A website is sold as a deliverable and behaves like equipment. The build quotes I review for Moroccan clients price the design, the development, sometimes the copywriting, then stop dead at go-live. What happens the next morning belongs to nobody.
The consequences show up between month three and month eighteen. A plugin that was never updated and now hosts a spam injection. An expired certificate throwing a red warning at visitors. A domain renewed too late because the invoice was going to the developer’s personal mailbox. None of it dramatic on its own. Added up, it costs more than the contract that would have prevented all of it.
Maintenance is not primarily a technical subject. It is a question of named responsibility: as long as nobody is assigned to watch the site, nobody watches it, and you find out about problems from your customers.
Mistake 1: treating handover as the end of the project
Handover is where everything is decided, and it is usually the rushed part. A site delivered properly means you hold, in your company’s name and on a company email address, the registrar account for the domain, the hosting access, the CMS admin account, the code repository if there was custom development, and control of the DNS zone.
When that is not the case, the story is always the same. Eight months later the provider has moved on or stopped answering, the domain sits under their personal account, and getting control back takes weeks of chasing. Sometimes rebuilding the site costs less than recovering the old one.
The fix fits on one page: a signed handover document at delivery listing every access, its owner and its renewal date. Ask for it before you pay the balance, not after.
Mistake 2: letting the CMS and plugins age
Moroccan SME sites run overwhelmingly on WordPress, with a commercial theme and a dozen plugins. Each piece is software maintained by a third party, with its own security patches. A form or caching plugin abandoned two years ago on a public site is an open door waiting for an automated scanner. Those scanners target nobody in particular: they sweep address ranges and test for known versions.
The usual symptom is not a wiped site, it is far quieter. Spam pages dropped into the uploads folder, redirects that only fire for visitors arriving from Google, a mail account hijacked for phishing. You learn about it when Google shows the warning, when the domain lands on a blacklist, or when the host suspends the account. Cleaning an infected site properly commonly runs between MAD 5,000 and MAD 20,000 depending on the damage, and part of the organic traffic takes weeks to come back.
The underlying work is light: one grouped security and CMS update cycle per month, tested on a copy of the site before it touches production, with a backup taken immediately before. One to three hours a month covers a brochure site. The real trap is the one-click update on a Friday evening with no backup, because when an incompatibility breaks the homepage there is nothing to roll back to.
Mistake 3: discovering the domain, the SSL and the backups on the day it fails
These three failures are the silliest and the most expensive, because they take everything down at once. A .ma domain left unrenewed stops the site and, in most setups, the business email with it. The renewal notice goes to the contact address registered with the registrar, which is still too often the developer’s. Check today which email is listed as administrative contact, and what the expiry date is.
Then the certificate. A Let’s Encrypt certificate renews itself every three months, right up until a hosting migration breaks the scheduled task. Nobody notices before the browser throws its warning screen, typically in front of a quote request form.
Then the backups. A backup that has never been restored is a hypothesis. The classic case: the copy exists, but it sits on the same server as the site and disappears with it, or it holds the files without the database. On hosting and website backup, the minimum rule is simple: a daily copy stored somewhere other than production, thirty days of retention, and a real restore test once a quarter. That test takes two hours and is worth more than any speech about reliability.
Mistake 4: putting fixes and improvements in the same budget line
Two kinds of spending, two billing logics. Corrective maintenance keeps the site running: updates, backups, monitoring, fixing what breaks, support when a page stops rendering. It belongs in a monthly retainer because the workload is steady.
Evolutive maintenance moves the site forward: a new page, a new form, a reworked checkout, CMI payment integration, an ERP connection. Nothing steady about any of that, and an “unlimited” retainer meant to cover it fails in both directions: either you pay for time you never use, or the provider slows down every request.
The arrangement that survives a few years pairs a monthly retainer for corrective work with a pool of development hours, either included (two to four hours a month) or billed per request at a rate agreed in advance. In Morocco, an agency web development hour is often billed between MAD 350 and MAD 700 depending on the profile, with specialist day rates between MAD 2,500 and MAD 5,000. Put that rate in the contract, not in an email.
