Website care and AMC, all seven emirates
Website maintenance in Dubai, with the hours and exit terms in writing
I'm Ashish Sharma, founder of Codingclave, and I look after WordPress, WooCommerce and Shopify sites for UAE businesses, Arabic pages included.
From AED 600 a monthexcl. VATSee pricing →
- 4.9 on Google (92 reviews)
- Your URL read first, no login
- Domain and logins stay in your name
- Arabic and English checked as a pair
- Mon–Sat 08:30–17:30 Gulf Standard Time
- ★ 4.9 on Google (92 reviews)Lucknow, India profile
- 200+ projects since 2017
- Top Rated on Upwork, 100% Job Success
Founder-led delivery
Overview
A site can also go down with every task ticked off, because a date passed. A .ae name not renewed by its expiry date drops out of DNS. PHP 8.2 gets its last security fix on 31 December. On 12 Oct 2026 I read nine UAE agency maintenance pages: fees run from AED 50 to AED 30,000 a month, and only one says how many hours its fee buys.
By Ashish Sharma, founder · Updated 12 October 2026
Quick answer
How much should I pay for website maintenance in Dubai each month?
Most UAE agencies that publish a plan price start between AED 350 and AED 750 a month: Si3 from AED 350, Global Media Insight from AED 500, Red Berries from AED 500 or 750 (its own pages disagree), AUN Digital from AED 600, Wistech from AED 700. Ask for the hours before the fee. Only Si3 states what its money buys: 12 hours a month on a one-year minimum. Global Media Insight caps hours yearly without giving the number, and unused ones are lost. Every scope we send answers the six questions below in writing.
- How many hours does the fee buy each month?
- Do unused hours roll over, and what does an extra hour cost?
- What response time applies, inside which hours?
- What are the minimum term and notice period?
- At exit, who holds the domain, hosting and logins?
- Is the figure before or after VAT?
01of 9
Seven UAE maintenance price pages, and what each fee actually buys
Skip the price column on first read. The last two tell you whether the price means anything. IDS Logic and Spiral Click publish no figure, so they're left out.
| Provider | Monthly figure on the page | Hours, minimum term or rollover rule stated | What doesn't add up |
|---|---|---|---|
| Si3 Digital | From AED 350 (business, 12 h, 2 of them development); from AED 550 (e-commerce, 24 h); one-off work from AED 125/h | 12-month minimum on business, 3-month on e-commerce. Response 6–12 h and 3–6 h. No rollover or overage rule | Plan hours come to roughly AED 23–29 each against its own AED 125 rate, unexplained |
| Global Media Insight | AED 500–1,000, then quoted | Yearly hour cap, number not given. Unused hours lost. 30 min / 4 h / 9 h by priority, Mon–Fri 08:00–17:00 | Gold and platinum tiers are named but never priced |
| Red Berries | AED 750–10,000+ (body text) | Plans named without prices. No term stated | Its FAQ says AED 500–10,000, and the yearly cost table is in USD |
| AUN Digital | AED 600–1,000 for CMS sites; corporate from AED 15,000 | None stated | Its yearly range starts at AED 3,000, but its own monthly floor comes to AED 7,200 a year |
| Wistech (article, 6 Apr 2026) | AED 700–1,400 / 1,400–2,400 / 2,400–5,000; enterprise e-commerce 3,000–30,000 | Extra hours AED 200–500 each | The intro says AED 350 entry and 30,000+ top. Chart and table disagree on Standard (2,000 vs 2,400) |
| Innomedia (article, 2 Oct 2026) | AED 50–150 / 150–500 / 500+ | No hours or response times | Its top tier bundles redesigns and A/B testing, which are projects, not upkeep |
| Auronix (guide, updated 29 Sep 2026) | AED 200 an hour, as an illustration | None | A cost guide with no monthly figure in its text |
| Codingclave | AED 600–1,800 a month, before VAT | Hours, rollover, overage rate and response time per priority, all in the written scope | n/a |
Si3's sums are most likely a commitment discount: about AED 29 an hour, under a quarter of its one-off rate, because you pay for twelve months whether you use the hours or not. Two of the 12 are development hours, so the rates may not be like for like. Over a year, Si3 starts at AED 4,200 and Global Media Insight runs AED 6,000–12,000.
AED 50 is 24 minutes at Si3's hourly rate. At that price, ask what a person checks by hand after each update: does anyone place a test order, or open the Arabic pages?
