What happens to a website nobody maintains

If you don't maintain your website, it may keep working for months, but it falls behind as the software and rules around it change. Its software can stop getting security fixes, a certificate renewal can fail, form emails can land in spam, and a backup may not restore. None of this is certain, and managed hosting handles some of it. The rest needs a named person.

Maintenance here means the regular work that keeps a live site secure and working: updates, renewals, backups and checks. Our ongoing development and support page puts it in one line: a website "is never finished; it's maintained or it decays". Below is what can decay, with dates, so you can judge your own site.

What changes even if nobody touches the site

The language under your site, the certificate rules, the email rules and the tools it connects to all change on published dates. Your site can stay exactly as it was and still fall behind.

Each date is set outside your business, so nobody can move it for you. A site that missed a past date is already behind.

The software under your site stops getting security fixes

The software your site runs on has a support life, and when it ends, security fixes stop. For a WordPress site that means two layers: the language on the server, and the platform and plugins built on it.

PHP is the programming language used to build WordPress. Each PHP version is fully supported for two years, then gets critical security fixes only for two more. After that, php.net says, anyone still using it may be exposed to unpatched security vulnerabilities.

Today, PHP 8.1 is past its end of life, reached on 31 Dec 2025. Version 8.2 gets security fixes until 31 Dec 2026, and 8.3 until 31 Dec 2027. WordPress recommends PHP 8.3 or greater, and warns that older versions may expose your site.

Upgrading is not a switch you flip and forget. PHP 8.3, for example, came with a list of backward incompatible changes, so an older theme or plugin can stop working after an upgrade. The safer path starts with a backup. Then try the upgrade on a private copy of the site, often called a staging site, and check the main pages.

WordPress itself updates partly on its own. Since version 3.7, most sites can apply minor and security releases automatically, and major releases may also be automatic, depending on the installation and settings. Check rather than assume. WordPress says only the latest version is officially supported, and its security team backports fixes to older versions as a courtesy.

Plugins and themes need more attention. Since WordPress 5.5, their automatic updates are opt-in, plugin by plugin and theme by theme. The built-in Site Health screen lists waiting plugin updates as a critical issue, because plugins have deep access to your site. WordPress's hardening guide adds a simple rule: if you are not using a plugin, delete it.

A custom-built site has the same kind of parts: a language, a framework and libraries, each with its own support life. If you are choosing between the two, WordPress or a custom-built website covers that choice. Either way, your developer acts here, with your host for the PHP version.

Security certificates expire sooner than they used to

Certificates now expire within months, and the limit keeps falling. A security certificate, often called an SSL certificate, is what lets a browser open your site over a private https connection. Each one has an expiry date that ends its validity.

Certificates issued from 15 Mar 2026 may last at most 200 days, down from 398. The limit falls to 100 days from 15 Mar 2027 and to 47 days from 15 Mar 2029. The CA/Browser Forum, whose members include certificate issuers and browser makers, voted for this schedule in 2025.

Those are maximums for every issuer; an issuer's own default can be shorter. Let's Encrypt, for example, issues 90-day certificates by default, moving to 64 days on 10 Feb 2027. If your host renews automatically, the shorter life changes little.

The risk is a renewal that fails quietly; Let's Encrypt stopped sending expiry reminders on 4 Jun 2025. After its expiry date, a certificate is no longer valid, and Chrome can show errors such as "Your connection is not private". So ask your host two things: is renewal automatic, and who is told when it fails?

Your domain name renews too

Your domain name has its own renewal date, and your website and email addresses both depend on it. If it lapses, ICANN, the body that coordinates domain names, advises you to contact your registrar immediately. A name that isn't renewed in time may be released for anyone to register. Keep auto-renew on, with a card that is still valid.

Email from your site can start landing in spam

Mail your site sends, such as enquiry notifications and password resets, can go to spam if your domain's email settings fall behind the rules. Since 1 Feb 2024, Gmail has required everyone who sends to Gmail addresses to meet a set of rules:

• SPF or DKIM. Two kinds of email authentication, set up as records in your domain's DNS, the settings that point your domain at your site and your email.
• Valid forward and reverse DNS for the domain or server that sends the mail.
• A secure connection (TLS) when the mail is sent.
• A low spam rate, measured in Google's own tools.

Google says mail that misses these rules might not be delivered as expected, or might be marked as spam. The records live in the domain's settings, not in the website, and fall out of step when a host, email provider or form tool changes. The site may show no error at all.

The check is simple. Each month, send a test enquiry through every form, to a Gmail address and to your usual inbox, and look in spam as well. The person who fixes it is whoever controls the domain's DNS, usually with your developer.

Forms and connections break quietly

A form is only the front of a chain: an inbox, a spreadsheet, a booking calendar or a payment page. When one link changes on its own schedule, the form can still show its thank-you message while the enquiry goes nowhere.

Connected tools publish their own timetables. Shopify, for example, releases a new version of its developer interface every three months and supports each one for at least 12 months. A connection that asks for a version it can no longer reach is answered by the oldest version still available instead. So a connection nobody updates ends up running on rules it was not written for.

A monthly test can catch a broken form before a customer reports it; alerts and more frequent checks may be appropriate for critical forms.

A backup nobody has tested may not restore

A restore test is what shows whether a backup can recover the site. On an unattended site, the backup job may have stopped, or the copies may sit on the site's own server. Managed hosting often keeps copies for you; ask where, and for how long.

WordPress's own guidance says a backup has two parts, the database and the files, and you need both to restore a site fully. It says to back up regularly and always before an upgrade: weekly for a small site, daily for a busy one. It suggests keeping at least three to five recent copies in different places, such as the host, cloud storage and a local computer.

CISA, the US government's cybersecurity body, gives small businesses the 3-2-1 rule: three copies, on two kinds of storage, with one kept away from the business. It also advises scheduled recovery tests to check that backups work.

So ask where the copies are, whether one sits off the server in an account the business controls, and when someone last restored one. If nobody can answer, or nobody can log in, start with what to do when your developer left and you can't get in.

Set a routine and act on urgent alerts

You don't need to watch every date yourself. A routine gives you, your host or a developer regular chances to catch problems. Treat the intervals below as a starting point, not a safe waiting period for an urgent patch or a failed renewal. On managed hosting, some items are the host's job: ask which, and tick them off.

A written support arrangement turns this list into someone's job. What it should include, and leave out, is in what website maintenance includes, and what to get in writing.

When you can leave it alone

Next step: write down what your site runs on, who holds the logins, and when a backup was last restored. Tell us, whoever built it, and we'll say what needs attention now and whether you need a standing arrangement at all.

Reviewed and edited by Online Scope before publishing. Something out of date? Tell us at info@onlinescope.in. How we write the Blog.