If you never update your website, nothing happens at first. Then, over months, security holes pile up, small features fail without anyone noticing, and the server moves on without it. By year two or three, a neglected site is usually slow, exposed and expensive to fix, if it hasn’t already been hacked.
Key takeaways
- Neglect is silent. The site looks fine long after it has started to decay.
- Patchstack recorded 11,334 new WordPress vulnerabilities in 2025, and the worst were exploited within hours.
- PHP versions only get security fixes for about four years, so old sites eventually lose their footing.
- A little care each month costs far less than a clean-up or a rebuild in year three.
This timeline describes a typical WordPress business site that launches well and then gets left alone. It’s not one client’s story, but a pattern common to sites left for years without care.
What happens in the first month?
Nothing you’d notice. The site loads, the phone rings, and the launch feels like the finish line. But WordPress, your theme and your plugins keep changing. Within weeks, the dashboard shows updates waiting.
Most are small fixes. Some close security holes. Nobody logs in to see them, so they sit there.
Month three: when do the security problems start?
Once a security flaw is published, attackers know exactly what to look for. Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, with 91% of them in plugins. For heavily targeted flaws, the weighted median time to first exploit was just 5 hours (Patchstack).
Automated bots scan millions of sites for those versions. They don’t care how small your business is. If one of your plugins is on that list and nobody updates it, your site is an easy target.
Month six: what breaks quietly?
This is the stage of silent failures. The usual suspects are:
- The contact form. It still says “thanks”, but the email never arrives.
- Premium licences. A paid plugin’s licence lapses, so its updates stop.
- Backups. A backup plugin fills the disk or stops running, and nobody checks.
- Logins. Old staff and your former developer still have admin accounts.
None of these trigger an alarm. You find out when a customer says they emailed twice, or when you need a backup that isn’t there.
Year one: why does the server become a problem?
Your website runs on PHP, the language behind WordPress. Each PHP version gets two years of full support, then two more years of critical security fixes only (PHP.net). PHP 8.2, for example, stops receiving security fixes on 31 December 2026.
Hosts upgrade PHP to stay secure. A site that’s been kept current takes that in its stride. A neglected one may throw errors, because its old plugins and theme were never updated to cope. If your old developer still holds the logins needed to fix it, our website handover checklist lists what to ask for.
Year one is also when the domain renewal email goes to an old address. auDA allows a 30-day grace period after a .au domain expires, but “your website and email services will stop working during this time” (auDA).
Year two: how does a neglected site fall behind?
By now the risks compound. Some plugins have been abandoned by their developers and will never be fixed. Our guide to abandoned WordPress plugins shows how to spot them. Patchstack found 46% of vulnerabilities disclosed in 2025 had no fix from the developer in time for disclosure.
Updating gets harder too. Jumping two years of versions at once is far riskier than monthly steps, so owners put it off again. Meanwhile, competitors’ sites get faster while yours carries old code. This is often when owners find out their developer has gone quiet. Our article on a web designer not responding explains how to take back control.
Year three: what’s the end of the road?
Usually one of two things. The site gets hacked, or it becomes too old to update safely. Sucuri found that 39.1% of content management systems were out of date at the time they were infected (Sucuri). A hack can mean spam pages in Google, redirects to scam sites, warnings in browsers or a host suspending the account.
If the site survives, it may still need rebuilding. The theme no longer works with current WordPress, key plugins are gone, and every fix risks breaking something else. That’s a big bill for a problem that started with a few skipped updates.
How do you stop the decay?
The fix is boring, which is the point. Small, regular care beats big, rare rescues.
- Back up first. Take a full off-site backup and confirm you can restore it.
- Update in small batches. WordPress, then plugins, then the theme, testing as you go.
- Remove what you don’t use. Every inactive plugin and theme is extra risk.
- Clean up logins. Delete old accounts and turn on two-factor login.
- Test what matters. Submit the contact form and check checkout and bookings.
- Put it on the calendar. Monthly, with security fixes as soon as they’re released.
Hosting helps too. Managed hosting keeps the server, PHP and security patches current, so your site isn’t left behind by the platform it runs on.
Who should look after it?
If you’d rather not own this job, hand it to someone who does it every month. Our Maintain & Protect website care plans include monthly updates, with high-risk security updates applied weekly. They also cover daily malware scans, off-site backups kept for 30 days, uptime monitoring and a monthly report. Sites on a plan are covered by “hack-free or we fix it free”.
Frequently asked questions
How often should a website be updated?
Check for updates at least monthly, and apply security fixes as soon as they’re released. Patchstack found the most targeted WordPress flaws were exploited within hours of disclosure in 2025. Content is different: update it whenever your services, prices or contact details change.
Can I just leave my website if it’s working?
Not safely. Working and secure aren’t the same thing. A site can look perfect while running plugins with published security flaws. The longer you leave it, the harder and riskier updating becomes, because you’re jumping several versions at once.
Is it too late to update a website that’s years old?
Often not. Take a full backup, then update on a staging copy first so customers don’t see anything break. Some old themes or plugins may need replacing. If the site is very old or heavily customised, a rebuild can work out cheaper than patching it.
Does my host update my website for me?
Usually not. Most hosts keep the server running and secure, but your plugins, theme and WordPress itself are the site owner’s job. Some hosts and care plans include website updates. Check exactly what your plan covers before assuming it’s handled.
What’s the first sign of a neglected website?
A long list of pending updates in the dashboard is the clearest one. Others include a copyright year that never changes, contact forms that go quiet, old staff still listed as users, and a slow home page. Any of these suggests nobody is checking regularly.
Sources
- State of WordPress Security in 2026, Patchstack, accessed 13 November 2026
- Supported versions, PHP.net, accessed 13 November 2026
- Renewing your domain licence, auDA, accessed 13 November 2026
- 2023 Hacked Website and Malware Threat Report, Sucuri, June 2024