I price every care plan myself, and the first number I write down is hours. Holding a quote already? Run it past the six questions above, then send it on WhatsApp if you want our scope beside it.
02of 9
Six things I can read from your URL without a login
Six things about your website are visible to anyone with the address, so I don't need a password to read them. Send the URL before the discovery call and I start here:
Domain registrar and status
For .com and other generic endings, the public record shows the expiry date. The .ae WHOIS shows registrar and status but no date, so send a screenshot of your registrar dashboard.
Certificate expiry and issuer
A certificate with less than a third of its life left and no replacement issued points to a renewal job that has stopped.
CMS, theme and version
Whatever the page source gives away: WordPress version, theme folder, plugin paths.
Mixed content
Images or scripts still loading over http on https pages.
Field data from real visits
Core Web Vitals from Chrome's CrUX data, if Google has enough traffic.
Safe Browsing status
Whether Google's Transparency Report lists the site as unsafe.
If everything is in date, I'll tell you that too. Search Console and server checks come later, on your accounts.
Who reads it. Me, on WhatsApp from Lucknow, on an Indian (+91) number. Codingclave Development LLP has been founder-led since 2017, with no UAE office. I work 08:30–17:30 Gulf Standard Time, Monday to Saturday, with no overnight or Sunday cover. A site that goes down at 22:00 in Dubai waits until morning, which is why I'd rather your domain and certificate dates sat in a monitor that emails you as well as me. 4.9 on Google (92 reviews), 200+ projects since 2017, Top Rated on Upwork.
03of 9
The calendar that takes websites offline: eleven dates and who owns each
A care plan earns its fee by catching these before your visitors do.
| Date | What changes | What you or your visitors notice if it's missed | Who should have caught it |
|---|---|---|---|
| 4 Jun 2025 | Let's Encrypt ends expiry emails | A browser warning with no reminder beforehand | Developer, or your monitor |
| 15 Mar 2026 | Public certificates capped at 200 days | Hand-installed certificates now lapse about twice a year | Host or developer |
| 20 May 2026 | WordPress 7.0 released | Plugin or page-builder conflicts after updating | Developer, on a copy of the site first |
| 30 Jun 2026 | Shopify Scripts stop running | Discount and shipping rules no longer apply at checkout | Developer |
| 26 Aug 2026 | Deadline for Shopify's legacy Thank you and Order status pages; late stores upgraded automatically | Old additional-scripts tracking may stop firing. Check Google Ads and Meta still record purchases | Developer or marketer |
| 31 Dec 2026 | PHP 8.2 security support ends; PHP 8.4 active support ends | Nothing on the day, which is the danger. Holes found later stay open; WordPress already recommends 8.3+ | Host and developer |
| 10 Feb 2027 | Let's Encrypt default drops to 64 days | More renewals, so a fragile renewal job fails sooner | Host |
| 15 Mar 2027 | Cap falls to 100 days | A paid 'one-year' certificate must be reissued and reinstalled about every three months | Host or developer |
| 16 Feb 2028 | Let's Encrypt default drops to 45 days | Eight or more renewals a year per hostname, so a broken renewal job shows within weeks | Host |
| 15 Mar 2029 | Cap falls to 47 days | Installing certificates by hand stops being practical | Host or developer |
| Your .ae expiry date, every renewal | The registry puts the name on serverHold | The site and email stop resolving as cached DNS answers run out | You and your registrar |
Apps run to store deadlines instead: see mobile app maintenance in Dubai.
Have a project in mind?
Send a few lines on WhatsApp or get a fixed AED quote.
04of 9
A lapsed .ae domain takes the website and email down on its expiry date
Under aeDA's policy AEDA-POL-012 v1.1 (sections 7.1–7.2), a .ae, co.ae, net.ae or org.ae name not renewed by its expiry date goes into Expired Hold, shown in registry tools as serverHold. You still hold the name, but its name-server records are removed from DNS, so browsers can't find the website. Your inbox goes with it.
Find your expiry date
When I ran the public .ae WHOIS on 12 Oct 2026, it showed registrar and status but no expiry date. Screenshot the domain page in your registrar account. If nobody knows where the name is held, ask the registrar WHOIS lists.
Auto-renew only runs if you agreed to it
Section 6.6 allows auto-renewal only with your explicit consent, cancellable free before it runs. Licences run one to five years, capped at five years plus 90 days (section 6.5), so a multi-year renewal is the simplest protection. AEserver charges AED 145 a year ex VAT to renew a .ae (read 12 Oct 2026).
