Fixed-price vs hourly — which is safer for an upgrade?

Fixed-price is safer after a paid audit; hourly is safer during the audit. The pattern I default to:

1. Audit hourly ($1.5k–$3k, 1–3 days). I document every blocker, every risky extension, every custom module needing rework. Output is a written report.
2. Upgrade fixed-price based on audit findings. I lock the number. If reality bites and a hidden customisation surfaces mid-build, I show you the line item and we agree before extending scope.
3. Stabilisation hourly (post-launch, 14 days). For bug-fix work that comes out of UAT — capped hourly so you’re not paying retainer rates for guaranteed work.

Avoid two anti-patterns:

• Pure hourly upgrade quote with no cap — the dev has zero incentive to be efficient. I’ve seen $40k upgrades balloon to $90k under pure hourly billing.
• “Fixed estimate” (i.e., fixed-price-but-actually-hourly) — always overruns. If a quote uses the word “estimate” it’s hourly with a fig leaf.

Get the change-order policy in writing before you sign. Mine: any out-of-scope work over $500 gets a written line-item before I touch it.