Leaving a business website untouched for months mostly risks outdated code that gets exploited, not just an outdated look: sites get hacked through unpatched plugin vulnerabilities, contact forms stop delivering leads without any error message showing up, and rankings slip in ways that only show up weeks later as fewer calls coming in. Maintenance is less of an upgrade and more of an insurance policy against failures that hit exactly where customers first make contact.
What actually happens when nobody keeps up with it
Security researchers at Sucuri and Patchstack put the share of hacked WordPress sites running outdated software at the time of the breach at somewhere between 60 and 67 percent, depending on the study, with more than 90 percent of vulnerabilities traced back to plugins and themes rather than the CMS core itself. Security vendors also estimate that several thousand WordPress sites get compromised worldwide every day. This is not limited to high-profile targets: automated bots scan the entire web for known vulnerabilities and hit any reachable site, regardless of the size or visibility of the business behind it.
A breach rarely announces itself. More often, spam links get quietly injected, the site’s search visibility gets hijacked to promote unrelated content, or redirects get planted to fraudulent offers while the actual site looks completely normal at first glance. Owners typically find out from a Google Search warning, a note from the hosting provider, or, sometimes, a customer calling to ask about a suspicious redirect.
There is also a cleanup cost that rarely gets factored in ahead of time. Most hosting providers require a full cleanup before restoring access once a breach is confirmed, and Google Search Console requires a separate review before a security warning gets lifted. Together, that typically means several days where the site is either offline or running with a visible warning attached, on top of having to figure out whether any customer data submitted through the contact form during that window was exposed.
Contact forms fail without a sound
The most common real-world case for home services businesses is far less dramatic than a visible hack: after a hosting provider rolls out a PHP or server update, the contact form quietly stops working, with no error message at all. Visitors fill it out, click submit, see a confirmation message, and the lead never reaches the business’s inbox. Without a regular test, this can go unnoticed for weeks, during which every inquiry from a potential customer simply disappears.
A monthly test submission through the site’s own contact form belongs in maintenance right alongside security updates. Anyone relying on a form plugin should also check whether delivery is affected by tighter spam filtering at Gmail and Yahoo, which have required stricter sender authentication since February 2024.
What a ranking drop actually means
Google draws a clear line between brief downtime and an actual security problem. Outages lasting a few minutes to about an hour have essentially no ranking impact, according to public statements from Google staff. But if a site stays unreachable for several days in a row, Google starts removing pages from the index, treating the outage as a permanent state rather than a glitch. A confirmed security warning gets a much faster, harsher response: the affected page can get flagged with a warning in search results or dropped in rankings outright, specifically to protect searchers.
| Incident | Google’s response | Typical recovery time |
|---|---|---|
| Brief downtime (minutes to about an hour) | Usually no noticeable effect | None, if fixed quickly |
| Downtime lasting several days | Gradual deindexing of affected pages | Weeks, sometimes longer |
| Confirmed security warning / hack | Warning label in search results, ranking demotion | Several weeks to months after cleanup |
Recovering from a security warning often takes several weeks in practice, even after the site has been cleaned up and cleared as safe in Google Search Console, because trust with the search engine gets rebuilt gradually rather than restored instantly. During that window, competitors frequently pick up the local search positions that opened up.
What maintenance actually covers
Website maintenance is not one task but a set of recurring ones:
- Core and plugin updates. Security vulnerabilities get published constantly and are often exploited by automated attacks within days of disclosure. A monthly update cycle closes most of that window.
- Backups with a tested restore. A backup that has never been restored is a guess, not a safety net. A yearly restore test should be standard practice.
- SSL certificate and domain renewal. Both expire automatically if nobody tracks the dates, leading to browser warnings or a fully broken site.
- Form and function testing. A monthly test submission through every contact form catches silent failures before a customer does.
- Uptime monitoring. A basic uptime check flags an outage within minutes instead of through a missed customer call.
A ten-minute self-check
Without any technical background, a business owner can get a rough read on where a site actually stands:
- Submit the contact form yourself. Send a test inquiry with a personal email address and confirm it actually lands in the inbox, not just that a confirmation message shows up in the browser.
- Check for the lock icon in the address bar. If it is missing or the browser shows a warning, the SSL certificate has likely expired or is misconfigured.
- Open the site in a private browser window, logged out. Unexpected redirects, unfamiliar ads, or a browser tab title that does not match the usual one are a clear sign a hack may already be underway.
- Search Google for the domain by name. A label like “This site may be hacked” showing up directly in search results means Google has already flagged the problem publicly.
- Ask about the most recent backup. Check with the hosting provider or internal notes for when the last backup ran and whether it has ever actually been restored. No clear answer usually means there is no reliable backup at all.
Any uncertainty on more than one of these points already answers the question of whether maintenance is overdue.
Why statically built sites carry less of this risk by design
Much of the risk above comes from the combination of a database, a plugin ecosystem, and a public admin login that classic CMS platforms like WordPress carry with them: every added plugin is one more attack surface, and every database is one more point of failure. Statically built websites without a plugin sprawl and without a publicly reachable admin login cut that attack surface down from the start, simply because there are fewer moving parts that can go stale or get exploited. That does not replace maintenance entirely, but it meaningfully shrinks the window where something can go wrong.
Mr.Site builds home services and contractor websites on exactly that principle and keeps several hundred business websites actively maintained rather than handing them off after launch and moving on. For details on what that kind of ongoing service looks like, see Managed Website Service.
The next step
Maintenance cannot be caught up on retroactively once a site is already flagged with a Google warning or leads have been disappearing for weeks. Business owners who do not want to track updates, backups, and form tests themselves should hand that work off to an ongoing maintenance service deliberately, rather than letting it lapse quietly. For a closer look at how much a slow or unreliable site actually costs in customers, see Website Speed Costs Customers; for the legal minimums that apply on top of technical upkeep, see Website Accessibility Requirements.