Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 91% of them in plugins, and 46% were not fixed by the developer in time for public disclosure. That number is the reason most website maintenance plans exist. It is also the reason a Webflow maintenance retainer has to be sold differently: Webflow patches its own platform, so the plugin update cycle that fills a WordPress care plan is simply not there.
This guide is for agencies that want to resell Webflow maintenance under their own name with a partner doing the work. It covers what the retainer is for once patching is off the table, how published Webflow plans price it, how to structure the margin, and the monthly report that makes clients renew. Prices come from vendor pages we opened on 2026-10-28.
What a Webflow retainer is no longer for
The first mistake agencies make is copying a WordPress care plan onto a Webflow site. Most of that list is done by the platform.
Webflow's security page says it removes "the weekly patch cycles and plugin hardening most platforms require", and lists automated patches and updates with no customer maintenance, TLS 1.2 or higher on all sites, HSTS by default, SOC 2 Type II and ISO 27001. Its hosting page lists automatic backups with one-click restore, free SSL certificates that renew automatically, and DDoS and bot protection through Cloudflare. These are vendor claims, but they describe the product as shipped, not a feature you configure.
| Task | Typical WordPress care plan | On Webflow | Left for the retainer |
|---|---|---|---|
| Core and plugin updates | Weekly, by the provider | Platform, automatic | Nothing |
| Security hardening and malware removal | Included in higher tiers | Platform | Review third-party scripts |
| Backups | Cloud backups, often several a day | Automatic, one-click restore | Named save points before big edits |
| SSL certificates | Provider or host | Automatic renewal | Domain and DNS renewals |
| Uptime monitoring | 24/7 checks | Hosting is the platform's job | An outside check on forms and key pages |
| Content edits | Higher tiers | Editor and CMS | Most of the actual work |
| Speed optimisation | Top tiers | CDN and image handling built in | Scripts, embeds, image discipline |
Source: WP Buffs pricing page; Webflow security and hosting pages, read 2026-10-28
For comparison, WP Buffs' entry WordPress plan is $89 a month for weekly updates, uptime monitoring and four daily cloud backups, and unlimited edits start in the $179 tier. A Webflow site does not need the first plan at all. It needs something closer to the second, minus the security half.
The five things a Webflow maintenance retainer covers
Once patching is gone, what is left is operations. We would scope a white-label retainer around five blocks, each with a named owner on the partner side.
Content and CMS operations. Publishing blog posts, adding case studies, updating team pages, cleaning up CMS fields that marketing has started using for things they were not designed for. This is the bulk of the hours. If the site was handed over well, as our Webflow client handover kit describes, the client does the simple edits and the retainer covers the rest.
Small builds. A new landing page from existing components, a new CMS template, a pricing table change. Define a ceiling: anything over a set number of hours becomes a project with its own quote.
Monitoring. Forms that stop sending, third-party scripts that slow pages down, and plan limits. Webflow's Basic Site plan, $15 a month billed yearly, includes 10 GB of bandwidth, and its pricing page says two consecutive months over the limit trigger an automatic plan upgrade. Someone has to watch that before the client sees a higher invoice.
Search health. Broken links after content edits, missing meta descriptions on new CMS items, redirects when a page is renamed, and Core Web Vitals. Google's thresholds are a Largest Contentful Paint within 2.5 seconds, Interaction to Next Paint of 200 milliseconds or less and Cumulative Layout Shift of 0.1 or less, measured at the 75th percentile of page loads.
Access hygiene. Who has seats, who has left the client's team, which agency and partner guests still have access. On Webflow this is a real job, because seats cost money and stale access is how mistakes reach a live site.
How published Webflow maintenance plans are priced
Few Webflow studios publish maintenance prices. The ones that do fall into three shapes: a care plan with approximate hours, a prepaid hour block, and an embedded team with no hour count.
| Provider | Shape | Price | Hours or cadence | Implied rate |
|---|---|---|---|---|
| Flow Hive Digital, Care Basic | Care plan | $1,500 a month | Up to about 5 hours | About $300 an hour |
| Flow Hive Digital, Care Pro | Care plan | $3,000 a month | Up to about 10 hours | About $300 an hour |
| Flow Hive Digital, Care Elite | Care plan | $5,000 a month | Up to about 20 hours | About $250 an hour |
| Foursets, Maintain | Hour block, monthly | $900 / $1,750 / $3,250 | 10 / 25 / 50 hours, 72-hour turnaround | $90 to $65 an hour |
| Foursets, Maintain | Hour block, annual | $8,000 / $14,000 / $18,000 | 100 / 200 / 300 hours | $80 to $60 an hour |
| Flowout, Webflow development | Embedded team | From $5,900 a month | Priority start within 1 business day is +$1,900 | Not stated |
| Loudface, Solo Autopilot | Embedded team | From $5,000 a month | Weekly maintenance batch, 2-hour response | Not stated |
Source: Flow Hive Digital, Foursets, Flowout and Loudface pricing pages, read 2026-10-28
The spread is the point. A care plan at about $300 an hour is selling availability and responsibility. An hour block at $65 to $90 is selling labour. When we compared 33 rate cards in how Webflow agencies price builds, the same gap showed up. Check the page again before you quote against it, because published plans change without notice.
