No one calls us the week their website starts dying. They call us a year later, when a customer mentions the contact form hasn't worked "in a while," or the site vanishes from Google, or — worst case — the homepage is suddenly advertising pharmaceuticals in Cyrillic. By then, the owner wants to know what happened. The honest answer is: nothing happened. That's the problem. For twelve months, nothing happened, while the entire stack underneath the site kept moving.
We've now audited enough neglected sites to describe the decay with unsettling precision. It follows a pattern. Here is the autopsy.
Months 1–3: the drift begins
A typical small-business website runs on 20 to 40 software components — a content platform, a theme, plugins for forms, bookings, payments, galleries, SEO. Each ships updates constantly; it's normal for a site to accumulate several pending updates within weeks of launch. Individually, each missed update is trivial. But updates aren't features — most are patches for bugs and security holes that have just been publicly documented. A pending update is a published instruction manual for breaking into your site, plus your decision not to change the locks.
Nothing visible goes wrong in this phase. Speed drips away as caches misbehave and image libraries bloat. The first form submission silently fails after an email provider tightens its rules. The owner notices none of it, because nobody is looking.
Months 4–8: the quiet losses
This is where money starts leaking. Search engines re-crawl your site constantly, and they measure it: speed, mobile behavior, broken links, security headers. Google's own research found that as a mobile page's load time stretches from one second to three, the probability a visitor bounces jumps by roughly a third. Slow pages don't just annoy — they quietly reprice every dollar you spend on ads and every referral you earn, because fewer of those visitors ever see your offer.
Meanwhile the automated scanning never stops. Attackers don't target you; they target everyone, scanning millions of sites for that one unpatched plugin. Security researchers consistently attribute the overwhelming majority of content-platform breaches to vulnerable plugins and themes — not to sophisticated attacks, but to doors nobody closed. Most small-business sites in month six of neglect have several such doors.
Months 9–12: the visible failure
Eventually something breaks in a way a human notices. A payment plugin conflicts with an outdated theme after a forced update. An SSL certificate lapses and browsers start warning visitors away. Or the site gets compromised and starts serving spam — often invisibly, cloaked so the owner sees a normal site while search engines see the pharmacy. The cleanup for that scenario routinely costs more than a year of proper care, and the search-ranking recovery takes longer than the cleanup.
The cruel arithmetic of the autopsy is that the fatal wound was never the dramatic finale. It was the compounding: months of slow decay that turned the site from an asset into a liability while producing no alarms at all.
What real maintenance actually is
Here's what separates real care from the $10/month 'maintenance' checkbox: real maintenance is a nightly discipline, not a monthly glance. It means updates applied within days of release — but staged and tested on a private copy of the site first, because updates themselves can break things. It means backups that are restore-tested, because an unverified backup is a hope, not a plan. It means uptime and SSL monitoring that pages someone at 3 AM, security scanning that treats every login attempt as data, and — this is the part almost nobody does — a written log of all of it, so the owner can verify the work actually happened.
Until recently, that discipline was economically impossible at small-business prices; it's how well-funded tech companies treat their infrastructure, and it took engineers on payroll. What changed is automation: the repetitive nightly work can now be performed by well-built systems supervised by engineers, which is precisely the model we run. But whoever you hire — us or anyone — the standard above is the bar. If your maintenance provider can't show you a timestamped log of what they did last night, you don't have maintenance. You have a subscription to hope.