Website maintenance: what breaks when nobody's looking

On launch day, everything works. The form delivers messages, the certificate is valid, the plugins are current, the analytics are collecting. Then everyone moves on. That's normal: a website is a tool, not a permanent project. The problem is that the site keeps living in an environment that never stops moving. In our web services, maintenance is the least glamorous line of the offer, and it's the one that prevents the ugly surprises.

The assumption behind most abandoned sites fits in one sentence: "it works, so it will keep working." True for a hammer. False for a website, because a website doesn't exist alone: it sits on software that receives patches, certificates that expire, Google and Meta services that change their rules, and visitors whose expectations keep rising.

This article walks through what actually breaks when nobody's looking, in the order it hurts. It ends with an honest list of what competent monthly maintenance should contain, whether you do it yourself or pay for it.

The short answer, for the busy

Website maintenance means monitoring and caring for a site after launch, because its environment degrades even when its content doesn't change. Four things break without warning. Software dependencies: in 2025, Patchstack recorded 11,334 new vulnerabilities in the WordPress ecosystem, 91% of them in plugins. Forms, which can stop delivering messages without showing any error. Technical deadlines: since March 15, 2026, a TLS certificate is valid for at most 200 days, and that ceiling drops to 47 days in 2029, per the CA/Browser Forum. And third-party services, which Google or Meta regularly retire, as with Universal Analytics, shut down and deleted along with its data in July 2024. Competent monthly maintenance includes security updates, a real test of every form, deadline monitoring, backups whose restoration has actually been tested, and content updates. Its real value: someone is accountable for looking.

Dependencies: the ground moves under the site

Start with the best-documented mechanism. Most SMB websites run on WordPress, and an average WordPress site stacks a dozen plugins. Each one is software maintained, or not, by a third party. In 2025, Patchstack recorded 11,334 new vulnerabilities in the WordPress ecosystem, up 42% year over year. The distribution tells the story: 91% in plugins, 9% in themes, and only 6 vulnerabilities in WordPress core. The main software is solid; the add-ons are what open the doors.

The most uncomfortable number in the same report: 46% of those vulnerabilities had no patch available at the moment of public disclosure. In other words, applying updates isn't always enough; you also need to know which plugins to remove once their author has stopped answering.

Custom-built sites don't escape this logic, they relocate it: JavaScript dependencies, framework versions, language security patches. The difference isn't immunity, it's a shorter, deliberately chosen dependency chain. Either way, the conclusion is the same: your site hasn't changed, but its environment changes every week. Standing still is exposure, not protection.

The form that fails silently

This is the most expensive pattern, because it's invisible from both sides. A contact form depends on a chain: the field the visitor fills in, the spam filter, the service that sends the email, the inbox that receives it, and that inbox's own filter. Every link can break without displaying anything. The page loads, the button confirms "message sent", and nothing arrives.

The typical scenario runs like this. An update or an email provider change breaks delivery in February. Nobody sees it, since an absence of messages triggers no alert. In May, the owner wonders why inquiries have slowed down and blames the economy. The failure is discovered by accident, three months and an unknowable number of lost customers later. It's the worst kind of loss: it leaves no trace to add up.

The counter isn't sophisticated, it just demands consistency: send a real message through the form every month and confirm it arrives, plus, ideally, automated monitoring that alerts you when volume drops to zero for an unusual stretch.

The silent deadlines: certificates and domains

An expired TLS certificate turns your website into a full-screen security warning. And the margin for error is shrinking: in April 2025, the CA/Browser Forum, the body that brings together browsers and certificate authorities, voted to progressively shorten certificate lifetimes. Since March 15, 2026, a certificate is valid for at most 200 days, down from 398. It will be 100 days in 2027, then 47 days in 2029. Manual renewal, already risky, becomes untenable: the only serious answer is automation, plus monitoring that confirms the automation still works.

The domain name is the cousin deadline, only worse. An expired domain takes down the website AND the email at once, and, past the grace period, becomes a domain anyone can buy. Auto-renewal solves most of the problem, on two conditions: the credit card on file hasn't itself expired, and the reminder emails don't land in an inbox nobody reads. If your domain, hosting and email are scattered across three vendors, our article on what you're actually paying for in hosting helps put things in order.

The third parties that move: Google, Meta and the rest

Your site depends on services you don't control, and those services retire things on notice, not on permission. The example every SMB lived through: Universal Analytics. Google stopped processing data on July 1, 2023, then closed access and deleted historical data starting July 1, 2024. Businesses that had neither migrated to GA4 nor exported their history lost years of data. The website itself showed zero errors the entire time.

The mechanism is general: embedded Google Maps, Instagram feeds, payment gateways, booking widgets, ad pixels. All of it evolves in versions, and old versions eventually get retired. An unmaintained site accumulates these dead integrations: the empty Instagram feed, the map showing an error message, the pixel that no longer measures anything. Each case is minor on its own. The accumulation tells the visitor that nobody looks after this place.

Content drift and hope-based backups

Two quieter forms of decay. First, content drifts. Opening hours change, an employee leaves, a price goes up, a service gets dropped. The site keeps displaying the world as it was in 2024. Each gap is small, but the cumulative effect shows up in lost calls and eroded trust: a visitor who spots one stale detail applies a credibility discount to everything else on the page.

Second, backups. Almost every host "does backups". Almost nobody has ever restored one. A backup that has never been restored isn't a backup, it's a hope. The questions that matter: does the copy include the database AND the files? Is there a copy stored away from the host, to survive a bankruptcy or a compromised account? Has anyone ever timed a full restoration? The right moment to answer is not the day the site goes down.

What competent monthly maintenance contains

If you run your site yourself, here is the honest routine, no magic software required. Once a month: apply security updates, then click through the key pages to confirm nothing broke. Send a real message through every form and confirm it arrives. Check the certificate and domain expiry dates, and the state of auto-renewal. Open your analytics to confirm data is still flowing. Reread the main pages for stale information. Confirm the latest backup exists and, once a quarter, restore one to a test environment.

Two hours a month, maybe three on WordPress. None of these steps requires an expert. The difficulty isn't technical: it's doing it on the first Tuesday of every month, including when everything is fine, including during vacations. Maintenance rarely fails through incompetence; it fails through abandonment, in month three, when nothing broke in the first two.

Where a subscription earns its keep

A maintenance contract doesn't buy technical magic. It buys two specific things: automated monitoring (uptime, forms, certificates, backups) that cuts detection time from three months to a few minutes, and a designated person whose job is to look even when everything is fine. That's the logic of our subscription model: a provider who hosts and maintains your site has a stake in keeping it healthy, because they answer for it every month. A quiet bonus: a maintained site ages better, which pushes back the redesign and its budget.

Let's be honest about the opposite case: a static brochure site, no forms, no commerce, serving as a business card, can get by on an annual check-up. A subscription earns its keep when the site produces something, inquiries, sales, bookings, because that's where three months of silent failure actually costs money.

If you don't know what state your site is in right now, that is exactly the question an audit answers: forms, certificates, backups, versions, content. Ours is free and comes with no obligation.

→ Request an audit of your site