White-Label Website Support for IT Providers and MSPs

This page is for IT providers, MSPs and managed service desks who look after a client's network, endpoints and identity but have no practical way to take responsibility for the client's website, and who want to add website hosting, patching and incident cover under their own brand.

The website is the line item missing from most IT agreements

Read a typical managed services agreement and you will find endpoints, servers, backup, email, identity, network hardware, licensing and a service desk with response targets. Read it again looking for the public website and you will usually find nothing, or a single exclusion clause saying third party web properties are out of scope.

That exclusion made sense when the website was a brochure. It does not make sense when the website is the organisation's main sales channel, the front door for job applications, the place tenders and member logins live, and the single internet-facing asset that an attacker can reach without any credentials at all. The website is also the asset most likely to be running software nobody has patched in two years.

So the client has a provider who owns everything behind the firewall, a hosting account they bought themselves or inherited from a web agency, and nobody who owns the application in between. When something goes wrong, the gap becomes very obvious very quickly.

What your clients assume you cover, and what your contract says

Clients do not read scope schedules. They read the words "managed IT" and they form a reasonable mental model: you look after the computers, and the website is a computer thing.

Here is what that produces in practice. A marketing manager rings your service desk because the site is down. A finance officer forwards a certificate expiry warning. A CEO forwards an email from a customer saying their browser warned them about the site. An insurer asks whether all internet-facing systems are patched within a defined window, and the client ticks yes because they assume you are doing it.

Your technicians then do one of three things: spend unbillable hours poking at a CMS they do not know, chase a web agency that has not replied in six months, or tell the client it is not covered. The third answer is contractually correct and commercially damaging. It is the moment the client starts wondering what else is not covered.

Why website work sits outside the usual MSP toolset

This is not a competence problem. It is a tooling and lifecycle problem, and it is worth being precise about why.

• RMM agents do not reach the application. Your monitoring stack sees disk, CPU, services and patch state. It does not see that a CMS plugin has a published advisory, that a theme is calling an abandoned JavaScript library, or that a form endpoint is accepting unvalidated uploads.
• Patching is not the same operation. Operating system patching is largely deterministic. Applying a CMS core or dependency update means resolving version constraints, running the update on a staging copy, checking that custom modules and templates still build, and having a tested rollback. That is a development workflow, not a patch window.
• The runtime has its own end-of-life calendar. PHP, Node.js and database versions reach end of security support on their own schedule, and moving a site onto a supported version frequently breaks code written against the old one.
• Nobody owns the codebase. There is often no repository you can access, no deployment pipeline, and no record of what was changed directly on the server.
• Restoring a website is not restoring a file share. Files and database have to come back in sync, with the right search and replace on domains and paths, or you get a half-restored site that looks fine and silently loses data.

None of that fits inside a standard desktop and server practice. It fits inside a web engineering practice with infrastructure discipline, which is a different business.

Three arrangements: refer out, resell white-label, or co-manage

Refer out

You introduce the client, the website partner contracts directly, and you take a recurring share of the revenue. You carry no delivery risk and no scope. Best when the client is already buying website work from someone and you simply want the problem to have an owner you trust.

Resell white-label

You buy hosting, management and SLA cover at wholesale rates and bill it inside your own agreement at your own margin. The client sees one provider, one invoice and one service desk. Your website line item sits alongside your other recurring lines and behaves the same way.

Co-manage

You keep the DNS, identity, email and the client relationship, and the website partner takes the application and the server layer. Useful where the client has strict vendor arrangements, or where the website runs in the client's own AWS or Azure tenancy and you want the infrastructure managed without changing who owns the account.

The Agency Hosting Program runs all three models, and the same structure is described from the agency side in white-label hosting for Australian agencies.

Responsibility split across infrastructure, platform and application

Most disputes come from the middle row of this table. Commodity hosting stops at the operating system, and the MSP agreement starts at the firewall. Everything in between is unowned.

Incident handling when a site is defaced, down or blacklisted

Website incidents are loud. A defacement is visible to every customer, every journalist and every competitor within minutes, and the client will ring the number they know, which is yours.

A usable arrangement means your service desk has one escalation path, a named response target, and an engineer who can get a shell on the box rather than lodging a ticket with a reseller. The first hour decides most of the outcome: contain the compromise, preserve the evidence before you overwrite it, identify the entry point, then restore. Restoring first and investigating later reinstalls the vulnerability and usually the backdoor with it. The sequence is set out in urgent website support: what to do in the first hour.

Blacklisting deserves its own mention. Once Google Safe Browsing flags a domain, the interstitial warning stays until the site is clean and a review is requested, and search traffic stops in the meantime. That is a commercial event, not a technical one, and the client will measure your firm by how fast it ends. For clients who want that cover without a full management agreement, there is also break/fix and emergency website support.

