How to choose a website maintenance agency in Malaysia: questions to ask

Before you hire a website maintenance agency, ask six things: how they back up your site, how they test updates, how fast they reply when the site breaks, who keeps the admin logins, whose name the domain and hosting are under, and how you leave the contract. Good answers are short and specific. If an agency cannot answer them in writing, keep looking.

Most small businesses in Malaysia pick an agency on price and on the sales call. The problems show up a year later, when the site is hacked, a plugin update breaks the contact form, or the agency closes and nobody has the password. The questions below are the ones we wish every customer had asked before signing. If you are still deciding whether to outsource at all, read our earlier guide on what website maintenance includes first.

Backups: how often, where, and have you tested a restore?

WordPress.org says a site has two parts to back up, the files and the database, and you need both to bring the site back. It suggests weekly backups for a small site and daily backups for a busy one, with several recent copies kept in different places.

Ask the agency:

• How often do you back up, and do you copy both the files and the database?
• Where are the copies kept? A copy on the same hosting account is lost if that account is lost.
• How many old copies do you keep, and for how long?
• When did you last restore a backup to check it works?

That last question matters most. WordPress.org advises checking automatic backups with a manual one now and then, because a backup job can fail quietly for months.

Updates: do you test them first?

WordPress applies minor and security releases by itself on most hosting, but bigger releases, plugins and themes still need someone to press the button. The WordPress documentation says to back up before updating and to check that plugins and themes support the new version, because there is no single safe update order.

Ask the agency:

• Do you back up right before each update?
• Do you test updates on a copy of the site (staging) before the live site?
• What do you check after an update: the home page, forms, checkout, login?
• If an update breaks something, how long until you roll it back?

Our guide on updating WordPress without breaking your site explains what a careful update looks like, so you can compare their answer.

Response time: what happens when the site goes down?

"We reply fast" is not an answer. Ask for the numbers in the contract.

• How long until you reply to an urgent problem, such as the site being down or showing a hacked page?
• Are those hours Malaysia time? Do they cover weekends and public holidays?
• Who do we call: a named person, a ticket system, or a WhatsApp group?
• Is cleaning up a hacked site included, or charged on top?

Logins: who holds the keys?

WordPress gives the Administrator role access to every setting on a site. That is the account that matters.

• Will we have our own Administrator account, separate from yours?
• Do you use a separate login for each staff member, or one shared password?
• Is two-step login turned on for admin accounts? WordPress.org recommends it on top of a strong password.
• Do we also get the hosting control panel login and the domain login?

Your company should hold at least one admin login for the website, hosting and domain. If the agency keeps every password, you depend on them for everything.

Domain and hosting: whose name are they under?

For a .com.my domain, MYNIC asks for the organisation's registration certificate (for a company, the one from the Registrar of Companies), so the registrant should be your business. MYNIC also sends its notices to the domain contacts and asks owners to keep those details correct. If an agency puts its own company or email on your domain, those notices go to them, not to you.

Ask the agency:

• Is the domain registered under our company name, with our email as a contact?
• Is the hosting account billed to us or to you?
• If you stop working for us, how do we take over the domain and hosting?

Contract red flags

Be careful when you see these:

• The domain or hosting is listed as the agency's property.
• No written backup or response time terms, only "full maintenance".
• A long lock-in with a fee to get your own files or logins back.
• Hack cleanup, restores or plugin licences are all "extra" with no price.
• No notice period, or no list of what they hand over when the contract ends.

What to do

1. Write down the six questions above and send them to two or three agencies by email, so you get the answers in writing.
2. Check your own domain today. Ask your current provider, in writing, whose company name and email are on the domain record. A public WHOIS lookup for .my domains hides most contact details, so you cannot rely on it for this.
3. Make sure someone in your company has the website admin, hosting and domain logins, kept in a password manager, not in a WhatsApp chat.
4. Ask for one test restore of a backup before you sign, or soon after.
5. Read the exit terms of the contract before the price.

How SyncTech can help

Our website care plans for Malaysian businesses cover backups, tested updates and support from our Johor Bahru team. You can send us the questions above and we will answer them in writing.

Source and credit

We are sharing this information from WordPress.org and MYNIC. This summary is written by Synctech in our own words.

• Backups, WordPress Advanced Administration Handbook, WordPress.org: https://developer.wordpress.org/advanced-administration/security/backup/
• Updating WordPress, WordPress.org Documentation: https://wordpress.org/documentation/article/updating-wordpress/
• Hardening WordPress, WordPress Advanced Administration Handbook, WordPress.org: https://developer.wordpress.org/advanced-administration/security/hardening/
• Roles and Capabilities, WordPress.org Documentation: https://wordpress.org/documentation/article/roles-and-capabilities/
• Frequently Asked Questions, MYNIC: https://mynic.my/faq Retrieved 14 Nov 2026. WordPress is a trademark of the WordPress Foundation. MYNIC is the .my domain registry. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.