The ‘grace period’ isn’t for late renewal
In this policy it means three days to cancel a new registration or renewal for a refund (section 4). The days after expiry exist, but the site is offline for all of them.
Whose name the registrar account is in
If a past agency registered the domain in its own account, the renewal notices go to them. Move it into yours (accounts in your name).
| When | Registry status | What you can still do |
|---|---|---|
| Expiry date | Expired Hold (serverHold); name-server records removed, so site and email stop resolving as caches run out | Renew. No other change is accepted |
| Days 1–29 | Expired Hold | Renew at your registrar |
| Day 30 | Expired Hold Pending Purge | Nothing: renewal is refused |
| Day 31 onwards | Eligible for purge | Once purged, anyone may register the name |
Domain already on hold? Renew at your registrar today, then send me the URL to check DNS and mail come back.
05of 9
SSL certificates: 200 days now, 47 by 2029
In April 2025 the CA/Browser Forum, where certificate authorities and browser makers set the rules, passed Ballot SC-081v3. It shortens every publicly trusted TLS certificate in steps, paid or free. When one lapses, Chrome shows a full-page warning instead of your site.
The schedule
200 days for certificates issued from 15 Mar 2026, 100 days from 15 Mar 2027, 47 days from 15 Mar 2029. Reuse of a domain check falls to 10 days by 2029, so each renewal needs fresh proof of control.
Let’s Encrypt stopped emailing you
Its expiry reminders ended on 4 Jun 2025, and its default moves from 90 days to 64 on 10 Feb 2027, then 45 on 16 Feb 2028. It points people to a third-party monitor, naming Red Sift Certificates Lite. Set one check per hostname (bare domain, www, mail, shop) that alerts the owner too, or the alert leaves with the agency.
The installs that break first
A paid certificate pasted into cPanel by hand. A server behind a CDN whose rules block the renewal check. A separate mail-server certificate. A renewal cron job that stopped after a hosting move.
06of 9
Hacked WordPress site: the order that gets Google’s warning lifted
Website malware removal means cleaning every file and database table, closing the way in, then asking Google to review the site. It often shows up through someone else: a customer sent to a gambling page, or spam pages in Google under your domain.
1. Confirm what Google sees
Open Search Console's Security Issues report, which Google calls the source of truth, and the Transparency Report. Google suggests URL Inspection rather than opening infected pages in a browser. Redirects often fire only for phones arriving from Google, so I fetch suspect pages with a phone user agent and a Google referrer.
2. Freeze and copy
Copy the files and database first, so the infection can be traced. Then change the hosting, SFTP, database and admin passwords, and remove admins nobody recognises.
3. Clean the whole site
Core, plugins, themes, the uploads folder (which should hold no PHP), the database, and other sites on the same hosting account. Google gives no partial credit for fixing some pages.
4. Close the way in
Find the hole before the site goes back up. On WordPress it is most often a plugin with a published vulnerability, or a nulled (pirated) theme that shipped with a backdoor already inside.
5. Request one review
Explain what you found, removed and changed. Google says reviews can take several days or weeks. Don't resubmit while one is pending, or before the fix is complete.
Keeps getting hacked? A backdoor survived the last clean-up, or the way in was never closed. A second clean-up is a warning.
Hacked now? WhatsApp me the URL. I can't price a clean-up until I've seen how deep it goes, which takes one call. On a nulled theme, a WordPress rebuild at AED 2,200–11,000 can cost less than a third clean-up.
07of 9
Speed work measured on real visits, not a PageSpeed score
Website speed optimisation is judged by Google on Core Web Vitals at the 75th percentile of real page loads, split by mobile and desktop. The PageSpeed number most quotes promise to raise is a lab test on one simulated device, useful for diagnosis but not the target. A low-traffic site may have no field data at all.
| Metric | Good at the 75th percentile | What pushes it over on a typical bilingual WordPress site | First thing to try |
|---|---|---|---|
| LCP (Largest Contentful Paint) | 2.5 s or less | Often the Arabic web font: the headline waits until a large font file has arrived | Preload the font and set font-display; serve one static hero image in WebP or AVIF |
| INP (Interaction to Next Paint) | 200 ms or less | A chat widget and a stack of tracking tags competing for the main thread on the first tap | Defer third-party scripts and remove add-ons nobody uses |
| CLS (Cumulative Layout Shift) | 0.1 or less | The cookie banner pushing the page down after it has drawn | Reserve the space; give images a width and height |
Before blaming the theme, check server response time from a UAE test location. A distant host with no nearby CDN edge adds delay to every page load, and no plugin removes it.
