What to Ask Before You Sign a Website Care Retainer

Buying a promise, not a product

A website care retainer is an unusual purchase. You are not buying a finished thing you can inspect before paying — you are buying a promise that someone will act correctly, on your behalf, in situations that have not happened yet, for a fixed sum every month. That is harder to evaluate than a one-off project, because the quality of what you bought often only becomes visible the first time something actually goes wrong.

The honest way to buy one is to ask the same six questions of any provider you are considering — including whichever one is pitching you right now. None of these require technical knowledge to ask, and a provider who cannot answer them plainly is telling you something useful before you have signed anything.

1. What is in scope, and what gets billed as extra

Every retainer has a boundary somewhere between "included" and "separate work," and the boundary is rarely obvious from the sales page. Ask specifically: does the monthly fee cover applying security patches, or only alerting you that one is available? Does it include content changes, and if so, how many, and what counts as a "change" — a price edit on an existing page, or building a new page from scratch? Does it include fixing something that broke because of a third-party plugin or a host's own outage, or only issues inside the provider's direct control?

Get the answer in writing, not as a verbal reassurance. A vague scope is not necessarily a sign of bad faith — plenty of providers genuinely have not written it down precisely — but it does mean you are both guessing at what "included" means until the first dispute settles it for you.

2. Response versus resolution — two different promises

These two words get used almost interchangeably in sales conversations, and they describe genuinely different commitments. A response is an acknowledgement: someone has seen your message and confirmed they are looking at it. A resolution is the problem actually being fixed. A provider can hit an aggressive response time and still take days to resolve something, and both of those facts can be true of the same incident.

Ask which one any stated time commitment actually refers to, and ask what happens for problems that turn out to be more complex than expected — is there an escalation path, or does the clock simply stop being mentioned? A provider that is upfront about this distinction, and upfront about not offering guaranteed time commitments at all, is giving you more useful information than one that quotes an impressive-sounding number without saying which promise it attaches to.

3. Who holds the accounts your business depends on

Domain registration, hosting, DNS, analytics, search console, the code repository — each of these has an owner of record, and it matters whether that owner is your business or the provider's. Ask plainly: for each system involved in running the site, whose name is the account under, and do you personally have a working login with full access today, not a shared password you have never actually tested?

This is worth verifying yourself rather than taking on trust — a domain's registrant record, for instance, can be checked independently rather than assumed. We have written a more detailed breakdown of exactly what to check and how in our access-audit checklist, which is worth reading alongside this one if the answer here is anything less than a clear "your business, and here is your login."

4. What happens to your backups if you leave

Almost every provider will tell you backups are running. Fewer will tell you, before you have signed anything, what happens to those backup files if the relationship ends. Can you export a full copy — code, database, media — in a standard, usable format? Is there a fee for that, and is it disclosed now or only when you ask to leave? Are backups retained anywhere you can reach after the contract ends, or deleted the moment it does?

A provider that answers this clearly, before you have paid a ringgit, is telling you the relationship is built to be left as much as it is built to be entered. One that treats the question as awkward or hypothetical is worth pressing further, because it stops being hypothetical the day you actually need the answer.

5. Notice periods — for you, and for them

Ask how much notice you need to give to cancel, and — just as importantly — how much notice the provider is obliged to give you if they decide to stop. A month-to-month arrangement with no lock-in is a very different commercial promise from a twelve-month contract with an early-termination fee, and both are legitimate business models, but only one of them should come as a surprise.

It is also worth asking what happens in the gap between notice and the actual end date: does monitoring keep running, do patches keep applying, or does service effectively stop the moment notice is given? A retainer that quietly downgrades the day you say you are leaving is not doing anything unusual, but you would rather know that in advance than discover it during a month you are also trying to find a replacement.

6. What evidence of work you will actually receive

"We are keeping an eye on it" is a sentence, not evidence. Ask what you will actually be shown: a monthly summary of what was patched and when, an uptime log, a record of what content changes were made and by whom, a note whenever a backup was verified rather than merely created. If the answer is "you can always ask," that is a weaker commitment than a report that arrives whether you ask or not — because the moment you would most want to check is usually the moment something has already gone wrong, and that is a bad time to be establishing a reporting habit for the first time.

Reading the answers together

No single answer to these six questions should make or break a decision on its own. A provider that is vague about reporting but excellent on backup portability might still be a reasonable choice for a low-risk site, and a provider with polished monthly reports but a murky answer on account ownership deserves more scrutiny than the reports alone suggest. What matters is asking all six before you sign, because a retainer is far easier to evaluate on the way in than on the way out, and the gap between what was implied and what was actually agreed is exactly where problems tend to live.

---

This is deliberately a list you can point at any provider, not only us. JagaWeb Care (RM450/month, excluding SST) covers monitoring, verified backups, patching and a limited number of content updates on a single site; Care + Changes (RM1,500/month) adds a larger, ongoing allowance of change requests worked through one at a time. Neither is sold with a guaranteed response or resolution time, for the reasons explained above — what you would be buying is a documented, month-to-month process, not a promise about the clock. Details at jagaweb.my, by email at sales@jagaweb.my, or on WhatsApp at jagaweb.my.