White-Label Maintenance for Agency Client Sites

Project work and operations follow different logics. A new build has a budget, a deadline and an end; the care that follows has neither, but does have a permanent claim on attention. In practice the project wins almost every time: it is visible, it is costed, and it pays in larger amounts. Maintaining twelve shops, by contrast, consists of many small tasks that are hard to plan and even harder to interrupt. When a security update lands on a Thursday evening, it competes with Friday morning's sign-off -- and loses. Making matters worse, the necessary capacity cannot simply be topped up: 85 percent (Bitkom, IT labour market 2025) of the companies surveyed report a shortage of qualified IT staff, and an open IT position stays vacant for almost eight months (Bitkom, IT labour market 2025) on average.

On top of that comes a coverage problem in time. A shop runs around the clock; an agency, as a rule, from Monday to Friday. If checkout fails on a Saturday afternoon, the damage is not decided by technical skill but by whether anyone picks up the phone at all. On-call duty is not a minor item: it costs money even when nothing happens, and in a team of three it is hard to staff without holiday and sickness gaps. Precisely in those gaps the expensive part of incidents arises. Almost 40 percent (Uptime Institute) of the organisations surveyed had a major outage caused by human error in the past three years, and 85 percent (Uptime Institute) of those incidents arose because procedures were not followed or were faulty. Silent failures in background processes surface especially late -- a separate article describes how cron jobs and imports can be monitored in their own right.

The decision for or against outsourced care is often made on gut feeling, because the effort is spread across many small tasks. A worked example brings clarity. Assume an agency looks after ten Shopware and WordPress projects of comparable size. The figures below are illustrative and can be replaced with your own; what matters is the structure of the items, not their exact amount.

Pure working time adds up to roughly 28 hours per month. At an internal rate of 95 euros per hour that is around 2,660 euros -- time that does not flow into billable project work in the same period. The real lever, however, lies elsewhere: in on-call cover. It costs regardless of whether anything happens, and it can only be staffed sensibly above a certain team size. Cut it, and the risk shifts to the emergency itself. That price can be quantified: in 2023 the average loss per reported cyber incident was 45,370 euros (GDV), and 48 percent (GDV, Forsa survey 2025) of the companies surveyed have no emergency plan at all. Which services belong in a dependable arrangement is set out in the article on what a maintenance contract should include.

The most common friction in a white-label arrangement is not technical but sits at the boundary of responsibility. Who decides on a major update that forces changes to the theme? Who owns a custom-built extension that stops working after a core update? An SLA maintenance contract answers these questions in advance rather than during an incident. That such clarity is missing is the rule rather than the exception: 77 percent (GDV, Forsa survey 2025) of the companies surveyed consider themselves adequately protected against cyber attacks, while 52 percent (GDV, Forsa survey 2025) rate their IT security position better than it actually is. Which response times are realistic and how they can be measured is explored in the article on response times and emergency support.

The monthly report is the most visible product of outsourced care -- for the end client often the only one. It answers three questions: what happened, what was done, what is next? That includes availability in the reporting month, the updates deployed with dates and a reference to the relevant vulnerability, open items with a recommendation and an effort estimate, and the results of backup and restore tests. How security advisories can be turned into such a report in a traceable way is shown in the article on handling security advisories and vulnerabilities.

Just as important is what the report does not contain: internal ticket numbers, tool names or hints at the partner in the background. A good report reads like a service of the agency, because from the end client's point of view that is what it is. It becomes dependable through evidence rather than assertion -- a restore test only counts once it has actually been carried out and recorded, as the article on backup strategies for online shops describes in detail. The underlying data comes from ongoing monitoring, which records availability, response times and error patterns continuously anyway.

At the beginning there is no contract but a stocktake of the portfolio. For every project it is recorded which system runs in which version, how the server is built, which extensions and custom changes are in use, where the logins sit and when it was last updated. From that stocktake comes a grading: projects with catching up to do are brought to a clean state first, everything else moves straight into the ongoing rhythm. The portfolio is then taken over step by step, typically two to four projects per wave, so that procedures and report format can settle before the volume grows.

The model works economically because monitoring, backups and on-call cover can be bundled across an entire portfolio instead of being arranged project by project. The enquiry option "Outsource maintenance" is designed for exactly that: it asks how many client projects need looking after, because the tiering follows that number -- from a handful of shops to a portfolio of more than 25. The starting point is the stocktake, which you can request without obligation: an honest assessment of which projects run cleanly today, which need catching up, and what continuous care would mean per month.