Read the maintenance line on almost any website proposal in this market and you will find hosting, a domain renewal and an assurance that somebody will reply if you message them. That is a support channel, not maintenance. Maintenance is the set of things that happen on a schedule whether or not anybody is looking, and the entire point of it is that you should never have to notice.
What a real website maintenance scope contains
Backups taken automatically, stored somewhere other than the server they came from, and restored to a staging site at least once a quarter. A backup nobody has ever restored is a hope rather than a backup. We have watched more than one team discover on the worst possible day that theirs had been failing silently for months.
Patching on a defined clock: core, plugins, themes, and the language runtime and server stack underneath them. Most compromised sites were never targeted. They were found by a scanner looking for a known hole in an out of date component, weeks after the fix was published. If the agreement does not say how quickly security updates get applied, it does not cover security.
Uptime monitoring with a human attached, because an alert firing into an unread inbox at three in the morning is theater. Certificate and domain renewals tracked centrally, since an expired domain is a surprisingly common way for an Egyptian company to lose a trading week. Then the checks nobody thinks of: a monthly test submission through every form to confirm the email actually arrives, payment gateway health in test mode, broken link sweeps, and a performance check, because sites get slower one plugin at a time.
The two failures that cost the most
The first is the unpatched component. Recovery from a compromised site is rarely a clean restore. You are dealing with reinfection, a warning screen in the browser that frightens away everyone who clicks, review requests to get the site cleared in search results, and a month of reputation work. That single week costs more than several years of maintenance fees.
The second is quieter and far more common: the form that stopped sending. A hosting move, a plugin update or a mailbox provider tightening its rules, and inquiries simply stop arriving. Since the large providers began enforcing authentication requirements on bulk senders last year, sites sending notifications without correct SPF, DKIM and DMARC records have been failing in exactly this way. Businesses discover it months later when somebody asks why the website has produced no leads since the spring. Every inquiry in that window is gone. A test submission on the first of each month would have caught it inside thirty days.
Ownership, and the exit test
Ask whoever maintains your site one question. If we parted ways tomorrow, what would we hold? You should own the domain registrar account, the DNS, the hosting, the administrator login, the code repository and the analytics properties, with your agency holding access rather than title. Agencies registering client domains under their own accounts is still normal here, and it remains the most effective way to make a client difficult to leave. Fix it on a calm day rather than during a dispute.
On price, a real retainer runs from a few thousand EGP a month for a brochure site to a five figure monthly number for an active store with integrations and daily content changes. Measured against one compromised week, or a quarter of inquiries lost to a form nobody tested, it is the cheapest insurance on the list. It is part of every handover our website and app development team does, and if you are unsure what your current arrangement covers, ask for it in writing, read it against this list and bring the gaps to a first call.
