Website maintenance services in Pakistan: cost and cover

What website maintenance costs in Pakistan

Maintenance is bought in hours, whatever the packaging on an agency page suggests, so the honest way to compare two retainers is to ask how many hours each includes and what those hours may be spent on. Published hourly rates give the arithmetic. Junior work in this market is quoted at PKR 500 to 1,000 an hour, full stack development at PKR 3,500 to 8,000, and senior specialists at the top of that band. A brochure site needs a few hours a month. A store integrated with an ERP, or a portal behind a login, needs considerably more, and any retainer priced identically for both is either overcharging one or under serving the other.

What those hours actually cover should be listed rather than implied. Core, plugin, theme and dependency updates staged before production. Automated backups with a restore tested on a schedule instead of a report that says a backup ran. Uptime checks that request a page which touches the database, since a static file returning two hundred proves very little. Certificate and domain expiry watched by somebody rather than by a calendar reminder on a laptop that left with an employee. Security scanning, and remediation when it finds something.

Three costs sit outside the retainer and cause most of the arguments. Hosting is yours and belongs in your name. Commercial plugin and theme licences renew annually and are a licence rather than a service, so ask any supplier plainly whether their price includes them. Major work is a project: a redesign, a version upgrade that changes how the site is built, a migration to another host. We separate those on the invoice rather than absorbing them and then rationing the ordinary work for the rest of the quarter. All of the above is market pricing rather than our figure. A real number follows a look at the site, once the platform, the plugin inventory and the change volume are known.

• Retainers compared as hours and inclusions rather than as package names
• A brochure site and an integrated store priced differently, because they are different work
• Updates staged before production, with backups restored on a schedule to prove they work
• Hosting, domain and commercial licence renewals identified as yours and named
• Redesigns, version upgrades and migrations quoted as projects rather than absorbed

How long it takes to take over a site

Taking over a site somebody else built is a short, defined piece of work and it is worth doing properly rather than beginning support blind. Two to four weeks is realistic. Nothing about it is difficult, and almost all of it depends on access that only your previous supplier can give.

The first week goes on the inventory. Where is the site hosted, who holds the registrar login, which plugins and themes are installed and which are commercial, what version of the platform is running, where do the backups go and has anybody ever restored one. That last question is answered by doing it in a copy rather than by asking, because the answer given and the answer observed are different surprisingly often.

The second week is remediation. Sites arriving on a retainer are usually behind on updates, and a site eighteen months behind is not patched in an afternoon: plugins have to be updated in a staged copy, in an order, with checks after each one, because the update that breaks the contact form is the one nobody notices for a month. Where a site is already compromised, that is an incident with its own scope and its own quotation.

Then the arrangement itself. Monitoring configured, a staging environment created if none exists, alert recipients named, and an escalation route agreed for out of hours. We hand back an inventory document at the end of the handover whether or not the retainer continues, because you paid for the knowledge and it is yours.

• Two to four weeks realistic to take over a site built by another supplier
• Hosting, registrar, platform, plugin and licence inventory produced in the first week
• A restore performed in a copy rather than a backup report accepted at face value
• Overdue updates applied in a staged copy, in order, with a check after each one
• Monitoring, staging, alert recipients and an out of hours route agreed before support starts

A retainer or pay as you go

Paying for work as it arises is a perfectly reasonable arrangement and it is undersold by everybody in this industry, ourselves included on occasion. For a five page company site on a hosted platform, with one contact form and two content changes a year, a retainer is an insurance premium against a risk that barely exists. Buy the hosting from somebody who patches the platform, keep the domain in your own name, and call a developer when you need one. That advice costs us a monthly invoice and it is the right advice.

A retainer earns its cost where three conditions hold. The site is assembled from third party components with their own security records, which describes any WordPress site with a plugin count above single figures. Something is lost when it is down: orders, enquiries, dealers who cannot see their statements. And nobody inside your organisation is going to apply an update on a Tuesday, which is true of almost every marketing team, because it is not their job and there is always something more urgent.

The economics are less about the hours than about the schedule. Patching is cheap and dull when it happens monthly in a staged copy. It becomes expensive and frightening when it happens after an incident, at which point the work is not an update, it is an investigation, a clean up, a restore, a set of credential rotations and an explanation to somebody senior. Every compromise we have been asked to deal with began with a vulnerability that had been public and patched for months.

So the question we ask a client is deliberately unglamorous. Who applies the update if there is no retainer, and on which day. Where the answer is a name and a day, pay as you go is honest and we will say so. Where the answer is a pause, a retainer is the cheaper of the two. We also decline to hold a site hostage in either arrangement: hosting, domain and accounts stay in your name, and the handover document is written whether you continue with us or not.

• Pay as you go recommended for a small site on a platform somebody else patches
• A retainer where third party components, real downtime cost or no internal owner apply
• Patching priced as a routine, since the same work after an incident costs many times more
• A named person and a day agreed for updates wherever there is no retainer
• Hosting, domain and accounts registered to you in either arrangement