Why offer maintenance contracts for Contao?

I strongly recommend that you read the entire article. But if you are short on time, here is the most important information for you:

• Legal requirements: In Germany, Art. 32 GDPR requires protection in line with the state of the art. This includes installing updates promptly and documenting when that happened.
• Ensure secure operation: Maintenance contracts keep Contao sites secure and up to date through regular updates and monitoring.
• Predictable income: Maintenance contracts give you, as a Contao agency or service provider, a stable and predictable income.
• Competitive advantage: Offering maintenance contracts sets you apart from other providers and makes your offer more attractive.
• Build long-term customer relationships: Maintenance contracts strengthen customer loyalty and lead to recurring business.
• Proactive error prevention: Regular maintenance lets you spot and fix potential problems before they grow into bigger challenges.
• Best time for maintenance contracts: Offer maintenance contracts right at the launch of a website, or use major version changes (for example an upgrade to a new LTS version) and newly published security vulnerabilities as an opportunity to present your service.
• trakked supports you!
  With trakked you keep all your Contao installations in view. You are notified immediately when new updates or security vulnerabilities appear. Thanks to our update feature you can carry out updates with just a few clicks.

We at the trakked team started offering maintenance contracts to all our customers when Contao 4 was released. We do so out of the conviction that it makes an important contribution to the professionalisation of Contao. In our view, anyone who creates Contao websites should also offer regular maintenance for them. In this article we want to give you the reasons for that and share our experience with you.

Contao currently consists of around 200 packages, and the number is growing. That is a good thing, because there is no point in reinventing the wheel. After all, we are happy when a component in our car is an industry standard that every mechanic knows and that any garage can diagnose and repair. As with any other software, there are regular updates for Contao that fix bugs and close security vulnerabilities.

Without updates, problems will occur sooner or later. Bugs should be fixed when needed. Known security vulnerabilities are a different matter. They have to be closed as quickly as possible so that the website keeps running and cannot be infected with malware or taken over and manipulated by attackers. Depending on the installation (an online shop with Isotope eCommerce, for example) the risk is higher, because highly sensitive customer data could be stolen, which in turn can lead to substantial penalties.

On top of that, there are legal requirements you should keep an eye on, and they differ from country to country. In Germany the starting point is Art. 32 GDPR. It requires personal data to be protected in line with the state of the art, and the measures taken to be reviewed regularly. This applies to every website that processes personal data, so a simple contact form is enough.

The term patch management does not appear in the law itself. What the state of the art means in practice is described by the German Federal Office for Information Security (BSI) in its IT-Grundschutz. The European Data Protection Board also explicitly recommends, in its guidelines on personal data breaches, keeping a record of which updates were applied and when.

Excerpt from OPS.1.1.3 Patch and change management

IT systems and software SHOULD be updated regularly. In principle, patches SHOULD be applied promptly after release. Based on the concept for patch and change management, patches MUST be assessed promptly after release and prioritised accordingly. As part of that assessment it SHOULD be checked whether there are known vulnerabilities relating to the patch. It MUST be decided whether the patch is to be applied. If a patch is applied, it SHOULD be verified that it was successfully installed on all relevant systems in good time. If a patch is not applied, the decision and the reasons for it MUST be documented. If hardware or software products are to be used that are no longer supported by their manufacturers or for which no support is available, it MUST be checked whether they can still be operated securely. If that is not the case, these hardware or software products MUST NOT be used any longer.

Translated from the German original.

As of 2023: IT-Grundschutz building blocks, OPS.1.1.3 Patch and change management (in German)

Individual fine proceedings show how seriously this is taken. In 2020 the Data Protection Commissioner of Lower Saxony imposed a fine of 65,500 euros on the operator of an online shop whose shop software had not received security updates for years. The data protection authority of Brandenburg reached a similar decision in 2022, after a content management system had been attacked through a known security vulnerability. Such proceedings are the exception, and a formal warning is the more common outcome. But they show what the authorities look at: whether there is a process, and whether you can demonstrate that it was followed.