For an agency reselling white-label maintenance, the useful question is which shape the partner sells you and which shape you sell the client. Buying hours and selling a care plan is where the margin sits, as long as you carry the responsibility the care plan implies.
Structuring the resale and the margin
The arithmetic is simple. The structure around it is where retainers fail.
Price the client on outcomes, buy from the partner in hours. Using only the published figures above: if a partner sold you 10 hours a month at Foursets' $900 rate, and you sold the client a care plan shaped like Flow Hive's Care Pro at $3,000 for about 10 hours, the gross margin is $2,100 before your account management time. The numbers are illustrative; the ratio is what to check in your own quotes.
Decide what happens to unused hours. Three options: they expire, they roll over for one month, or they convert into a quarterly improvement task. Expiry is cleanest for the partner and worst for renewal. A one-month rollover is the usual compromise.
Set response times you can honour through the partner. If the partner promises 72 hours, the client contract cannot promise 24. Loudface publishes a 2-hour response time and Flowout charges $1,900 a month extra for a next-business-day start, which tells you what fast response costs.
Agree the term. Foursets' Maintain packages carry no retainer commitment, and its development retainers are billed monthly with no lock-in. Month-to-month is easier to sell. A three-month minimum is easier to staff.
Write the scope ceiling into both contracts. The same ceiling, the same definition of a small build, in the client agreement and the partner agreement. The contract structure in our guide to white-label Webflow development applies here unchanged.
Webflow account structure for a white-label retainer
Webflow's Workspace plans decide how the partner gets into the client's site without appearing in it.
As of 2026-10-28, Webflow's pricing page lists the Freelancer Workspace at $16 a month billed yearly and the Agency Workspace at $35. Both include free guest access in client Workspaces, which lets a partner join a client's account on behalf of a whole team without using paid seats. The Agency plan adds unlimited staging sites and three free client seats per site, against one on Freelancer. Client payments, on both plans, let the client put their own card on file for the Site plan.
Who pays the Site plan. The client, through client payments or their own Workspace. A retainer that quietly includes hosting turns the agency into a reseller of Webflow's prices, and Webflow publishes those prices.
Whose guest seat. The agency should be the guest in the client Workspace, with the partner working through the agency's access. Then the activity a client sees is the agency's, and removing the partner is one change.
What the platform logs. Site activity logs are listed on Webflow's Team and Enterprise platform plans, not on ordinary Site plans. On smaller sites, the change log in the monthly report is the only record the client gets, which is one more reason to write it.
The monthly report clients keep paying for
A retainer renews when the client can see what it bought. On Webflow, "we updated your plugins" is not available as filler, so the report has to show real work and real numbers.
| Section | What it shows | Where the data comes from |
|---|---|---|
| Changes shipped | Each edit, page or template, with a link | The partner's ticket log |
| Caught before the client noticed | Broken forms, failed integrations, bandwidth trend | Form tests, Webflow usage, script checks |
| Search health | New errors, redirects added, pages indexed | Google Search Console |
| Speed | LCP, INP and CLS against Google's thresholds | Field data at the 75th percentile |
| Hours | Used, remaining, rolled over | The retainer ledger |
| Next month | Two or three proposed improvements | The agency's account lead |
Source: Google web.dev Core Web Vitals thresholds; Octo report structure
Three rules keep it useful. One page, because the person who approves the invoice reads it in two minutes. The "caught" section first after changes, because it is the evidence the retainer is needed. And "next month" always carries a proposal, because that is how a maintenance retainer turns into small paid projects.
The partner drafts it; the agency sends it under its own brand and adds the commercial line. We would hand the agency a draft by an agreed day each month, and the agency decides what the client sees.
What this means for an agency adding Webflow maintenance
Recurring revenue is worth building. The Admin Bar's 2026 survey of 622 agency owners found that among those pricing on retainers, 51.2% were consistently profitable and 56.6% grew in 2025, though the survey notes that stronger agencies may simply be the ones that adopt retainers. Its cleaner finding is the 25% line: past it, fewer than one in ten agencies said they were rarely or never profitable. The survey covers WordPress businesses, so treat it as a proxy for Webflow agencies.
On Webflow, that recurring revenue has to be earned with operations, not patching. Scope the five blocks, buy hours and sell outcomes, give the client's marketing team the editing rights they need, as in our piece on a site the marketing team can actually edit, and send the one-page report every month. We built 20+ Webflow sites in twelve months as Web Tonic's white-label partner, and we quote maintenance per project rather than publishing a rate. Our white-label service page explains how we scope it.