Website maintenance cost Morocco: what to budget per month
The ranges below reflect what a serious website maintenance contract costs on the Moroccan market, infrastructure excluded. They move mostly with criticality: a site taking orders is not held to the same standard as an online brochure.
- Brochure site, 5 to 15 pages: MAD 500 to 1,500 per month. Monthly updates, backups, uptime checks, small fixes.
- Corporate or multilingual site, catalogue, connected forms: MAD 1,500 to 3,500 per month.
- Active ecommerce: MAD 3,000 to 8,000 per month, because somebody has to watch the payment module, the carriers, the stock sync and an order flow that will not wait until Monday.
- Custom web application: from MAD 6,000 per month and often more, at which point you are buying application maintenance rather than site upkeep.
Infrastructure sits on top. It is not maintenance, but it lands in the same monthly website budget: MAD 200 to 400 a year for a .ma domain, MAD 600 to 2,500 a year for decent shared hosting, MAD 150 to 600 a month for a VPS. The platform you pick at the start weighs heavily on that line, something our comparison of ecommerce platforms for Moroccan retailers goes into: Shopify charges a subscription but absorbs the updates, WooCommerce costs less in licensing and more in upkeep.
A useful rule of thumb when you are arguing the budget internally: annual upkeep on a professional site lands somewhere around 15 to 20 percent of the build cost. If the site cost MAD 60,000, setting aside close to MAD 10,000 a year is not a comfort margin, it is the running cost. If you have no baseline yet, our figures on what a professional website costs in Morocco give you the starting point, and the same logic applies to a mobile app maintenance budget, where store deadlines tighten the calendar further.
What a maintenance contract must cover at minimum
A useful contract does not spend three pages on the availability of our teams. It answers precise questions.
- Scope: CMS, theme, plugins, server, domain name, mailboxes. And what is not covered, stated explicitly.
- Frequency: monthly updates or on release of a critical patch, daily backups, retention period, storage location.
- Monitoring: automated uptime checks with alerting, plus watch on domain and certificate expiry dates.
- Response time: two levels are enough. Site down or checkout broken, a few working hours. Minor defect, a few days. A single response time with no severity grading means nothing.
- Included hours and the rate beyond them.
- Exit: at the end of the contract you leave with the accesses, a full backup and the documentation. Short clause, large saving.
- Monthly report: one page, listing what was updated, detected or fixed.
CNDP: an obligation of means, not a tick box
If your site collects personal data (contact form, customer account, newsletter, job applications), Law 09-08 requires you to declare the processing and secure it. The text speaks of appropriate security measures, which is an obligation of means: a CMS left two years without patches on a site storing customer details is hard to defend after a leak. Technical upkeep is part of the evidence that you take the subject seriously. The formalities and the legal notices are covered in our guide to website CNDP compliance, and for edge cases, check the CNDP site directly.
In-house or outsourced: where to draw the line
Outsourcing everything is not always the answer, and keeping everything almost never is. The dividing line follows the type of task rather than the size of the company.
Handled well in-house: publishing content, adding products, updating opening hours and contact details, processing form submissions. Half a day of training at delivery saves you from paying a provider to change a phone number.
Worth outsourcing: technical updates, backups and restores, monitoring, reacting to an outage. Not because any of it is wizardry, but because it has to happen on a fixed schedule, done by someone who has watched sites break before. A common middle case: the company has an IT person who runs the network and the workstations. They can hold the monitoring and the backups, but updating a WooCommerce stack full of paid plugins is a different job. To decide, picture the outage on a Saturday morning and ask who looks at it, and with which credentials.
Taking back control of a site already delivered
Arrowlancer builds brochure sites, ecommerce stores and custom web applications (our services) and then keeps them running under contract: security updates, tested backups, hosting monitoring, fixes and a monthly report. We also take over sites built elsewhere, after an assessment that says honestly what is salvageable. If yours has been live for months with nobody looking after it, describe the situation through the contact form and you will get a clear opinion before any quote.