Most maintenance arrangements do not fail with a bang. They fade. The monthly invoice keeps arriving, the reports get shorter, and one day a customer phones to say the booking form has not worked for a while. Looking back, the warnings were there. They just did not look like warnings at the time.
This post lists the website maintenance company red flags we would point out to a friend, sorted by when you are likely to see them: during the sales conversation, in the first month, once the routine has settled, and when you try to leave. Some are serious enough to walk away over. Others are worth a direct question. At the end there is a short section on things that look worrying but usually are not, because a few honest providers get judged unfairly.
Website maintenance company red flags before you sign
They quote without looking at your site
A five-page brochure site and a WooCommerce store with forty plugins are different jobs. If a provider names a fixed price and a start date before asking for your address, they are selling a plan, not looking after a site. That is not always fatal for a very simple site, but it tells you how much attention yours will get.
Every answer is a feature name
“Enterprise backups.” “Advanced security.” “Proactive monitoring.” Ask what those words mean in practice: where the backup is stored, which scanner they run, what is being monitored and who receives the alert. When the explanation never gets more specific than the brochure, there may be nothing behind it.
They promise outcomes nobody controls
A maintenance provider can keep a site updated, backed up and watched. Nobody can promise it will never be hacked, never go down, or rank higher on Google. Claims like that are not ambition. They show either a misunderstanding of the work or a willingness to say what you want to hear, and neither is a good sign for the day something goes wrong.
They want your domain or hosting moved into their name
Some providers offer to “manage” your domain and hosting by moving them into their own reseller account. It can be convenient. It also means the most important accounts your business has online now belong to somebody else. If they insist on this, ask for the accounts to stay registered to you, with them added as a user. If the answer is no, that tells you what leaving will be like.
Red flags in the first month
Nothing was checked before the first update
If the first thing you hear is “all updates done”, ask what they found before they started. A careful provider looks at the site as it is first and writes down what was already broken. Without that baseline, every later problem becomes an argument about who caused it. Our post with questions to put to a provider before you hire covers what that first look should include.
They asked for your personal admin password
A provider should have its own login with its own name on it, not yours. Shared logins make it impossible to tell who changed what, and they mean you cannot remove their access without changing your own password too. WordPress makes separate accounts easy, and the guide to giving each person the right WordPress role explains how to set one up.
Your first report is a template with your name dropped in
“Plugins updated. Backups completed. Site secure.” With no versions, no dates and no findings, a report like this could have been written without opening your site. A first report should be the most detailed one you ever get, because it is the first time anyone has looked properly.
Signs of a bad maintenance provider once the routine settles
These are slower to show and easier to explain away.
- The dashboard still shows pending updates when you log in mid-month. One or two held back on purpose is normal, and a good provider will tell you why. A long list that never shrinks is not.
- You find problems before they do. If you are the one noticing the broken form, the expired certificate or the slow page, the monitoring is either missing or nobody reads it.
- Questions get answered with a different question. “Did the update cause this?” should get a yes, a no, or “let me check”. Repeated deflection is often a sign they do not know.
- Every small request becomes a quote. Plans have limits, and quoting real work is fair. But if changing a phone number turns into a separate invoice every time, the plan was priced to look cheap rather than to cover what you need.
- The person you dealt with has gone, and nobody seems to know your site. Staff change. What matters is whether notes were kept. If the new person asks you to explain your own setup from scratch, there were none.
- Backups exist, but nobody has ever restored one. Ask when they last tested a restore of your site. Until somebody has restored one, nobody actually knows whether those copies work.
Red flags when you try to leave
This is where the earlier choices come due. Most of these could have been prevented with the right terms at the start.
- A fee to “release” your site that was never mentioned in the agreement.
- Backups that can only be restored inside their system, so you leave with nothing usable.
- Premium plugin licences registered to the provider’s account, which stop updating the day you leave.
- Silence. Emails about the handover go unanswered for weeks.
If you are already in this position, do not argue the whole history. Ask in writing for the specific items you need: a full backup, account ownership, and a list of licences. The step-by-step guide to switching to a new maintenance provider sets out the order to do it in.
Things that look like red flags but usually are not
A few honest behaviours get mistaken for bad service. Before you judge a provider on these, consider what is behind them.
They refuse some work
A provider who says “we do not do SEO campaigns” or “your email is hosted elsewhere, so we cannot fix it” is drawing a line, not dodging. The ones who say yes to everything are the ones to worry about.
They hold back an update
Waiting a week on a major plugin release, to let early bugs surface, is a sensible habit. What matters is that they tell you and give a reason.
They ask for hosting access as well as WordPress access
Some problems cannot be fixed from inside WordPress: a PHP version, a server error log, a database that will not connect. Asking for hosting access is normal. Asking to own the hosting account is the problem, not access to it.
They tell you something is your responsibility
Content, legal pages, renewing your domain on time, paying the hosting bill. Some of these really do sit with the owner unless agreed otherwise, and a provider who says so plainly is being honest. The post on which party looks after which part of a website lays out the usual split.
What to do when you spot one
One red flag is a conversation, not a resignation letter. Pick the one that worries you most and ask about it directly, in writing. “The dashboard showed eleven pending updates on the 14th. Can you tell me why they had not been applied?” A specific question gets a specific answer, or it gets a non-answer, and both are useful.
If the answer is reasonable, note it and move on. If it is not, or if you are now on your third red flag in as many months, start getting your own accounts and backups in order before you raise the subject of leaving. That way the decision is yours, made calmly, rather than forced on you by a broken site.
Whichever way it goes, keep a short log: the date, what you saw, what you asked and what they said. It takes two minutes and it changes the conversation if things get difficult later.
A quick self-check for your current provider
Answer these honestly about the web maintenance company you use now:
- Could you name what they did on your site last month without opening an email?
- Do you have your own admin login, separate from theirs?
- Is your domain registered in your name, with your email address on it?
- Could you download a full backup today without asking anyone?
- Have they ever told you about a problem before you noticed it?
Two or more “no” answers does not prove they are bad. It does mean you are relying on trust where you could be relying on evidence.
Comparing us against the same list
We would rather be judged on these points than on a sales page. Our plan prices and what each one covers are published openly on the pricing page, so you can hold them up against everything above before you ever speak to us.
Next in this series: Freelancer vs Website Maintenance Company: How to Choose
