Yes, and it is a large part of what we do. We start with an audit: what the site runs on, what version, what is out of date, whether backups exist, and whether anything is already compromised. That audit is quoted separately, because until it is done neither of us knows what an ongoing plan should cover. Occasionally the honest answer is that a site is cheaper to rebuild than to maintain, and we will tell you that rather than sell you a plan.
Nothing, for a while. Then a plugin with a known vulnerability gets exploited, or a PHP version reaches end of life and the host forces an upgrade that breaks the site, or an SSL certificate lapses and browsers start warning visitors away. The common thread is that these are all cheap to prevent and expensive to fix after the fact, and they tend to happen at the worst possible moment.
A defined amount, yes — typically a set number of hours per month for text edits, image swaps, adding a page or updating a product. Larger work such as a new template or a new feature is quoted separately. We say up front how many hours are included rather than leaving "minor changes" undefined, because that phrase is where most maintenance contracts go sour.
No. Hosting stays in your name and on your card, so you always control the account and can move away from us without losing anything. We will manage the hosting on your behalf, handle renewals and deal with the provider when something breaks, but the account is yours.
Response times are agreed in writing in the plan, with a shorter target for a site that is fully down than for a routine content change. We would rather commit to a target we can actually hit than advertise a number that sounds impressive and gets missed. Our working hours are IST; for clients in other time zones the plan states what is covered outside those hours.
