Most website conversations in Dubai stop at the build. You agree a price, the site launches, everyone is pleased, and then nobody talks about the site again until something breaks. That gap is where most of the real cost hides.
Website maintenance in Dubai starts from around AED 150 a month for a small business site, whether billed monthly or as an annual maintenance contract (AMC). That covers updates, security patching, SSL, backups, and uptime monitoring. A typical WordPress business site with a few content changes each month sits closer to AED 350 to 600. Those are small numbers next to what a build costs, which is exactly why they get skipped, and exactly why so many sites quietly fall apart in year two.
We maintain sites for UAE businesses from our Dubai and Bengaluru teams [6], so this guide is written the way we would explain it on a call: what an AMC actually covers, what it deliberately leaves out, what the market really charges, and the contract terms worth checking before you sign anything.
What is a website AMC (annual maintenance contract)?
AMC stands for annual maintenance contract. It is a yearly agreement covering the ongoing upkeep of a website, separate from the one-off cost of building it. The term is used widely in the UAE and India and less so in Europe or the US, where the same thing is usually called a maintenance retainer or a care plan. If a Dubai agency quotes you an AMC, they mean a recurring fee to keep the site running, secure, and current.
The confusion usually comes from what "upkeep" means, because it is not one job. It is a bundle of small recurring tasks that individually take minutes and collectively decide whether your site is still working properly in three years.
What does website maintenance actually include?
A reasonable maintenance plan covers most of the following. If a quote does not name these, ask which ones it includes:
- Software updates. CMS core, plugins, and themes, applied on a schedule, with security patches applied faster than the routine cycle.
- Security patching and malware scanning. Regular scans that look for injected code, not just an assumption that nothing has happened.
- Backups with tested restores. Scheduled copies kept somewhere other than the live server, and an occasional real restore to prove they work. WordPress publishes its own backup guidance for exactly this reason [11].
- SSL certificate renewal. Certificates expire on a fixed date and someone has to renew them before it arrives.
- Uptime monitoring. An automated check every few minutes that alerts your team if the site stops responding.
- Speed and Core Web Vitals checks. Watching that the site has not quietly got slower since launch.
- Broken link and error fixes. Links rot, pages get renamed, forms stop delivering. Someone has to look.
- A small content-change allowance. A set number of hours or requests each month for text swaps, price updates, images, and blog posts.
- A monthly report. What was updated, what was found, what needs a decision from you.
The last two are where most of the disagreement between clients and agencies happens, so they deserve the most attention in the contract.
Why does website maintenance matter?
Website maintenance matters because the main ways a site fails are invisible until they are expensive: a hack, a slow decline in speed, or an expired certificate. None of them announce themselves, and the honest case for maintenance is not dramatic.
Security is the clearest one. The OWASP Top 10, the security industry's consensus list of the most critical web application risks, puts broken access control first and security misconfiguration second in its 2025 edition [1]. Both are common outcomes of software that has not been patched or has been left on default settings. Once a vulnerability is published, it stops being obscure knowledge and becomes something automated tools scan the whole web for. Your site does not need to be interesting to be found.
Speed and visibility are the slow one. Google defines three Core Web Vitals: Largest Contentful Paint, which should be 2.5 seconds or less, Interaction to Next Paint, which should be under 200 milliseconds, and Cumulative Layout Shift, which should be under 0.1 [2]. Google states that page experience signals feed its ranking systems, and that when competing pages are similar in quality, page experience is what separates them [3]. Sites get slower on their own as images pile up and plugins accumulate. Nobody notices in week one. People notice in month eighteen when enquiries have thinned out and nobody can say why. Our guide to how to rank on Google in the UAE covers what else feeds those rankings.
Certificates and domains are the abrupt one. An expired SSL certificate does not produce a small cosmetic warning. It breaks the TLS handshake, and modern browsers respond by blocking the page and telling your visitor the connection is not private [4][5]. From a customer's point of view the site is not just broken, it looks unsafe. The same applies to a lapsed domain, which takes your email down with it.
None of this requires much work. It requires someone doing a small amount of work reliably, which is a different problem.
What does a monthly website maintenance checklist look like?
A monthly website maintenance checklist covers backups, updates, security, uptime, speed, and content, in that order. Here is the routine we run on every site we maintain:
- Take a fresh backup and note when a restore was last actually tested
- Apply CMS core, plugin, and theme updates, security patches first
- Run a malware scan and read the result, not just the green tick
- Check SSL certificate and domain expiry dates
- Review the month's uptime log for repeat drops
- Submit every form for real and confirm the email arrives
- Compare Core Web Vitals against last month's numbers
- Fix broken links and crawl errors
- Review prices, services, and contact details for accuracy
- Send the client a report of what was done and what was found
If your provider's monthly report does not map to a list like this, ask what they actually did that month. A report that only says the site was maintained is not evidence of anything. And if you maintain the site yourself, treat this as the minimum, with the backup first every single time.
