The 6 Things That Actually Break on Websites Nobody Maintains

Every website maintenance pitch leans on the same analogy: your website is like a car, skip the oil changes and the engine seizes. It sounds sensible. It is also wrong.

Code does not wear out. A site I built years ago serves the exact same bytes today as the day I uploaded it. What actually happens is that the environment shifts underneath your site. PHP versions die, form services change their rules, certificates expire, third-party scripts get rewritten. Your site stands perfectly still while the ground moves.

I have cleaned up enough neglected websites in 8+ years to know what breaks, in what order, and on roughly what timeline. So here is the honest list. No vague hacking threats, no retainer pitch hiding in the last paragraph.

Why the Car Analogy Sells So Well

The car analogy is agency marketing, and it works because it implies universal, inevitable decay: every site, every month, forever. That is exactly what you want prospects to believe when you sell website maintenance at $99 a month.

The truth is less convenient. How fast a site decays depends almost entirely on the stack. A WordPress site with 30 plugins is a moving system with dozens of independent release cycles, any of which can conflict with any other. A static site is a folder of files. I have static sites that have not been touched in years, and the only thing they ever needed was a domain renewal.

That difference matters more than any maintenance plan, and it is one of the reasons I stopped using WordPress for most projects. But whatever your stack, the failure points below are the real ones.

This is what I actually find when someone brings me a site that has been ignored for a year or two. Not hypotheticals. These six, over and over.

1. Plugin and CMS Updates (and Their Conflicts)

WordPress core updates itself for minor releases. Plugins mostly do not, unless someone switched that on. So updates pile up, and I regularly open neglected dashboards showing 25 or 30 of them pending. Now you are stuck both ways. Skip the updates and you accumulate known security holes, because disclosed plugin vulnerabilities are the number one way WordPress sites get hacked. Apply a year of them at once and something breaks, because your page builder changed its markup or two plugins now want different versions of the same library. That trap is exactly why this stack needs a human on a schedule.

2. PHP Version Deprecations

This one is the silent killer. Your host will eventually force-migrate your server to a newer PHP version, because running end-of-life versions is a liability for them. PHP 7.4 reached end of life in November 2022, and a wave of older themes and plugins threw fatal errors when hosts moved everyone to 8.x. When it happens to your site, you do not get a warning banner. You get a white screen, and you find out from a customer.

3. Form Endpoints That Die Silently

The most expensive failure on this list, because nobody sees it happen. Contact forms deliver mail through SMTP credentials, an API key, or a third-party service, and all three of those rot. Passwords get rotated, keys expire, providers shut down or tighten their authentication rules. The form still looks fine. It even shows visitors a success message. The message just goes nowhere. I have seen forms fail silently for months, and the only symptom was the owner saying leads had been slow lately. Go submit your own contact form. Today.

4. SSL Certificate Renewals

Let's Encrypt certificates renew automatically every 90 days, right up until the renewal job breaks, the DNS changes, or the site moves servers and nobody reconfigures it. Then visitors get a full-page browser warning telling them your site is not safe, which for a business might as well be a closed sign on the door. And the rules are tightening: the CA/Browser Forum has voted to shrink maximum certificate lifetimes step by step, down to 47 days by 2029. Automation will handle it. When the automation works.

5. Domain Expiry

Boring, catastrophic, and more common than you would think. The credit card on file expires, the renewal notices go to an inbox nobody checks anymore, and the domain lapses. Catch it in the grace period and you pay a normal renewal. In the redemption period you typically pay $80 to $150 on top. Miss that too, and drop-catching services will register your domain within minutes of release. Then you are negotiating with a squatter for your own name.

6. Third-Party Scripts That Change Under You

Your embedded map, your analytics, your chat widget, your Instagram feed: all code you do not control. Google changed its Maps API pricing in 2018 and thousands of embedded maps turned into gray error boxes overnight. Universal Analytics shut down in July 2023, and sites that never migrated have been flying blind ever since. The pattern repeats every year with smaller services. Nothing on your server changed. The thing it talks to did.

The Decay Timeline: 6, 12, 24 Months

Take a typical small-business WordPress site and stop touching it.

At 6 months, nothing looks wrong. The dashboard shows 15 or 20 pending updates, the host has sent an email about PHP that nobody read, and the site is a touch slower. Superficially fine. That is precisely what makes neglect so easy.

At 12 months, the odds catch up. Usually at least one plugin has been abandoned by its developer, the contact form has had its first silent outage, and the site is running plugin versions with published vulnerabilities. Bots scan for those constantly. Not because your business matters to them, but because scanning is free.

At 24 months, the forced PHP migration has usually happened, and with it either a broken layout or a white screen. If the site is still up, there is a real chance it is quietly hacked: spam pages for fake merchandise or pharma keywords sitting in the Google index under your domain. I have been called in for exactly that cleanup more than once, and I wrote up the defensive side in my website security hardening checklist.

The same 24 months on a static site? Almost nothing happened. The domain auto-renewed, the SSL auto-renewed, and the form endpoint deserved a test twice a year. That is the part maintenance pitches leave out: the need for website maintenance scales with stack complexity, and some stacks need close to none.

Is Your Retainer Real Work or a Subscription for Silence?

Some maintenance retainers are honest work. Plenty of $99-per-month plans are three auto-update checkboxes the provider ticked once, two years ago. From the invoice, you cannot tell the difference.

Here is the test: ask for last month's work log. Specifics, in writing. What was updated, what was backed up, where the backups live, and when someone last actually restored one to prove it works. An honest provider answers in five minutes because the log already exists. If what you get back is a screenshot of an uptime dashboard, you are not paying for maintenance. You are paying for silence.

To be fair to the good ones: real maintenance is labor plus insurance. Testing updates before applying them, verifying backups offsite, watching security advisories, fixing the small stuff before you notice it. That is worth real money on a complex site. It is just not what the bottom-tier plans deliver.

The Minimal Viable Maintenance Setup

If you run WordPress and would rather not pay a retainer, here is the monthly 30-minute routine that covers most of the list above:

• Back up first, store it off the server, and check the file actually exists
• Update core, themes and plugins, then click through your five most important pages
• Submit your own contact form and confirm the email arrives
• Confirm domain auto-renew is on and the card on file has not expired
• Run a free uptime monitor so you hear about outages before your customers do

If you also care about rankings, fold in my monthly SEO maintenance checklist while you are in there. On a static site, the honest version of this routine is quarterly, and most of it is checking that two renewals are still on autopilot.

So, Does Your Website Need Monthly Maintenance?

Honest answer: it depends on what it is built on, and anyone who answers without asking that first is selling something.

WordPress or any plugin-heavy CMS: yes, someone needs to look at it monthly. Whether that is you with the checklist above or a provider with a real work log is a cost question, not a technical one. A static site: no, not monthly, and a provider charging you monthly for one should be able to explain exactly what they do in those 30 days.

I do not sell maintenance retainers, so I have no dog in this fight. What I do is build sites that need less maintenance in the first place, and occasionally excavate ones that got none for two years. If your site is somewhere on that decay timeline and you are not sure how deep, let's talk. Checking it now is cheaper than excavating it later.