The verdict in three sentences
A corporate website without an application maintenance retainer almost always ends up paying more in emergency call-outs than it would in a monthly fee. In 2026, budget £800 to £2,500/month in London (or €350 to €900 excl. VAT in Paris for a basic plan with 8 hours included), and up to €3,000/month once you require a 4 business-hour SLA. Against a hack whose full cost ranges from €8,000 to €25,000, the retainer pays for itself with the first incident avoided.
What a maintenance retainer really covers in 2026
A retainer bundles corrective maintenance (bugs, outages), preventive maintenance (CMS, plugin and server updates, backups) and small enhancements (editorial or functional requests). For a head of communications, the real questions are the hours included, the response time and what is billed on top.
| Plan level | Monthly price London (2026) | Monthly price Paris excl. VAT | Hours included | Response time | Typical scope |
|---|---|---|---|---|---|
| Essential | £800 to £1,000 | €350 to €500 | 4 to 8 h | 2 business days | Security updates, daily backup, uptime monitoring |
| Standard | £1,000 to £1,500 | €600 to €900 | 8 h | 1 business day | + monthly report, small changes, restore tests |
| Business | £1,600 to £2,000 | €1,500 to €2,200 | 12 to 16 h | 4 business hours | + contractual SLA, WAF, business-day on-call |
| Premium | £2,000 to £2,500 | €2,500 to €3,000 | 20 h | 4 business hours, 24/7 for critical | + weekend on-call, quarterly security audit |
| Ad hoc | £110 to £160/h | €90 to €140/h | 0 | Subject to availability | No guaranteed response |
| Extra hour on a retainer | £90 to £120/h | €75 to €110/h | n/a | Per SLA | Negotiated sliding rate |
One point often missed: unused hours rarely roll over beyond a month. Negotiate a rolling quarter carry-over; most providers accept this clause for a 12-month commitment.
Ad hoc or retainer: the 12-month math
Pay-as-you-go looks cheap as long as nothing breaks. The problem is the spikes: a WordPress update that breaks a form, an exploited vulnerable plugin, an SSL certificate expiring on a Friday night. The agency then bills the emergency, often with a 50 to 100% surcharge.
| Annual item (2026 order of magnitude, Paris) | Ad hoc | Standard retainer €750/month | Business retainer €1,800/month |
|---|---|---|---|
| Updates and backups (40 h/year) | €4,800 | Included | Included |
| Editorial changes (50 h/year) | €6,000 | Partly included (96 h/year) | Included |
| Two urgent incidents with surcharge | €3,600 | €1,200 | Included |
| Probability of a hack over 12 months | 8 to 12% | 2 to 4% | 1 to 2% |
| Weighted average cost of a hack | €1,600 | €500 | €250 |
| Estimated annual total | €16,000 | €10,700 | €21,850 |
For most service groups, the Standard plan offers the best cost/risk ratio. The Business level is justified when the site drives significant inbound leads, hosts a client portal or carries regulatory publishing duties (press releases, financial information).
Clauses to demand in the contract
- Measurable SLA: separate response and resolution times, with penalties (5 to 10% of the monthly fee per breach).
- Off-site backups: 30-day minimum retention, documented quarterly restore test.
- Reversibility: admin access, source code and documentation handed over within 10 business days at contract end.
- Monthly report: hours used, updates applied, incidents, uptime (target 99.9%).
- GDPR / UK GDPR compliance: a data processing agreement and hosting in the UK or EU.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Nathalie, head of communications for a 600-employee services group in Paris, pays for maintenance ad hoc. In 2025 she paid for 58 hours at €120 (€6,960) and a hacking incident on a contact form: clean-up, restore and crisis communication for €14,000. Total: €20,960. With a Standard retainer at €800 excl. VAT/month (€9,600/year) including 8 monthly hours, monitoring and a WAF at €40/month (€480), her budget would have been €10,080, a €10,880 saving, not counting her team's crisis time. A London equivalent at £1,200/month would land around £14,400 a year, still below the cost of a single serious incident.
FAQ
Which retainer suits a 30-page corporate site?
A Standard plan at €600 to €900 excl. VAT/month (£1,000 to £1,500 in London) with 8 hours included is enough for most corporate brochure sites. Move to Business, €1,500 or more, if the site generates over 50 leads a month or hosts a client area.
What does a 4 business-hour SLA mean?
The provider commits to start working on a critical incident within 4 business hours of it being reported. Check that a resolution time, often 8 to 24 h, is also written down, otherwise response alone guarantees nothing.
How much does a website hack really cost?
Between €8,000 and €25,000 in 2026 for a mid-sized company, combining clean-up, restore, lost leads, a possible regulator notification within 72 h and communications. Reputational cost, harder to quantify, comes on top.
Can an agency that didn't build the site take over maintenance?
Yes, after a takeover audit typically billed €800 to €2,000 excl. VAT (£700 to £1,800). It maps versions, plugins and vulnerabilities before the retainer starts.
What commitment length is reasonable?
12 months with 3 months' notice is standard. A 24-month commitment can lower the monthly fee by 10 to 15%.
Let's scope your project. Send us your corporate site URL and your current request volume: we will price a retainer that fits, from Essential to a 4-hour SLA, with a takeover audit within 10 days. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