I won't promise a score or an uptime percentage. The scope says how results are reported: field figures where Google has them, a lab trace and change list where it doesn't. If the theme is the bottleneck, read WordPress or custom for a Dubai business.
Have a project in mind?
Send a few lines on WhatsApp or get a fixed AED quote.
08of 9
The drift checks bilingual sites and UAE stores need
Nobody hacked these sites. Someone updated the English price list in March and forgot the Arabic one.
Arabic–English parity after every content change
The English prices change and the Arabic page keeps last year's. Ramadan hours come down on one side only. Smaller, but common: someone who left two years ago is still on the Arabic about page. Rename one language's slug and its hreflang pair breaks. Our bilingual QA checks a new build before launch; this is the repeat run after edits, page pairs side by side, including right-to-left layout after theme updates.
Gateway pages that a store edit broke
The pages your gateway reviewed (refund policy, delivery, terms, contact) must still exist, sit in the footer and match checkout's real delivery fees and return window. After each plugin or gateway-module update, place one real order through your gateway and refund it. A broken checkout shows up there before a customer finds it. Per-sale costs are in the gateway and BNPL fee table; providers are compared in PayTabs vs Telr vs MyFatoorah.
Shopify stores still need looking after
Shopify runs the servers, not your customisations. Scripts stopped running on 30 Jun 2026, so discount and shipping rules had to move to Shopify Functions or an app. Stores that missed the 26 Aug 2026 deadline had legacy Thank you and Order status pages upgraded automatically, and old tracking added there may no longer fire. Build costs in AED are in the Shopify section of our store cost guide.
09of 9
What a website AMC should say in writing before you sign
AMC just means annual maintenance contract, the same service billed by the year. In practice it keeps four things working: the domain and certificate, the software versions, the backups, and the pages that take money or enquiries. These seven lines decide whether a contract is worth the money.
| Scope line | What vague quotes say | What to get written down |
|---|---|---|
| Cover hours | "24/7 support" | Named days and hours. Ours: Mon–Sat 08:30–17:30 Gulf Standard Time, no 24/7 cover |
| Response time | "Immediate action" | A time for each priority, counted inside cover hours |
| Hours, rollover, overage | "Unlimited access" | For example: 12 hours, unused hours roll over three months, a stated AED rate per extra hour |
| Updates | "Regular updates" | Tested on a copy of the site first, with a rollback plan |
| Backups | "Daily backups" | Where they're stored, how long they're kept, when a restore was last tested |
| Search upkeep | "SEO included" | Technical upkeep kept apart from ranking work (our digital marketing is AED 2,500–24,500 a month) |
| Term and exit | Not stated | Minimum term, notice period, how logins come back |
Will the site go offline while it's maintained? Not for routine work. A PHP upgrade or a major WordPress version gets a window agreed in advance. Every line above except our cover hours goes into your scope before you sign. Contract and payment terms are on the UAE overview.
Pricing in AED
Hours for care, fixed prices for rebuilds
Care plans run AED 600–1,800 a month before VAT. Where you land depends on the platform, the plugin count, whether there's Arabic or a store, and how many hours you actually use; a short discovery call settles it, and the signed fee then holds unless the scope grows. Rebuild bands appear only where rebuilding can cost less than another year of repairs.
Website care plan
AED 600 – AED 1,800a month
Excl. VATWebsite care plan (updates, security, backups, small changes) · Monthly retainer, scope agreed in writing
An hours allowance for the work on this page: updates, domain and certificate watch, backups, Arabic–English and gateway-page checks. The scope lists what's included and how.
Get a quote for this plan
One-off clean-up or speed fix
Malware clean-up through to Google's review request, or Core Web Vitals work judged on field data where Google has it.
WordPress website
When the theme is nulled or abandoned and a third clean-up would cost more than starting again.
Business website (custom design, Next.js or WordPress)
When every change means fighting the page builder.
E-commerce store (Shopify, WooCommerce or custom)
When the store keeps failing gateway checks. A typical store takes 2–6 weeks to build.
- Fixed price in AED
- Free scoping call
- No obligation
A rebuild's price is fixed from the day the written scope is agreed, paid 40% before work starts, 40% at the halfway sign-off we agree, 20% at launch. We fix our own bugs at our expense for six months after launch; the final payment hands you the code and IP. Estimate a rebuild with the website cost calculator. Care fees and rebuild stages are invoiced in dirhams and wired to our AED account. Domain, hosting and email costs are in the yearly running costs table, and redesign-or-not in the redesign guide.
