Maintenance contracts in Morocco: what's worth paying for and what's a scam

After your website launches, the agency offers you a maintenance contract. 500 MAD/month. 2,000 MAD/month. Sometimes 5,000 MAD/month. For "updates, security, backups, and support." Some of these contracts are worth every dirham. Others are paying 24,000 MAD/year for someone to click "update" on WordPress plugins once a month. Here's how to tell the difference.

What legitimate maintenance actually includes

Security monitoring and patching: Your site needs to stay secure. This means monitoring for vulnerabilities, applying security patches, and responding to incidents. On a WordPress site, this is substantial work — plugins need updating, PHP versions need tracking, and security headers need maintaining. On a custom-built site, the attack surface is much smaller, so security maintenance is lighter.

Backups: Automated daily backups with tested restore capability. This is non-negotiable for any site with a database (e-commerce, forms, user accounts). The key word is "tested" — many agencies take backups but have never verified that a restore actually works.

Uptime monitoring: Someone needs to know when your site goes down. Proper monitoring checks your site every 5 minutes and alerts the responsible person immediately. If your maintenance contract does not include uptime monitoring, you are paying for maintenance without visibility.

Performance maintenance: Databases grow, images accumulate, caches stale. Quarterly performance checks ensure your site stays fast over time. This includes database optimization, image compression, cache clearing, and CDN configuration reviews.

Content updates: Some contracts include a set number of content updates per month (text changes, image replacements, new pages). This is valuable if you do not have technical staff. Typical: 2–4 hours of content updates per month.

What is NOT worth paying for

"WordPress plugin updates" as a standalone service: If your entire maintenance contract is someone clicking "Update All" in the WordPress dashboard once a month, you are overpaying. Plugin updates should be part of a larger maintenance package, not the entire thing.

Hosting as part of a maintenance contract: Some agencies bundle hosting into their maintenance fee and charge 2,000 MAD/month for what is actually a 100 MAD/month hosting plan with a "we manage it" markup. Always know what your hosting actually costs separately.

"SEO maintenance" without deliverables: If the contract says "SEO optimization" but does not specify what is being done monthly (keyword tracking, content updates, technical fixes, reporting), it is a line item that generates no value.

24/7 support for a brochure site: If your site is a 5-page vitrine that changes once a quarter, you do not need 24/7 support. You need someone available during business hours who responds within 24 hours.

The red flags of a scam contract

No SLA (Service Level Agreement). If the contract does not specify response times, resolution times, and what happens if they miss them — it is not a real maintenance contract. It is a recurring invoice with no accountability.

No reporting. If you pay for maintenance but never receive a monthly report of what was done, you have no way to verify that anything is happening. Demand monthly reports that list: updates applied, security checks performed, uptime percentage, and any issues resolved.

Lock-in without access. If the agency holds your hosting credentials, your domain registrar login, and your CMS admin access, and your contract says you can't leave without forfeiting these, that's a hostage situation, not a service contract.

Annual prepayment with no cancellation clause. Legitimate maintenance contracts are monthly or quarterly with 30-day cancellation notice. A contract that locks you in for 12 months with no exit is designed to benefit the agency, not you.

What a fair maintenance contract looks like

For a WordPress site: 500–1,500 MAD/month. This should include: weekly plugin and core updates, daily backups, uptime monitoring, security scanning, and 2 hours of content updates per month. Quarterly performance review included.

For a custom-built site: 300–1,000 MAD/month. Custom sites need less maintenance (no plugins to update, fewer security concerns), so the cost should be lower. This should include: daily backups, uptime monitoring, quarterly performance audit, and 2 hours of content or feature updates per month.

For an e-commerce site: 1,000–3,000 MAD/month. E-commerce requires more: payment gateway monitoring, order flow testing, inventory system maintenance, and faster response times for critical issues (because downtime = lost revenue).

Questions to ask before signing

What is the response time for critical issues? Acceptable: 4 hours during business hours, next business day for non-critical. Unacceptable: no defined response time.

Do I own my domain and hosting separately? Always. Never let an agency register your domain under their account. Your domain and hosting credentials should be in your name.

What is the cancellation policy? 30-day notice, monthly billing. Anything more restrictive needs a good reason.

Will I receive monthly reports? Yes, every month. What was updated, what was checked, what was found, and what the uptime was.

If your current agency can't answer these questions clearly, it's time for a different partner. Start a conversation about what proper maintenance looks like.