What a neglected website actually looks like
There's a particular moment I've come to recognise. A new client gets in touch, usually because something has gone wrong – the site is slow, or broken, or they've just noticed it still lists a member of staff who left two years ago. They hand over the login details and I take a look. Within ten minutes, I have a fairly clear picture of what the last few years have looked like for that website.
Neglected websites are more common than you'd think. Not because the people who own them are careless, but because running a business takes all the time you have, and the website – once it's live and seemingly working – drops to the bottom of the list. Months pass, then years, and the site quietly accumulates problems that nobody notices until something forces the issue.
The unlocked door
The first thing I check is when the CMS was last updated. On a WordPress site, this tells me most of what I need to know. I've opened dashboards where the core software is three or four major versions behind, surrounded by plugins that haven't been touched in years. Some have known vulnerabilities. A few are no longer maintained at all – the developer moved on, stopped releasing updates, but the plugin is still sitting there, active, doing its thing.
Most attacks on small business websites aren't targeted. They're automated – bots scanning thousands of sites simultaneously for known weaknesses. An unpatched plugin from 2021 is exactly what they're scanning for. I've taken over sites that had already been compromised without the owner knowing. The visible site looked fine.
Then there's the other WordPress problem, which is almost the opposite: updates that run automatically and break things. Core updates, plugin updates, a PHP version change on the hosting side – any of these can quietly take out a feature, a layout, or occasionally the whole front end. On a maintained site, someone catches it that day. On an unmaintained one, it can stay broken for weeks of even months. I once inherited a site where the homepage had been showing a white screen for so long that the client had started telling people the site was 'being redesigned'.
Content rot
The most immediately visible problem on a neglected site is usually the content. Not dramatically wrong – just consistently, gradually out of date.
The team page still has a photo and bio for someone who left 18 months ago. The services page describes something the business stopped offering. The homepage talks about 'our new office' which is now just the office. The blog has four posts, the most recent from 2022, ending with a cheery promise of more to come.
Then there are the broken integrations that fail silently. A Google Maps embed that stopped rendering because the API changed and nobody updated the key. A contact form connected to an email address nobody checks. A booking widget from a service that was discontinued. These don't announce themselves. They just sit there, waiting for a visitor to find them before the owner does.
A prospective client visiting for the first time doesn't know what's out of date and what isn't. They just notice that something feels slightly off. That feeling is usually enough.
Speed, drift, and things that used to work
Websites get slower over time if nobody's actively keeping them quick. Images uploaded at full resolution because the original process for optimising them stopped being followed. A JavaScript plugin added for a feature that was later removed, but the plugin wasn't. Third-party scripts for tools the business stopped using, still loading on every page.
A site that scored well on Google PageSpeed Insights at launch can drift considerably – not because anything dramatic changed, but because small additions accumulate and nobody's measuring. Page speed affects both search rankings and whether visitors actually stick around, so the consequences aren't just aesthetic.
Browser compatibility is part of this too. Things that rendered correctly three years ago occasionally behave differently in current browsers. Layouts break on certain devices. Small visual glitches appear. On a maintained site these get caught. On an unmaintained one they just become part of the furniture.
How it happens
This isn't a character flaw. Running a small business means managing roughly 40 things at once, and the website has no mechanism for demanding attention. It doesn't flag when a plugin becomes vulnerable. It doesn't remind you that a team member's bio is still live. It just sits there looking roughly fine while the gap between what it is and what it should be quietly widens.
The businesses with consistently well-maintained websites are the ones that have made it someone's job – in-house or through an ongoing arrangement with their developer. Not a big job. An hour a month handles most of what a small business site actually needs. But it has to belong to someone.
What it takes to keep things in order
At its simplest, website maintenance means keeping the software updated, checking that everything works, and making the small changes that keep the content accurate. Unglamorous work, but the absence of it is what produces everything above.
The maintenance overhead varies a lot depending on the platform. A CMS like Kirby – which I use for most of my projects – needs significantly less attention than WordPress. No plugin ecosystem to monitor, a much smaller attack surface, and no auto-updates silently breaking things in the night. That's part of why I use it. But even a Kirby site benefits from someone keeping an eye on it.
If you want that to be me, I offer website management plans covering everything from basic security and updates to more involved monthly maintenance. If you've got a developer you already trust, the main thing is just making sure it's actually in someone's hands.
Either way, the sites that end up in the worst shape are always the ones where nobody thought it was their job.