Security questionnaires and the website lines you currently leave blank

Your clients are increasingly asked to answer supplier assurance questionnaires, cyber insurance renewals and procurement schedules. Many of those questions are written for all internet-facing systems, not just the corporate network.

• Are internet-facing applications patched within a defined window of vendor release?
• Is multi-factor authentication enforced on all administrative access, including the CMS?
• Are administrative privileges restricted and reviewed?
• Are backups tested by restoring them, and are restore times documented?
• Is there a web application firewall, and is it in blocking mode rather than logging mode?
• Are security headers and a content security policy in place?
• Is there a logged, dated record of changes made to the application?

Those are the lines that get a "not applicable, third party managed" today. Each one is answerable once a single party owns the website layer and keeps a dated record of what was found, changed and patched. It also shows up directly in external ratings, which is why UpGuard and similar scores so often drop because of website findings rather than anything inside the network.

Branding, ticket flow and who the client talks to

Under the white-label model the client deals with you. Tickets arrive in your service desk, get triaged by your team, and are escalated to a shared channel or into your PSA by integration or email. Reports come to you unbranded so you can issue them on your letterhead. Engineers introduce themselves as part of your delivery team when a call is needed, and no one is invoiced by a party the client has never heard of.

Under the referral model the opposite is true and should be set that way deliberately: the website partner contracts, bills and supports in their own name, and you stay out of the delivery path entirely. The failure mode to avoid is the undefined middle, where the client is never sure who to ring and both parties assume the other is watching.

Commercial models: wholesale margin versus referral share

Wholesale rates are not published and are set per arrangement, because site complexity, traffic profile and response targets vary enormously. There is no minimum number of sites to start.

Taking over a site built by an agency that has moved on

Most of these sites arrive the same way: the agency that built it has stopped replying, the hosting is on a credit card belonging to a marketer who left, and no one knows where the code lives.

A disciplined takeover establishes the facts before promising anything. That means locating and securing the registrar, DNS and hosting accounts, taking a full copy of files and database, finding or reconstructing a repository, documenting runtime and dependency versions, listing every third party integration and API key, and producing a written list of what is unsupported and what must change. Only then is an SLA meaningful, because only then does anyone know what is being committed to. The process is set out in website vendor replacement and transition, and the questions worth asking any partner before you sign are in how to evaluate a managed web services provider.

Frequently Asked Questions

What are white-label IT services for websites?

White-label website services mean a specialist provider delivers the hosting, patching, monitoring and incident response, and you present it to your clients under your own brand, contract and invoice. The client sees one provider and one service desk. The underlying engineering team works behind your name rather than alongside it.

Can an MSP offer website hosting without building its own infrastructure?

Yes. Under a white-label arrangement the partner provides the servers, monitoring, backups, WAF and the engineering capability to patch and fix applications, and you resell it at your own rate. You do not need to run web infrastructure, employ CMS developers, or hold the on-call roster yourself. There is no minimum number of sites required to begin.

Who responds when a client's website is hacked or goes down?

Under a white-label model your service desk takes the call and escalates through a single agreed path to engineers who have server access and know the application. Under a referral model the client contacts the website partner directly. Either way the point is that one named party holds the response target, rather than the client being passed between a host and a web agency.

How is white-label hosting priced in Australia?

Wholesale rates are quoted per arrangement rather than published, because cost depends on platform, traffic, redundancy, backup frequency and the response targets being committed to. You set your own retail price and keep the margin. Referral arrangements pay a recurring share of what the client pays instead.

What happens to websites running unsupported PHP or CMS versions?

They are identified during the onboarding audit and treated as remediation work rather than routine maintenance, because upgrading a runtime or major CMS version usually requires code changes and regression testing. The site is copied to staging, upgraded there, tested, and then cut over. Until that work is done the site is covered by compensating controls such as WAF rules and restricted administrative access.

Does this affect our existing managed services agreement?

Under a referral model, no: the website sits in a separate agreement with the partner. Under a white-label model you add a website line item with its own scope and response targets, backed one for one by the partner's commitments to you, so you are never promising more than you are receiving.

Where UnDigital fits

UnDigital runs managed hosting and website management for enterprise and government clients, and offers the same capability to IT providers and MSPs white-labelled through the Agency Hosting Program. Infrastructure and application engineering sit in the same team, so there is no handoff between the people who run the server and the people who can read the code. Response targets, escalation paths and reporting are set out in writing before anything moves, in the same form as our website support SLAs.

Partner conversations start with a look at the sites you would want covered and what shape the commercial arrangement should take.