Here is why most business websites end up neglected: when you skip WordPress maintenance, nothing happens.
You log in, see a red badge saying eleven plugins need updating, think "I will do that later", and close the tab. The site still loads. The form still works. Nobody complains. So you conclude the updates were never urgent.
That conclusion is wrong in a way that is hard to spot. The damage builds quietly for months before it shows up in anything you would notice — and by then the cheap fix has passed you by.
Why "if it isn't broken, don't fix it" fails here
That saying works fine for a kettle. Nobody is inventing new ways to break your kettle while it sits on the counter.
Websites are different. Your site is built from software written by other people, and that software is actively studied by people hunting for weaknesses in it. When someone finds a weak spot in a popular plugin, the developer releases a fix as an update — and here is the part that catches people out. That fix is published in public, along with a description of the problem it solves. Anyone can then read exactly what the weakness was and go hunting for sites that have not applied it yet.
The National Cyber Security Centre is blunt about this in its vulnerability management guidance: most incidents happen because attackers take advantage of publicly disclosed weaknesses, often indiscriminately, as soon as they become public.
An out-of-date site is not simply an old site. It is a site with a list of its own known weaknesses published on the internet.
Weeks 1 to 4: nothing visible
You will notice nothing. What has changed is invisible: a handful of your plugins now have published, known weaknesses, and automated software crawls the web constantly looking for exactly this. It is not personal — it is a machine checking millions of sites for the same short list of problems.
At this stage the fix takes ten minutes. That is the cheapest this problem will ever be.
Months 2 to 6: things start failing quietly
Your plugins are now several versions behind, and some no longer play nicely with each other or with the version of PHP your hosting runs. The symptoms are subtle:
- →The site slows down. A second or two longer than it used to — enough to lose a share of mobile visitors.
- →Your contact form starts failing. It still says "thank you, your message has been sent", but the message never arrives. You just notice enquiries seem quiet.
- →Small display bugs appear. A button sits wrong on mobile. Images stop resizing.
- →Your backups quietly stop running. The plugin has broken, but the only place it says so is a dashboard notice you never look at.
That last one matters most. Site backups turn a disaster into an inconvenience, and a backup you have never tested is not a backup — it is a hope.
Months 6 to 12: real risk, and updates become dangerous
The plugin vulnerabilities on your site are now old, well documented and widely known. If something automated finds you, you might get spam pages injected, hidden links added, or visitors redirected somewhere unpleasant. That is when Google gets involved: if its systems decide your site is unsafe, they put a full-screen red warning in front of every visitor, and rankings drop.
There is a second problem. WordPress updates have now become risky in themselves. One version behind, updating is safe. Fifteen versions behind across twenty plugins, clicking "update all" can take the whole site down, because those updates assume changes introduced by the versions you skipped.
Year 2 and beyond: rebuild territory
Past roughly two years of no attention, the maths stops working in favour of repair. Some plugins have been abandoned by their developers entirely. Your theme may no longer be supported. At that point you are not maintaining a website, you are performing surgery on one — and a maintenance bill you avoided for two years has quietly become a rebuild cost.
What breaks, how likely it is, and what it costs
| What goes wrong | When it shows up | How likely | Cost to prevent | Cost to fix afterwards |
|---|---|---|---|---|
| Contact form silently stops delivering | Months 2–6 | Very likely | Included in monthly care | Lost enquiries you never knew about |
| Site slows down noticeably | Months 2–6 | Very likely | Included in monthly care | Half a day of dev time, plus lost visitors |
| Backups stop running unnoticed | Months 1–6 | Likely | Included in monthly care | Nothing to restore from when you need it |
| Display bugs on mobile | Months 2–8 | Likely | Included in monthly care | £100–£400 per fix |
| Site hacked or spam pages injected | Months 6–12 | Rising over time | Included in monthly care | £500–£2,000 clean-up, plus downtime |
| Google flags the site as unsafe | Months 6–12 | Possible after a breach | Included in monthly care | Clean-up, review, weeks of lost traffic |
| Updates too far behind to apply safely | Months 9–18 | Likely | Included in monthly care | £400–£1,200 staged catch-up |
| Site needs full rebuild | Year 2+ | Possible | Included in monthly care | £2,500+ |
Every fix in that right-hand column costs more than the prevention did, and the gap grows the longer you leave it.
What a basic maintenance routine covers
None of this is complicated:
- →Weekly updates to core, plugins and themes — applied carefully, not by clicking "update all" on a live site.
- →Daily off-site backups, stored away from the server the site lives on, and tested occasionally.
- →Uptime monitoring, so somebody knows the site is down before your customers do.
- →Security scanning for injected code and known problems.
- →Speed checks, so a slowdown is caught while it is still gradual.
- →Form testing — the most valuable five minutes of the month.
Our own WordPress maintenance plans cover exactly that. What matters is that somebody does it, on a schedule.
Website security is not a separate project bolted on afterwards, either. A site running a small number of well-chosen plugins is far easier to keep secure than one running thirty added over the years — which is why decisions made during web design in Essex projects determine how much maintenance a site needs for life.
The short version
Skipping maintenance does not break your site today. It builds up quietly, then hands you a bill much larger than the one you avoided. Months two to six cost you enquiries you never know about. Months six to twelve bring real breach risk. Year two turns a maintenance question into a rebuild question.
If you are not sure where your site sits on that timeline, get in touch and we will take a look and tell you straight — including if the answer is that you are fine and do not need us.
