Website Maintenance SLA: What Saudi Businesses Should Include

A good contract for website maintenance in Saudi Arabia spells out exactly what gets patched, backed up, monitored and reported, and how fast the supplier must respond when something breaks. The strongest SLAs cover security updates, tested backups, uptime monitoring, response times by severity, Core Web Vitals, SEO health, content changes and a monthly report. If any of those is missing or vague, the agreement protects the supplier more than it protects your business.

Many Saudi companies sign an annual maintenance contract, usually called a website AMC, at the end of a build without reading it closely. The result is familiar: a plugin update breaks checkout on a Thursday evening, nobody is sure who should fix it, and the contract only says "support during business hours". This guide walks through each clause a decision maker in Riyadh, Jeddah or Dammam should ask for, what good wording looks like, and the questions that separate a real service from a retainer that only pays for availability.

Why website maintenance in Saudi Arabia needs a written SLA

A website is not finished on launch day. Content management systems, plugins, themes, server software, payment gateways and third party scripts all release updates on their own schedules. Each update can fix a vulnerability or introduce a conflict. Without a written service level agreement, the work happens when someone remembers, and problems surface when a customer complains.

Saudi businesses also carry specific obligations that make maintenance a governance matter rather than a technical chore. Sites that collect personal data fall under the Personal Data Protection Law, overseen by SDAIA. Organisations in regulated sectors, or those working with government entities, are often expected to align with National Cybersecurity Authority controls, which cover patching, logging, access management and incident handling. Stores that issue invoices must keep their ZATCA e-invoicing (Fatoora) integration working through platform updates. An SLA is the document that shows who is responsible for each of these, and how quickly. Requirements vary by sector, so confirm the obligations that apply to you with counsel or the relevant regulator.

SLA, AMC and retainer: what the terms mean

• SLA (service level agreement): the measurable promises, such as response time for a critical incident, uptime target and backup frequency, plus what happens if they are missed.
• AMC (annual maintenance contract): the commercial wrapper, usually a yearly term that lists included tasks and hours. A website AMC should reference or contain an SLA, not replace it.
• Retainer: a block of hours for changes and improvements. Useful, but it says nothing about how fast anyone responds to an outage unless the SLA is attached.

When comparing proposals, ask each supplier to separate these three parts. It becomes much easier to see who is offering real cover and who is offering a bank of hours with a reassuring name.

The core clauses every website maintenance SLA should include

The sections below are the clauses that matter most. Use them as a template when reviewing a draft website maintenance SLA, or when writing your own requirements into a tender.

1. Security updates and patching

The contract should state how often the core platform, plugins, themes and server packages are reviewed and updated, and how critical security patches are handled outside the normal cycle. Good wording separates routine updates, applied on a fixed schedule after testing on staging, from emergency patches, applied as soon as a known vulnerability is published for something the site uses.

Ask for these details in writing:

• The update cadence for routine items, for example weekly or fortnightly.
• Whether every update is tested on a staging copy before it reaches the live site.
• How the supplier tracks published vulnerabilities for your exact stack.
• Who holds administrator access, and how access is reviewed and removed when staff change.
• Whether a web application firewall and malware scanning are included or billed separately.

For WordPress sites in particular, plugin sprawl is the main risk. A sound WordPress maintenance clause includes a periodic review that removes unused plugins and flags abandoned ones, because the safest plugin is the one that is no longer installed. If your site runs on WordPress, our WordPress development team can review the current plugin list before you sign anything.

2. Backups and restore tests

Almost every proposal promises backups. Far fewer promise to prove that a backup can actually be restored. The SLA should define:

• Backup frequency for files and for the database, which can differ. A busy store may need database backups several times a day.
• Retention period, meaning how many days or weeks of history are kept.
• Storage location, kept separate from the production server, with data residency stated if your data must stay in the Kingdom.
• A scheduled restore test, for example quarterly, where the supplier restores a backup to a staging environment and confirms the site works.
• Recovery point and recovery time targets, in plain language: how much data you could lose, and how long a full restore should take.

The restore test is the clause to insist on. A backup that has never been restored is a hope, not a control.

3. Uptime monitoring and alerting

The supplier should monitor the site from outside your hosting environment and be alerted within minutes of an outage, not when a customer calls. Ask which pages are monitored. Checking only the homepage misses the more common failure where the homepage loads but the cart, login or contact form does not.

A practical monitoring clause covers the homepage, a key landing page, the checkout or enquiry form, SSL certificate expiry, domain expiry and DNS changes. It should also say who receives alerts on your side, and through which channel. Many Saudi teams prefer a WhatsApp group or phone call for critical alerts, with email for everything else.

4. Response and resolution times by severity

This is the heart of the SLA. A single promise such as "we respond within one business day" treats a typo and a payment failure the same way. Insist on severity levels with separate targets.

Two details are easy to miss. First, define the working week. Saudi businesses work Sunday to Thursday, and a supplier based elsewhere may assume a different week, so state it. Second, separate response time from resolution time. A supplier can respond in fifteen minutes and still take three days to fix the problem. Ask for both, and for a commitment to a temporary workaround on critical issues.