How much does website maintenance cost in Dubai?
Website maintenance in Dubai costs from around AED 150 a month for a brochure site, AED 350 to 600 for a typical WordPress business site, and from AED 1,500 a month for an online store. Here is what each tier actually buys you.
| Plan | Best for | Typically includes | Starts from (AED/month) |
|---|---|---|---|
| Essentials | Brochure and informational sites | Updates, security patching, SSL, backups, uptime monitoring, email support | 150 |
| Standard | Most WordPress business sites | Everything above plus malware scanning, a few hours of content changes, monthly reporting, faster response | 350 |
| Growth | Sites that change often or drive leads | Everything above plus more change hours, Core Web Vitals monitoring, priority response, small design tweaks | 700 |
| E-commerce | Online stores | Everything above plus more frequent backups, payment and checkout testing, plugin compatibility testing, higher uptime commitment | 1,500 |
As an annual maintenance contract, an essentials plan lands around AED 1,800 a year and a standard business plan around AED 4,000 to 7,000 a year. Paying annually usually carries a discount against monthly billing.
Two things to check on any quote. First, whether it is stated before or after VAT: the Federal Tax Authority's standard rate is 5 percent and applies to services like this [7], so an annual figure changes meaningfully depending on which side of it you are looking at. Second, whether hosting is bundled in or billed separately, because a bundled quote and an unbundled quote are not comparable on price alone. Final pricing depends on your site and is confirmed during a short review.
If you want the wider picture of what a site costs over its life rather than just its upkeep, our guide to the real cost of running a website in the UAE covers hosting, domains, tools, and content alongside maintenance.
What is not included in a website maintenance package?
A typical website maintenance package does not include redesigns, new feature development, copywriting, paid licences, replatforming, or SEO campaign work. This is the part worth reading twice, because most disputes start here rather than with the price.
- Redesigns. Reworking how the site looks or is structured is a project, not maintenance.
- New features. Adding a booking system, a portal, or a payment flow is development work.
- New pages beyond the allowance. A text change is maintenance. A new page template is not.
- Copywriting and content strategy. Publishing a post you supply is usually included. Writing it is usually not.
- Paid licences. Premium plugin, theme, and third-party tool fees are typically billed at cost on top.
- Replatforming. Moving from WordPress to something else is a migration project.
- SEO campaigns. Technical health is normally inside the plan. Keyword research, content, and link building are not.
- Out-of-hours emergency response. Sometimes included, sometimes a separate clause, sometimes billed hourly. Find out which.
Ask for the exclusions in writing. A provider who lists them clearly is easier to work with than one whose proposal only contains good news.
How do you compare website maintenance quotes?
Five questions get you most of the way to comparing two proposals fairly.
- How many change hours or requests, stated as a number? Words like reasonable and minor are not a scope. A number is.
- Do unused hours roll over? Usually not, which is fine, but you should know before you plan around it.
- Is hosting in or out? What about email hosting? These are the two line items that make quotes look artificially different.
- What does the service level agreement (SLA) commit to on response time and uptime? A site down at 9pm on a Thursday is not the same request as a text change, and an uptime SLA of 99.9 percent still allows about 43 minutes of downtime a month.
- Who holds the domain, the hosting account, and the source files? The answer should be you.
That last one matters more than the price. Your domain should be registered in your own name and your own account from day one. In the UAE, .ae domains sit under the .aeDA registry operated by TDRA, and registrants have to reconfirm acceptance of the registry's policies at renewal as well as at registration [8], so it is a live obligation attached to your business rather than an administrative detail you can leave with a vendor. If you ever want to change providers, the entire difficulty of that move is decided by who holds these three things.
The UAE-specific parts people miss
PDPL applies to ordinary websites. UAE Federal Decree-Law No. 45 of 2021 came into force on 2 January 2022 and covers the processing of personal data through electronic systems. It requires organisations to secure personal data, keep it confidential, and obtain consent before processing it, with limited exceptions, and gives individuals rights to request correction or restriction [9]. A contact form and a newsletter signup put an ordinary business site in scope. Because this is an ongoing obligation rather than a launch checklist, your privacy notice, your consent behaviour, and your data-retention practice all need someone responsible for them. Our PDPL compliance guide covers what that means in practice.
Where your data physically sits is worth knowing. There is no general requirement for a UAE business to host locally, but PDPL sets conditions on transferring personal data outside the country. Knowing which country your host's servers are actually in, rather than where the provider's office is, is a reasonable question to ask.