Sources: Fine for operating a website with outdated software and the 2022 activity report of the Brandenburg data protection authority (PDF, case from page 43). Both sources are in German.

This is exactly the point where a maintenance contract is more than a service. It turns an occasional update routine into a process you can follow up on, and if you use trakked, the update history of each installation provides the evidence for it.

Besides the secure operation of the website and the legal requirements, there are other good reasons for maintenance contracts.

• Predictable income
  Thanks to maintenance contracts you have secure, predictable, recurring income month after month, without having to write quotations or invest time in acquisition.
• Additional income through flat rates
  The faster you carry out the maintenance work, the more of the revenue you keep as surplus.
• Regular customer contact
  With an average of 16 Contao updates per year, you have a reason to email your customer at least once a month. That can lead to spontaneous follow-up jobs, because you are back on your customer's mind.
• Preventing problems
  When systems are kept up to date, many problems are already solved before you or your customer even notice them. That makes daily work easier and saves a lot of time and trouble.
• Satisfied customers
  When the website works reliably, your customer is happy with your work and speaks well of you. In the best case, your customer recommends you and your service to friends and business contacts of their own accord.

Customers often understand something different by the term "maintenance contract" than we do. That is why it is essential to define clearly IN ADVANCE which services are included in your offer and which are not.

For our installations we generally use only LTS versions (currently Contao 5.3 and Contao 5.7) and keep them current with bugfix and security updates. We make it clear to the customer that major updates, for example from Contao 5.3 to Contao 5.7, have to be paid for separately.

In our view, a basic maintenance contract should cover at least the following points:

• Regular installation of Contao bugfix releases
• Installation of critical security updates at short notice
• Updating the installed extensions (bugfix releases)
• Backups of the database and of the files composer.lock and composer.json before every update
• Fixing problems caused by an update
• Monitoring of availability (uptime monitoring)

Beyond that, you can offer any additional services you like. It helps to define several packages.

• Monitoring and renewal of SSL certificates
• Monitoring of broken and unreachable links
• Regular updates for the statistics tool Matomo
• SEO monitoring and tracking of search engine rankings

There are no limits to additional services. Think about which services come up regularly, can be planned, and offer your customer real value.

You should also consider carefully whether editorial maintenance is a sensible addition, or whether you would rather offer purely technical support in the form of updates.

How you price all this depends on your range of services and on your installations. Our calculator for maintenance contracts helps you work out what makes sense for you.

A common obstacle when selling Contao maintenance contracts is that you can only half-heartedly stand behind your own offer or your price. How is the customer supposed to choose your offer if you would not use it yourself?

Before you offer your customers a maintenance contract, you need to be clear about its benefits yourself. Selling it only works if you are 100 % convinced.

A good maintenance contract should offer added value for both sides. If the customer sees no advantage in it, or does not understand it, they will not take up your offer. So make sure you explain to your customer what regular maintenance does for them: meeting legal requirements, reducing downtime, error-free operation, protection against attackers, and so on.

Our experience shows that with new customers you should raise the topic as early as the quotation. The earlier, the better. That way customers can budget for the recurring costs from the start and are not surprised later. You can even go so far as to not install Contao at all without a maintenance contract and recommend a static HTML page instead. We leave that up to you. One small tip: comparisons with cars really do work well most of the time. And who drives a car without taking it in for a service or an inspection? Why should software be any different, just because you cannot touch it?

With existing customers it is often more effective to wait for a suitable moment. You can offer the maintenance contract together with the update to the current LTS version, Contao 5.7, for example. Possibly even as a promotional package, where you carry out the update and add one year of maintenance as a bonus. The next opportunity you can plan for is already set with Contao 6.

The release of a new security update is another good occasion to offer maintenance.

If a customer has problems with their website because no updates have been installed for a long time, that is also a perfect moment to point to a maintenance contract. It gives you strong arguments that this would not have happened with regular updates.

