A website looks finished on launch day. Everything underneath it keeps moving: the PHP version it runs on, the CMS, the plugins, the certificate. For months nothing seems to happen. Then one morning the browser shows a red warning instead of the homepage, or someone realises the contact form hasn't sent a single message in three weeks.
Maintenance is the dull, regular work that stops those mornings from coming.
What changes under a site nobody touches
PHP runs out of support. Every PHP version gets security fixes for a limited time. According to php.net, PHP 8.2 receives them until 31 December 2026, and PHP 8.1 and older no longer receive any. A site that has been running quietly on 8.1 is running on software nobody patches.
Plugins collect security holes. Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025: 91% in plugins, 9% in themes, and only six in WordPress itself, all low priority. By default WordPress updates its own core automatically, but plugins and themes only in special cases. The part with almost all the holes waits for someone to press "update".
Certificates expire sooner every year. Since 15 March 2026 a public HTTPS certificate can be valid for at most 200 days. The CA/Browser Forum has set the limit to drop to 100 days in March 2027 and 47 days in March 2029. Let's Encrypt, the free certificate authority behind many small sites, is going from 90 days to 45 by 2028 and advises against renewing by hand. Renewal has to be automatic, and someone has to notice when it fails.
OWASP, whose Top 10 list is the usual reference for web application risks, puts it plainly in the 2025 edition: if the software is unsupported or out of date, you are likely vulnerable.
A recent example: PHP, 21 October
On 21 October 2026 the PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which let someone outside run code on the server without an account or a password. The project said updating is the only safe option.
On a site that someone looks after, that was a routine update the same week. On a site nobody looks after, the first question is whether anyone even knows which PHP version it runs. On 8.1 or older there is nothing to install: the PHP project no longer releases fixes for those versions, so the only way out is an upgrade.
What maintenance includes
The details depend on the site, but a sensible monthly routine covers this:
- Updates: PHP, the CMS, plugins and themes, each one after a backup, with a check that the site still works afterwards.
- Backups: daily, stored away from the server, with a restore tested now and then. How to set that up is in our article on the 3-2-1 backup rule.
- Monitoring: the site is up, the certificate renews on time, the contact form actually delivers.
- Security and mail checks: security headers, DNS records, and the SPF, DKIM and DMARC records that keep the company's email out of spam (we wrote about why company emails end up in spam).
- Renewals: the domain and the hosting, with the dates written down and a payment card that hasn't expired.
- Small changes: a new phone number, opening hours, prices, photos.
- Someone who answers when something stops working.
What happens when nobody does it
None of this happens on the first day. It builds up, and usually shows itself in one of these ways:
- The certificate expires. Browsers show a full-page warning instead of the site, and many visitors simply leave.
- The form goes quiet. A mail setting changes on the server, messages stop arriving, and nobody notices until a customer phones to ask why they never got a reply.
- The site breaks after a server update. When a host retires an old PHP version, an old theme or plugin can stop working, and visitors see an error page.
- The site gets hacked. Attackers add spam pages or redirect visitors elsewhere. Google may then show "This site may be hacked" next to the site in search results and advises people not to visit until the warning is gone. Google removes the warning only after the owner cleans the site and asks for a review. Patchstack measured how quickly attacks follow: for the most exploited flaws, the weighted median time to the first attack was five hours.
- There is no backup to go back to. Or there is one, from a year ago, and nobody has the password.
Check your own site in ten minutes
- Open the site, click the icon to the left of the address and look at the certificate's expiry date.
- Send yourself a message through the contact form and see whether it arrives.
- Ask whoever runs the site three questions: which PHP version does it run, when were the plugins last updated, and where are the backups?
- Look up when the domain expires and who receives the renewal reminders.
If nobody can answer, nobody is looking after the site. Better to learn that today than on the morning of the red warning.
Updates, backups, monitoring and the small repairs along the way are what our maintenance and support plans cover, and the plans are listed on that page. We also take over old sites: we move them off a host nobody checks, fix the certificate and update the old CMS. If you would like us to look at your site as it is today, write to us.