stores and web applications alike, though the scope differs for each.

What should a good website AMC include?

A good AMC covers prevention, recovery and communication. Use the sections below as a checklist when comparing proposals. Each item should be written into the contract, not just mentioned in a sales call.

Software updates and security patching

The provider should update the core platform, plugins, themes and libraries and, where they manage the server, the operating system and runtime such as PHP or Node.js. Ask how updates are applied:

• Updates tested on a staging copy before going live, especially major version changes.
• A backup taken immediately before each update, so changes can be rolled back.
• Critical security patches applied promptly rather than waiting for the next monthly cycle.
• Unused plugins, themes and admin accounts removed, since they add risk without adding value.

Disciplined software updates and patch management is the part of maintenance that most directly reduces the risk of a compromised website.

Backups and restore tests

Backups are only valuable if they can be restored. A good contract specifies backup frequency, what is included (files and database), how long backups are retained and where they are stored. Copies should be kept away from the hosting server, so a server failure or compromise does not wipe out both the site and its backups. Insist on periodic restore tests, where a backup is actually restored to a test environment and checked.

Uptime and security monitoring

Automated website monitoring checks the site at regular intervals and alerts the provider when it goes down, returns errors or has an SSL certificate close to expiry. Good AMCs also include malware scanning, login protection and checks that contact forms and payment flows still work, because a site can be online while its enquiry form silently fails.

SSL, domain and hosting renewals

Expired SSL certificates and lapsed domains are among the most avoidable causes of downtime. The AMC should state who tracks renewal dates, who pays the renewal fees and how far in advance you will be reminded. Many hosts now issue certificates that renew automatically, but auto-renewal can still fail after DNS or server changes, so it should be monitored too.

Content changes allowance

Most AMCs include an allowance for small changes, such as updating text, replacing images, adding a team member or publishing a blog post. The allowance should be stated in hours or number of requests per month or quarter, along with whether unused time carries forward. Vague phrases such as 'minor changes included' lead to disputes.

Performance checks

Speed tends to degrade as images, plugins and scripts accumulate. A good AMC includes periodic checks of page speed and Core Web Vitals, database clean-up, cache configuration and image optimisation. Deeper website performance optimisation may be quoted separately, but routine checks belong in maintenance.

Incident response and reporting

The contract should define how you report a problem, how issues are prioritised and how quickly the provider responds. It should also include a regular report, monthly or quarterly, listing updates applied, backups completed, uptime, incidents handled and recommendations. Reports are your evidence that the work is actually being done.

What is usually excluded from a website AMC?

Most AMCs cover maintaining what already exists, not building something new. Expect the following to be excluded or charged separately, and check that the contract says so clearly:

• New pages, new features, redesigns and major functionality changes.
• Content writing, photography and graphic design beyond the agreed allowance.
• SEO campaigns, advertising and social media management.
• Hosting, domain, premium plugin licences and third-party subscription fees, unless explicitly bundled.
• Fixing problems caused by changes made by you or another vendor without coordination.
• Major platform upgrades or migrations, such as moving to a new host or rebuilding on a newer framework.
• Clean-up after a hack, in some contracts, or only up to a stated limit.

None of these exclusions is unreasonable. The problem is discovering them only when you urgently need the work done.

Which SLA terms should you check?

The service level agreement (SLA) is the part of the AMC that defines how fast and how reliably the provider will act. Read it as carefully as the scope, and look for:

• Priority levels: clear definitions, for example critical (site down or checkout broken), high (a key feature not working) and normal (content changes).
• Response time versus resolution time: a response is an acknowledgement, while resolution is the fix. Both should be stated for each priority level.
• Support hours: business hours only, or round the clock for critical issues, and whether Sundays and public holidays are covered.
• Support channels: email, ticketing system, phone or WhatsApp, and which channel starts the SLA clock.
• Uptime commitments: if the provider also manages hosting, what uptime is committed and what happens if it is missed. If you host elsewhere, the AMC provider cannot reasonably commit to uptime on its own.
• Recovery expectations: how much data you could lose, based on backup frequency, and how long a full restore is expected to take.

Who should own your hosting, domain and accounts?

Your business should own its domain, hosting account and all key logins, with the AMC provider given access rather than ownership. This one point prevents the most painful disputes when you change providers.

• Register the domain in your organisation's name with an email address you control, not a developer's personal email.
• Keep the hosting, DNS, Google Analytics, Google Search Console, Google Business Profile and payment gateway accounts in your name, and grant the provider user or admin access.
• Store credentials in a shared password manager or a documented handover file that you hold.
• Confirm in writing that you own the website code, design and content you paid for, subject to any third-party licences.
• Agree an exit clause: on termination, the provider hands over credentials, the latest backup and documentation within a set period.

If personal data flows through your forms or checkout, clear ownership and access control also support your obligations under India's data protection law, covered in our DPDP Act website checklist.

What questions should you ask before signing?

Ask questions that reveal how the provider actually works, not just what the proposal lists. Useful ones include:

1. What exactly is updated, how often, and is each update tested on staging first?
2. How often are backups taken, where are they stored, and when did you last test a restore?
3. Which tools monitor uptime and security, and who receives the alerts?
4. What are the response and resolution times for a site-down incident outside office hours?
5. How is the content-change allowance measured, and what happens when it is exceeded?
6. What is not covered, and how are out-of-scope requests quoted and approved?
7. If we end the contract, what do we receive and how quickly?
8. Who will actually work on our site, and is any of the work subcontracted?

What are the red flags in a website AMC?

Be cautious with contracts that are vague about scope or that give the provider control over assets you should own. Common warning signs include:

• A one-line scope such as 'complete website maintenance' with no list of tasks.
• No written response times, or only 'best effort' support.
• The domain or hosting registered in the provider's name, or a refusal to share admin access.
• Backups stored only on the same server as the website, or no mention of restore testing.
• No reports, so you cannot tell whether any maintenance happened.
• Promises that the site can never be hacked or will always be online. No responsible provider can promise that.
• Automatic renewal with a long notice period and no exit or handover clause.

How much cover does your website need?

Match the AMC to the business impact of downtime. A brochure site with a few pages needs lighter cover than an online store or booking portal that handles payments and personal data. The more revenue or customer trust that depends on the site, the more you should invest in monitoring, faster response times and tested recovery.

If you are comparing proposals or reviewing an existing contract, Yashmitra's website AMC service and wider Managed Services follow the checklist above, with ownership of your accounts staying with you. You can also contact us to talk through what your website actually needs.

Written by the Yashmitra Global Solutions team. Published 21 October 2026.