Keep in mind that there will always be customers who want to do without a maintenance contract. No matter how hard you try, they will ignore your advice. That is fine. This type of person exists, and you will find them in every industry and in every part of the world. But you should offer the maintenance contract to every customer. Always let the customer say no, rather than deciding for them in advance. Perhaps you can also do without such customers and develop your portfolio step by step, so that in the end all your customers appreciate your maintenance services.

We cannot offer you the perfect approach. But we would like to share a few of our experiences with you:

As an example, I will describe how I handle this with my customers

I started offering maintenance to my customers in 2019. In my communication I use the term "Contao update service", so that it is clear where the focus of my service lies. My maintenance contracts generally run for 12 months and are paid in advance. So that neither my customer nor I have to deal with notice periods, my contracts expire automatically after one year. Four weeks before they expire, I ask the customer whether I may extend my service by another year. At first that sounds like extra work, but my customers find it very pleasant and in most cases are happy to extend. It also has the advantage for me that I can adjust my service if needed. When a major update is due, I usually offer it at the time of the extension as well.

After every update I send my customers an email. This is received very positively, it shows the customer that the service they pay for is actually being carried out, and at the same time it serves as evidence of patch management.

If a customer only has a very limited budget, I offer a minimal service. That means I install security updates and nothing else. This reduces the number of updates to two to four per year and makes it more affordable for the customer. That way clubs and small companies can afford updates too.

Over the past years we have identified a few points that we have stopped offering, or only offer under certain conditions.

Mixing content maintenance and Contao updates

The big problem with editorial maintenance is that you usually cannot predict how much work will come up each month. If you define a fixed time budget, the question inevitably arises whether unused hours expire at the end of the month or can be carried over. To avoid conflict with the customer, we limit ourselves to technical maintenance only.

Different Contao versions

The more homogeneous your Contao versions are, the easier updates become. Where possible, we use the current LTS version. That reduces the update effort and lets us ensure secure operation. There will always be exceptions for certain installations, but uniform versions should be the goal wherever possible.

Extra effort for certain themes and extensions

If you like to use ready-made themes, find out in advance what the provider's update policy looks like. Are there regular updates? How much effort does installing an update take? Can the extensions be updated through the Contao Manager?

There are also extensions such as Isotope eCommerce, MetaModels or custom developments that mean more update effort. You should take all of that into account in your service and your price.

If too many incalculable factors come together, we only offer maintenance on a time and materials basis. Especially with projects like these, you should involve the customer directly in drawing up the contract. Perhaps you can word the included services so that they are clear to both sides.

Problematic hosting providers

Despite numerous optimisations in Contao, Composer and the Contao Manager, problems still occur regularly with some hosting providers. In such cases you should discuss the possibility of a migration with the customer. Otherwise you have to factor in potential extra costs here as well, right from the start.

And then there is our trakked tool, developed to do away with the constant effort of maintaining Excel lists. We have added new features regularly, so today trakked offers considerably more than a simple Excel list. We are particularly proud of our update feature, which in our experience reduces the effort for updates by around two thirds. You can find a complete overview of trakked's features here.

For everyday work with maintenance contracts, these features are especially helpful:

• Email notification as soon as new releases or security vulnerabilities appear
• Uptime monitoring, so that you hear about an outage before your customer calls
• Backup of the Composer files before every update
• Weekly status reports that you can use directly in your communication with the customer

The integrated update history also records which update was carried out and when. That gives you exactly the documentation described by the IT-Grundschutz and the European Data Protection Board. For decisions that deliberately go against an update, you can use the notes on each installation.

For us and for many of our customers, trakked is an indispensable tool for managing Contao installations and keeping maintenance contracts.

Try it now without obligation!

The best thing is to try trakked for 30 days without obligation and see our tool for yourself.

Try trakked

Not sure whether trakked pays off for you? Then our calculator might help.

No matter if with or without trakked. Contribute to the professionalization of Contao and offer your customers care and maintenance for their Contao installation.

What is your experience with maintenance contracts? Write us a comment or discuss with us in the Slack channel #wartungsvertaege in the official Contao Slack workspace.