5. Performance and Core Web Vitals

Speed decays quietly. New images, tracking tags, chat widgets and plugins add weight month after month until the site that launched fast is now slow on mobile. A maintenance SLA should include a performance check on a fixed schedule, with Core Web Vitals reported for the main templates: home, category or service, product or article, and checkout or contact.

Ask the supplier to agree thresholds for Largest Contentful Paint, Interaction to Next Paint and Cumulative Layout Shift, using field data where available, and to explain each month why any template has moved. Our Core Web Vitals checklist lists the usual causes, and a dedicated Core Web Vitals service is worth considering if the site is already failing.

6. SEO health checks

Maintenance work can damage search visibility without anyone noticing. A theme update changes heading structure, a plugin adds a noindex tag, a redirect is lost when a page is renamed. The SLA should include a monthly technical SEO check that covers:

• Index coverage and crawl errors in Google Search Console.
• Robots rules, sitemaps and canonical tags after any update.
• Hreflang between the Arabic and English versions.
• Redirects for any renamed or deleted pages.
• Structured data validity on products, articles and the organisation.

This is not the same as an SEO campaign, and the contract should say so. It is a safety check to make sure maintenance does not undo the work your marketing team pays for. If you need a baseline before the SLA starts, a technical SEO review gives you one.

7. Content changes and small enhancements

Decide in advance what counts as maintenance and what counts as new work. A clear clause lists included changes, such as text edits, image swaps, new blog posts, banner updates and adding a team member, and states a monthly allowance in hours. It also defines the turnaround for routine requests, and the process for anything larger, which should be quoted separately.

For bilingual sites, the clause should state that every content change is applied to both Arabic and English versions, or say clearly who is responsible for translation. A frequent problem in Saudi websites is an English page updated in March and its Arabic twin still showing last year's information in October.

8. Reporting

A monthly report is the evidence that the work happened. It should be short, consistent and written for a manager, not only a developer. A useful report includes:

1. Updates applied, with versions, and anything held back with the reason.
2. Backup status and the date of the last successful restore test.
3. Uptime for the month and a summary of any incidents, with cause and fix.
4. Core Web Vitals for the main templates, compared with the previous month.
5. SEO health findings and actions taken.
6. Hours used against the allowance, and requests completed.
7. Recommendations for the next month, flagged as included or extra.

Clauses that protect you if the relationship ends

The most overlooked part of any maintenance contract is the exit. Suppliers change, and the handover should be painless. Make sure the contract covers the following:

• Ownership: your company owns the domain, hosting account, code, content and analytics properties, registered in your name.
• Credentials: a current list of all accounts and access is kept in a shared vault your team controls.
• Documentation: the supplier keeps a short technical document covering the stack, custom code, integrations and deployment steps.
• Handover period: a defined notice period with cooperation during transfer to a new supplier.
• Data: how backups and logs are handed over or deleted at the end, in line with your PDPL obligations.

If you are already moving away from a supplier, a planned site migration reduces the risk of losing data, rankings or integrations in the process.

Security and compliance points to write into the contract

Beyond patching, the SLA should describe how the supplier handles security incidents. That means a clear definition of what counts as an incident, the steps the supplier takes in the first hours, who they notify on your side and how evidence is preserved. Where personal data may be affected, your legal team needs to know quickly, because notification duties under PDPL may apply.

Organisations that follow NCA controls should ask the supplier to describe how their process supports those controls, for example access reviews, logging and change management. The National Cybersecurity Authority website publishes the frameworks, and your compliance team can map the relevant ones to the contract. For a broader view, see our guide to enterprise website security in Saudi Arabia and the PDPL and NCA website checklist. These are general notes, not legal advice, so confirm specific obligations with counsel or the regulator.

Checklist: reviewing a website maintenance proposal

Use this list when comparing proposals for website support in Riyadh or anywhere else in the Kingdom.

1. Are severity levels defined, with separate response and resolution targets?
2. Is the working week stated as Sunday to Thursday, with critical cover outside it?
3. Is every update tested on staging before going live?
4. Are backups stored off the production server, with retention and residency stated?
5. Is there a scheduled restore test, with results in the report?
6. Does monitoring cover checkout or forms, SSL and domain expiry, not only the homepage?
7. Are Core Web Vitals and technical SEO checks included each month?
8. Do content changes apply to both Arabic and English versions?
9. Is there a clear line between included work and quoted extras?
10. Do you own the domain, hosting, code and analytics accounts?
11. Is there an incident process that covers personal data?
12. Is there a defined exit and handover clause?

If a supplier cannot answer most of these in writing, keep looking. If you are unsure what your current site needs, a website audit is a sensible first step before you negotiate.

How Codeeo helps Saudi businesses with website maintenance

Codeeo has delivered 200+ projects across the UAE and the US, with a team of 80+ across Dubai, Riyadh and Karachi, and is rated 4.7 from 23 Google reviews. Our approach to website maintenance in Saudi Arabia follows the structure in this guide: tested updates, verified backups, monitoring of the pages that matter, severity based response, and a monthly report your managers can read in a few minutes.

We work on WordPress, WooCommerce, Shopify and custom builds, in Arabic and English. Riyadh clients can meet the team in person at our Riyadh office, and clients elsewhere in the Kingdom work with us over video calls. If you want a second opinion on an existing AMC, or a maintenance plan written around your own stack, contact Codeeo and we will walk through it with you.