A website with nobody watching it does not stay the way you left it. The software under it ages, the certificate behind the padlock expires on a schedule, the contact form keeps looking fine while it stops sending, and the domain comes up for renewal on a card that was replaced two years ago. None of these announce themselves. You find out when a customer tells you, or when you go to look for your own site and it is not there.
This post walks through the four ways I see small business websites fail when nobody is responsible for them, in the order I run into them. It is not a sales pitch for hosting. If you already read what's included in website hosting, this is the other half of that story: what the maintenance part of "hosting and maintenance" is actually preventing.
1. The software under the site goes stale
Most small business sites in Connecticut run on WordPress, and WordPress is not one piece of software. It is the core, a theme, and anywhere from five to forty plugins, each written by a different person, each updated on its own schedule. Every one of those updates exists for a reason, and a lot of those reasons are security holes somebody found.
When nobody applies updates, the site keeps working. That is the problem. It looks exactly the same for a year while the list of known holes in it gets longer. Automated scanners run around the clock looking for sites with an outdated plugin they know how to break into. They do not care that you are a two-person landscaping company. They care that you are running version 3.1 of a form plugin with a published exploit.
What a hacked small business site usually looks like, in my experience, is not a dramatic defacement. It is quieter than that:
- Spam pages for pharmaceuticals or gambling appear deep in the site where you never look, and Google indexes them under your business name.
- Visitors on phones get redirected to a scam page, while the site looks normal on your office computer.
- The site starts sending spam email from your domain, which lands your real email in spam folders too.
- Google flags the site as dangerous in search results and Chrome shows a red warning page.
Cleaning that up costs far more than keeping it updated would have. And a restore only helps if there is a backup from before the break-in, which brings up the next item.
2. The certificate expires and the padlock turns into a warning
The padlock in the address bar comes from an SSL/TLS certificate, and every certificate has an expiration date. The free ones most sites use now are valid for 90 days and renew automatically, as long as the thing that renews them is still running and still has permission to. Paid ones are usually a year.
When renewal fails, nothing happens on the day it fails. Something happens on the day the old certificate runs out. From that moment, every browser shows a full-page warning that the site is not secure, with a button most people will not click. Your site is technically online and practically closed.
Common ways renewal silently breaks:
- The hosting plan changed and the renewal job did not come with it.
- DNS was moved to a new provider and the validation record was left behind.
- A firewall or security plugin started blocking the renewal check.
- The certificate was tied to a card or account that lapsed.
The fix takes minutes if someone is watching the expiration date. It takes a panicked afternoon if the first warning you get is a customer's phone call.
3. The contact form breaks and nobody notices
This one costs more than the other three combined, because it fails invisibly for a long time.
Your contact form has two halves: the part the visitor sees, and the part that gets the message to you. The visible half almost never breaks. The invisible half breaks all the time. Email providers tighten their rules, a plugin update changes how mail is sent, the sending service your old designer set up gets shut off, or your domain's email records change when you switch to Microsoft 365. The form still says "Thanks, we'll be in touch." The message goes nowhere.
I have seen forms that were dead for months. The owner assumed the slow season was just slow. If your site has a form, somebody should be sending a test through it on a schedule and confirming it arrives. That is a five-minute check, and it is one almost nobody does.
If your mail is also landing in spam folders, the cause is often the same set of DNS records. SPF, DKIM and DMARC covers that side.
4. The domain lapses, and sometimes it is gone for good
Your domain name is a rental. It renews yearly, or every few years, through whatever registrar it was bought at, on whatever card and email address were used at the time. For a lot of businesses that was the original web designer's account, or an employee who has since left, or an email address nobody checks anymore.
When the renewal fails, registrars typically give a grace period, then a redemption period with a steep fee, and then the name is released. Domains with history behind them get bought up fast, often by people who park them with ads or hold them for resale at a price that will make you wince. Your email stops when the domain stops, because your email address is built on it.
A consultant we helped this summer found out the hard way. Her email stopped working and her domain, registered since 2004, was quietly redirecting to someone else's site. The domain sat in a registrar account nobody could log into, the web company that built the site had not had access since 2019, and the account's recovery email was the dead mailbox itself.
The prevention is boring and takes ten minutes: know which registrar holds the domain, make sure the account is in the business owner's name with a current card and an email address that gets read, and turn on auto-renew. Who owns your website walks through how to check all of that.
What "maintained" actually means
Maintenance is not a monthly email saying everything is fine. For a small business site it comes down to a short list of things that somebody does on a schedule, and a name attached to each one:
- Updates applied, with the site checked afterward so an update that breaks the layout gets caught right away.
- Nightly backups that are stored somewhere other than the site itself, with a known date on the most recent one.
- Regular malware scanning so a break-in is found in days, not at the point where Google flags it.
- Certificate expiration watched, with renewal confirmed rather than assumed.
- A test submission through every form so a dead form is found before a customer finds it.
- Domain and hosting renewals on a calendar, in the owner's name.
Whether you do that yourself, pay your hosting company for it, or pay someone like me, the point is that each line has a person responsible for it. The sites that fail are the ones where the answer to "who handles that" is a shrug.
Where we fit
The sites we build are hosted on a VPS in a secure, reliable data center, with nightly backups, regular malware scanning, certificate renewal handled, and updates applied by the person who built the site. That is what the $35 a month on our web solutions page covers, on top of the $500 flat-rate build. When something does break, you call (860) 398-9221 and talk to me, not a ticket queue.
If your current site has been sitting untouched for a while and you are not sure what state it is in, is it worth updating your website is a good gut check. And if you are not sure whether anyone is maintaining it at all, that is usually the answer.
The bottom line
An unmaintained website fails in slow motion. Stale software gets it hacked, an expired certificate scares visitors off, a broken form loses the leads you were counting on, and a lapsed domain can take your email and your name with it. Every one of those is cheap to prevent and expensive to fix after the fact.
Not sure who is looking after your site? Tell us about it and we will take a look, or see what a build and a maintained site cost on our web solutions page.