Prices are in UAE dirhams (AED) and exclude VAT. Project prices are converted from our GBP price list at GBP 1 = AED 4.90 (11 October 2026) and rounded; monthly plans are set in AED. Codingclave is an India-based supplier and is not registered for UAE VAT. VAT-registered UAE businesses usually account for VAT on imported services under the reverse-charge mechanism; confirm with your tax adviser.
Fixed AED quote
Pick the problem you have today
Certificate and platform dates read from public records with no logins, plus the .ae expiry from your registrar screenshot. If the site then needs care, the discovery call ends in a written scope: hours, response times, minimum term and exit.
Ashish Sharma
Founder, Codingclave
Ashish or the team replies on WhatsApp or email during our hours, Mon–Sat, 8:30am–5:30pm GST.
- ★ 4.9 on Google (92 reviews) · Lucknow, India profile
- 200+ projects since 2017
- Top Rated on Upwork, 100% Job Success
- Founder-led delivery
Prefer WhatsApp?
WhatsApp AshishHow it works
Read first, scoped second, logged in last
You send the URL; I read the public signals
Send the address, and the CMS if you know it, plus a registrar screenshot for a .ae domain. I read the public signals listed above before we talk.
Hours, rollover and notice agreed on one call
Hours a month, rollover, overage rate, response times by priority, minimum term and notice.
You invite us as users, never as owners
You invite us as users on your hosting, CMS, Search Console and gateway; nothing moves into our name. A takeover from another agency starts here, with a list of missing logins and who holds them. The scope sets what month one covers, backup and restore checks and monitoring included.
A change note each month, logins back when you leave
The scope says how you hear what changed each month. When you leave, you get the admin passwords, the backup location and the monitor accounts, and I delete my own user from each.
FAQ
Questions UAE businesses ask us
Can’t see yours? Ask Ashish directly — you’ll get a straight answer, not a sales script.
Ask Ashish directly
What is a fair website AMC charge in Dubai, and what should it include?
Is free website maintenance in Dubai real, or is there always a catch?
My .ae domain has expired: is my website gone, and how long do I have to renew?
How do I remove malware from a hacked WordPress site and get Google's warning lifted?
Our AMC invoice comes from India: where does UAE VAT fit in?
Can a website speed optimisation service guarantee a 90+ PageSpeed score?
Another agency built our site in Abu Dhabi. Can its upkeep move to you?
Ashish Sharma · Founder
Do you know the date your domain expires?
Certificate and platform dates read from public records with no logins, plus the .ae expiry from your registrar screenshot. If the site then needs care, the discovery call ends in a written scope: hours, response times, minimum term and exit.
- WhatsApp us or fill in the form
- Free scoping call
- Fixed AED quote, no obligation
- ★ 4.9 on Google (92 reviews) · Lucknow, India profile
- 200+ projects since 2017
- Top Rated on Upwork, 100% Job Success
- Founder-led delivery
Keep exploring
- UAE
Web development for UAE businesses
- Service
Mobile app maintenance in Dubai
- Tool
Website cost calculator (AED)
- Price guide
E-commerce development cost in Dubai
- Guide
Website development cost in Dubai, 2026
- Guide
WordPress or custom for a Dubai business
- Guide
Website redesign guide for UAE companies
- UAE
Get a free AED quote
Ashish Sharma
Founder, Codingclave · Updated 12 October 2026
Ashish founded Codingclave in Lucknow, India, in 2017 and still leads delivery on every project.
Sources (12)· public sources cited on this page
- aeDA – Domain Name Renewal, Expiry & Deletion Policy AEDA-POL-012 v1.1 (2010 policy marked Current; 101domain copy, read 12 Oct 2026)
- AEserver – Domain pricing
- CA/Browser Forum – Ballot SC-081v3: schedule of reducing validity and data reuse periods
- Let's Encrypt – Ending support for expiration notification emails
- Let's Encrypt – Decreasing certificate lifetimes to 45 days
- PHP – Supported versions
- WordPress – Requirements
- Make WordPress Core – WordPress 7.0 release party, updated schedule
- Shopify – Shopify Scripts will be deprecated on June 30, 2026
- Shopify Help Center – Upgrading and replacing your Thank you and Order status pages
- Google Search Central – Security issues report
- web.dev – Web Vitals