When a website breaks, you find out immediately. The phone rings, someone emails a screenshot, you fix it.
Decay is different. Nothing announces itself. The site keeps loading, the forms keep submitting, the design still looks broadly like it did on launch day. Meanwhile the rankings slip a position at a time, the mobile experience falls further behind what people now expect, the security surface widens with every unpatched plugin, and the enquiries that never arrive leave no trace at all.
That is the expensive failure mode, because there is no moment where anyone decides to act.
What actually ages on a website
It helps to be specific about what "outdated" means, because it is rarely the visual design that matters most.
| What ages | How long before it hurts | What it costs you |
|---|---|---|
| Plugins, themes and WordPress core | Weeks | Security breaches, malware, blacklisting, downtime |
| Page speed and Core Web Vitals | 6 to 18 months | Rankings and mobile visitors who leave before the page paints |
| Structured data and technical SEO | 12 months | Lost rich results and invisibility to AI search engines |
| Content accuracy: prices, services, staff, hours | 3 to 12 months | Wasted enquiries and lost trust at the point of decision |
| Design conventions and mobile layout | 3 to 5 years | Credibility, especially for first-time visitors comparing options |
| Analytics and tracking setup | 12 to 24 months | Flying blind, and no way to prove what marketing is working |
Notice the top of that table. The parts that decay fastest are the parts nobody looks at. The visual design, which is the thing everyone worries about, is the slowest-moving item on the list.
The security problem is not hypothetical
In 2026, two critical vulnerabilities were disclosed in Avada Builder, a page builder running on roughly one million WordPress sites. One allowed an attacker with subscriber-level access to read files on the server. The other allowed database queries with no login at all. Patches came, but the exposure window lasted weeks, and any site that was not updated promptly stayed vulnerable long after.
That is one plugin in one year. Multiply it by the twenty or thirty plugins on a typical site and you get the real picture: an unmaintained WordPress site is not static, it is accumulating risk. I wrote about the wider lesson in why one million hacked Avada sites should make you reconsider page builders.
The cost of a compromise is not just cleanup. It is Google flagging your domain, email deliverability collapsing, and months of rebuilding reputation. For a local business that depends on being findable, that is genuinely dangerous.
The slow leak: speed and rankings
Page speed degrades on its own. You add a tracking pixel for a campaign, upload a few uncompressed images, install a plugin to solve one problem, switch to a nicer font. Each change costs a fraction of a second and none of them feel significant.
Eighteen months later the site takes four seconds to become usable on a mid-range phone on mobile data, which is how a large share of local searches actually happen. Visitors do not complain. They just leave, and Google notices that they leave.
The compounding is what makes this expensive. Slower site means worse engagement, which means slightly worse rankings, which means fewer visitors, which means less data and fewer conversions. None of the steps are dramatic. The destination is.
The new one: being invisible to AI search
There is now a failure mode that did not exist five years ago. A growing share of buyers begin with ChatGPT, Perplexity or Google’s AI Overviews rather than a search results page. Those systems build answers from sites they can parse confidently: clear structure, complete structured data, unambiguous facts about who you are and where you operate.
A site built in 2019 and left alone almost certainly fails those tests, not because anything is broken but because the requirements changed underneath it. You do not get an error message telling you that an AI engine skipped your business in favour of a competitor. You simply never hear about the enquiry.
This is the whole rationale behind GEO optimization, and it is the single biggest reason an ageing site now costs more than it used to. There is more detail in what an AI-driven website actually means in 2026.
How often does a website actually need attention?
A realistic schedule for a small or mid-sized business site:
- Monthly: core, theme and plugin updates applied and tested, backups verified, security scan, uptime check, broken links fixed.
- Quarterly: speed and Core Web Vitals review, Search Console error check, content accuracy pass on prices, services and staff.
- Annually: structured data and technical SEO audit, mobile usability review, conversion review of the pages that actually generate enquiries, competitor comparison.
- Every three to five years: a genuine design and structure refresh, or a rebuild if the underlying platform is holding you back.
Most businesses do none of the monthly work and then commission an expensive rebuild every five years to fix the accumulated damage. Doing the small work continuously is significantly cheaper than doing the large work occasionally, which is exactly why ongoing website maintenance exists as a service.
A five-minute self-check
- Open your site on your phone, on mobile data, not on office wifi. Count the seconds until you can read and tap something. More than three is a problem.
- Check whether every price, service and staff member listed is still accurate today.
- Log into WordPress and look at the updates counter. If it is more than a handful, or you are afraid to click it, that fear is the actual finding.
- Ask ChatGPT the question a customer would ask in your category and city. See whether you are mentioned.
- Submit your own contact form and confirm the email actually arrives. Broken forms are far more common than anyone expects, and they fail silently.
That last one deserves emphasis. A contact form that has quietly stopped delivering is the single most expensive fault a website can have, because everything else keeps working perfectly while every enquiry disappears. I have found this on client sites that had been running that way for months.
The honest cost comparison
Maintenance feels like paying for nothing to happen, which is a hard thing to value. So frame it the other way: what does one lost customer per month cost you? For most Toronto service businesses, a single recovered job pays for a year of upkeep.
And the alternative is not free. It is a rebuild you did not budget for, a security cleanup on someone else’s schedule, or a slow decline in enquiries that nobody connects to the website until the drop is severe enough to be undeniable.
Not sure how much your site has drifted? Send me the address and I will run through the checks above and tell you what I find, at no charge. Request a website review, or see what is included in website updates and maintenance.
Frequently Asked Questions
Check five things: load time on a phone using mobile data, whether all content is still accurate, how many pending updates WordPress is showing, whether your contact form still delivers, and whether AI search engines mention your business. Failing two or more means the site has drifted far enough to be costing you enquiries.
Security and plugin updates monthly, a speed and content check quarterly, a technical SEO and conversion review annually, and a design or structure refresh every three to five years. The monthly work is what prevents the expensive emergency work later.
If the site loads reasonably, converts visitors and is built on a sound platform, maintenance plus a content and markup pass is usually enough. A rebuild is warranted when the platform itself prevents clean markup and good performance, or when the business has changed so much that the structure no longer fits.
Known vulnerabilities in outdated plugins are actively scanned for and exploited automatically. The realistic outcomes are malware injection, spam pages added to your domain, being flagged by Google as unsafe, and email deliverability problems. Cleanup usually costs several times what prevention would have.
Yes. It starts with an audit to establish what is on the site, what is out of date and what is risky, followed by a stabilising round of updates and backups. After that it moves to a regular monthly cycle.
Done carelessly, yes. Changing URLs without redirects, dropping content or altering page structure without a plan can all cost rankings. Done properly, with redirects mapped and content preserved and improved, rankings normally hold and then improve as speed and structure get better.
Related reading: AI-driven WordPress websites in 2026 · What 184,000 Toronto search impressions taught us · Website design and redesign in Toronto