A business website can develop faults without going completely offline. An address variant may show an error, a button may lead nowhere, or an important page may be empty. This website maintenance contract checklist helps Indian businesses agree who checks for these problems and what happens next.
A website AMC (annual maintenance contract) should define the checks, responsibilities and reporting you have agreed. Ask who reviews the live website, how often checks happen and how findings are recorded.
This guide is for owners, MDs and marketing heads who already have a website and are deciding whether an AMC is worth it, or whether the one they have is doing anything. It explains the faults we keep finding on live Indian company websites and turns them into a plain checklist of what your contract must cover.
Why websites decay when nobody is watching
A website is not a brochure that was printed once. It runs on a server, a content system, a theme, plugins, a security certificate, a domain and an email setup for forms. Each of these changes over time. Hosts update their software. Plugins release new versions. Certificates expire. Staff who set up the contact email leave the company.
Buyers may arrive from search results, visiting cards, directories, email signatures or shared links. These can point to different address variants or older pages, so checking only the homepage is not enough.
Ask who checks the live website, how often and what they check. Have the answers recorded in the maintenance agreement.
Three faults we keep finding on live Indian company websites
The examples below are drawn from visitor-visible website checks recorded by our team. They are anonymous observations, not a survey of Indian websites or a diagnosis of your website.
1. Different address variants behave differently
A website can usually be reached through four address variants: with or without “www”, and on “http” or “https”. Ideally all of them lead to one working secure version. Our checks have recorded cases where an HTTPS address loaded while a linked HTTP or www address showed a server error.
A buyer following an older link may therefore see an error even when another address works. Check the variants and links that visitors actually use.
2. Enquiries leak silently
An enquiry path can have faults even when the surrounding page looks fine:
- A form may look normal while its submission behaviour remains unverified. A missing action attribute alone does not prove it is broken; authorised end to end testing is needed to confirm delivery.
- A phone number coded as an email link, so tapping it on a mobile opens the mail app instead of the dialler.
- Menu items or buttons pointing to “#” instead of the intended page or action.
These faults can interrupt an enquiry. Visitor-visible checks can identify wrong links, but they cannot confirm whether a form message reached an inbox without an authorised delivery test.
3. Important pages are empty or unfinished
Our checks have recorded important pages, including investor information pages, that displayed a heading without the expected content. Separately, outdated software can expose a website to known vulnerabilities. CISA’s guidance on updating business software recommends regular patching procedures and tests. A public page check alone does not establish whether its underlying software is up to date.
What your website AMC must cover: a practical checklist
Use this checklist to discuss the scope with your provider. It is not a list of services automatically included in every AMC. Record the agreed checks, reporting frequency, exclusions, monitoring coverage and human response availability separately.
Uptime and error checks on every address variant
- Uptime monitoring, so someone is alerted when the website goes down, not when a customer complains.
- A monthly check of all four variants (http and https, www and non www) to confirm each one lands on the correct secure page without an error.
- A check that the security certificate is valid and renewing on time.
Forms, calls and WhatsApp links tested end to end
- Every enquiry form submitted as a real test, with confirmation that the message actually reached the right inbox or CRM.
- Every phone, email and WhatsApp link tapped on a mobile to confirm it opens the right app with the right number.
- Main menu and key buttons clicked to confirm none lead to “#”, a blank page or an error.
Stale, blank and broken pages flagged
- A crawl for broken links and missing pages.
- A list of pages that are empty, outdated or showing placeholder content, sent to you so the right person can update them.
Updates and security patches, tested rather than blind
Updates matter, but updating blindly can break a live website. The official WordPress documentation advises taking a backup first and checking that plugins and themes are compatible before updating (Updating WordPress). A good AMC follows that order:
- Core, theme and plugin updates applied on a schedule, after a backup and a compatibility check.
- Tested patching: agree compatibility checks, pre-change backups and post-update verification, whether updates are applied manually or automatically.
- A written note of what was updated and what was checked.
Security monitoring and website hardening
Maintenance and security belong in the same contract. Ask for:
- Malware scanning and file-integrity monitoring, so unexpected changes to website files are spotted early.
- A firewall or WAF (web application firewall) and bot protection to filter attack traffic and spam submissions.
- Website hardening steps such as strong passwords, two-step authentication and removing unused plugins, as described in the WordPress hardening guidance.
- Awareness of the common web risks listed in the OWASP Top Ten.
Backups you can actually restore
A backup is useful only if you know how to restore it. The UK National Cyber Security Centre explains online and external-device backups, advises disconnecting an external backup device when it is not in use, and recommends checking that backups contain important data and can be restored (NCSC: backing up your data). Your AMC should state:
- How often backups are taken, and where they are stored.
- That at least one copy is kept away from the website’s own server.
- That a restore is tested from time to time, not only when disaster strikes.
A monthly written report
Ask whether a monthly written report can be included in your agreement, and confirm which of these items it will cover:
- Uptime and any downtime seen.
- Results of the address variant, form and link tests.
- Updates applied and patches tested.
- Security scan results and anything blocked.
- Backup status.
- Pages flagged as stale or broken, with a recommended action.
Ask the report to identify the checks performed, findings, completed actions and outstanding issues, even when no incident was recorded.
Questions to ask before you sign or renew
- Who, by name or role, checks our live website each month?
- Which address variants, forms and links are tested, and how?
- Are updates tested before or right after they go live?
- What security monitoring, firewall and bot protection is included?
- Where are backups kept, and when was a restore last tested?
- What does the monthly report contain, and can we see a sample?
- How quickly do you respond when something breaks?
Clear answers to these questions tell you more about an AMC than any promise of “full support”.
When maintenance is not enough
Sometimes a review identifies issues that maintenance alone may not resolve, such as an unsupported theme, persistent mobile problems or a structure that no longer fits the business. Assess whether repairs, an upgrade or a rebuild is appropriate before deciding the maintenance scope. Our website modernisation service is a related option.
How Hyrrokkin handles website AMC
At Hyrrokkin, our secure website AMC can include agreed software updates with compatibility checks and post-change verification, backup oversight, uptime and SSL expiry monitoring, error and backup alerts, technical support and an activity record. The scope depends on the supported website and hosting environment. Reporting frequency, human support availability and response targets are agreed separately. Our team works from Coimbatore and supports businesses across India and global markets.
Discuss your website maintenance scope
Book a 15 minute Microsoft Teams call with our team to discuss your website, the checks you need and the maintenance responsibilities to agree. Confirm the assessment scope and any written deliverables before work begins.