There is an official channel if something goes wrong. TDRA operates a cyber incident reporting service, and the UAE Cyber Security Council oversees national cyber resilience under a national strategy that has been moving the country from voluntary guidance toward firmer expectations [10]. If your site is compromised and customer data is involved, that is not only a technical cleanup.
If security is a live concern rather than a background one, our guide to penetration testing and VAPT in Dubai explains when a proper test is worth doing.
Agency, freelancer, or in-house?
There is no universally right answer, only a right answer for your volume of work.
A freelancer is usually the cheapest per hour and works well when you need occasional small changes and you already have a relationship with someone reliable. The risk is availability: one person can get busy, take a contract elsewhere, or simply stop replying, and everything they knew about your site leaves with them.
An agency retainer costs more per hour but buys continuity, a written response commitment, and cover when one person is away. For most Dubai SMEs needing a few hours a month, this is the practical middle, because you are paying for someone to be responsible rather than for a specific number of hours of typing.
In-house only makes financial sense once there is genuinely enough work to occupy someone properly. Below that, you are paying a full salary for partial utilisation and still have a single point of failure.
If you are weighing up local versus offshore delivery more broadly, our comparison of a Dubai agency versus an offshore team goes through the trade-offs.
Do you need maintenance or a redesign?
A quick test. If the problem is speed, security, bugs, broken links, or outdated content, that is maintenance and it is cheap to fix. If the problem is that visitors cannot find what they need, the positioning has moved on, or the site simply does not turn traffic into enquiries, that is a redesign and no amount of maintenance will change it.
The common mistake is paying for maintenance on a site that needed replacing two years ago, and the opposite mistake is commissioning a redesign when the real issue was that nobody had updated anything since launch. A site older than three to five years is usually worth a proper look rather than another year of patching. Our guides on small business website design in Dubai and choosing a web design company in Dubai cover what a rebuild involves, and WordPress versus Webflow versus Next.js is a useful read if the platform itself is what is making upkeep painful.
Real client stories
These are real situations from maintenance work we have taken on.
The site that had been fine for two years. A Dubai services company came to us after their contact form had silently stopped delivering. Enquiries were being submitted and going nowhere. Nobody knew for how long, because there was no monitoring and no monthly check. The fix took under an hour. The lost enquiries did not come back. This is the most common maintenance failure we see, and it costs far more than the plan that would have caught it.
The expired certificate on a Friday. A retailer's SSL certificate lapsed over a weekend. Every visitor got a browser warning telling them the connection was not private, so from the customer's side the business looked compromised rather than merely offline. Renewal is a five-minute task on a known date. It only becomes an incident when nobody owns the calendar.
The plugin nobody had updated. A WordPress site we inherited was running a form plugin several major versions behind, with a publicly documented vulnerability. There was no evidence anyone had exploited it yet, which was luck rather than security. Patching it took ten minutes. The clean-up if it had been found would not have.
How SKIMBOX handles website maintenance
We keep our website maintenance services in Dubai deliberately plain. You get a named person, a written scope with the change allowance stated as a number, monthly reporting that says what we actually did, and your domain, hosting, and source files in your own name from day one. Our Dubai and Bengaluru teams let us keep the entry price low, starting from around AED 150 a month for a small business site, and we will tell you honestly if what you need is a rebuild rather than a maintenance plan.
See our web development services and cybersecurity services, or contact us for a straightforward quote on your existing site.
For related reading, see our guides on website development cost in Dubai, the real cost of running a website in the UAE, and how to rank on Google in the UAE.
References
[1] OWASP Foundation - OWASP Top 10 web application security risks, 2025 edition. owasp.org/Top10/2025/en/
[2] Google Search Central - Understanding Core Web Vitals and Google search results. developers.google.com/search/docs/appearance/core-web-vitals
[3] Google Search Central - Understanding Google page experience. developers.google.com/search/docs/appearance/page-experience
[4] Cloudflare Learning Center - Common SSL certificate errors and how to fix them. cloudflare.com/learning/ssl/common-errors/
[5] Cloudflare Learning Center - "Your connection is not private" explained. cloudflare.com/learning/ssl/connection-not-private-explained/
[6] SKIMBOX - Internal experience maintaining websites for UAE businesses, 2026. skimbox.co
[7] Federal Tax Authority, UAE - Value Added Tax. tax.gov.ae/en/taxes/vat.aspx
[8] TDRA - .aeDA domain name policies. tdra.gov.ae/en/aeda/ae-policies
[9] U.AE Official UAE Government Portal - Data protection laws, Federal Decree-Law No. 45 of 2021. u.ae/en/about-the-uae/digital-uae/data/data-protection-laws
[10] TDRA - UAE National Cybersecurity Strategy and cyber incident reporting. tdra.gov.ae
[11] WordPress.org - Advanced Administration Handbook, backups. developer.wordpress.org/advanced-administration/security/backup/
