Your website is rotting on its own

A business owner opens their website after a long while, because a customer mentioned that something does not look right. The map on the contact page is dark and has “for development purposes only” written across it. Where the Facebook Like button used to be, there is nothing any more. Under “News”, the latest post is about the summer opening hours of 2023. And on the “Our team” page, an employee who left two years ago is still smiling.

“But nobody touched it,” they say.

Exactly. That is why it broke.

A website is not a leaflet

You print a leaflet once, and whatever it says stays the same, right or wrong. Many people think of their website the same way: we built it, we paid for it, it is there.

But a website is not printed paper. It is a program. Every time someone opens it, it runs on other programs and borrows pieces from other people’s services. All of these keep changing, whether you touch it or not.

In “I changed one setting and broke my own site” I wrote about how a site breaks when someone changes it, and I mentioned the other side in a single sentence. Here it is in full: how a site breaks when nobody changes it. The decay comes from three places, and none of them warns you.

The ground under the site keeps moving

Every website runs on software made by other people. Many sites, and every site built with WordPress, run on PHP, a programming language that works on the server, the computer where the site “lives”. WordPress sits on top of PHP, and on top of WordPress sit the plugins: small programs from other makers that add a form, a gallery, a booking button.

Every version of PHP has an end date, announced in advance. After that day, the people who make PHP stop fixing that version, even if a security hole is found, meaning a flaw someone could use to get into the site. PHP 8.1 stopped receiving security fixes on 31/12/2025. Version 8.2 stops on 31/12/2026. Any site still running on a version whose support has ended is running without the official fixes for whatever is found from then on.

And here is the trap. When support for a version ends, the hosting provider, the company you pay to keep your site on its server, usually goes one of two ways. If nobody is keeping an eye on the site, both end badly:

• The provider moves the server to a newer version of PHP, and a part of the site written for the old one stops working. A blank page or, worse, a form that does not send, without anyone noticing.
• The provider keeps the old version so that nothing breaks, and the site stays exposed to every new security hole found from then on.

The same goes for plugins. A plugin someone installed five years ago may have been abandoned by its maker. It still works, until the day something around it changes. In “A secure site in 2026” I wrote that most WordPress security holes are found precisely in plugins.

You do not need to know what PHP is. Someone needs to know, on your behalf, which version the site runs on, and until when.

Whatever you borrow, one day they ask for it back

The second kind of decay is sneakier, because it is not even on your site.

The map on the contact page comes from Google. The Like button comes from Facebook. Your visitor numbers are counted by someone else’s tool. All of these are borrowed, and the company that lends them changes the terms whenever it sees fit. Three real examples:

The map. For years now, for quite a few of the ways a Google map can be put on a website, Google has required a key, meaning a code that tells Google which site is using the map, plus an account with billing details. Where the key or the account is missing, the map shows up dark, marked “for development purposes only”. The site works. The map just tells the visitor that something here has been left half-done.

The statistics tool. The old Google Analytics stopped recording visits on 01/07/2023, and a year later Google started deleting its data. On many sites its code (the instructions it used for counting) still loads on every page. It counts nothing, and if nobody looks at the statistics, nobody will have noticed. Whether your own numbers measure what you think they do is something I look at in “Four things you do not know about your own website”.

The Facebook buttons. On 10/02/2026 Meta discontinued the Like button and the Facebook comments that appeared on external sites. The button and the comments showed no error message. According to Meta’s own announcement, they became invisible, so that the page would not break. That is why many people never noticed. If your page relied on Facebook comments, the comments simply stopped appearing.

And then there are the smaller loans. Links to other people’s pages: the supplier who changed websites, the page with a law on it that moved to a different address, the video that was taken down. The visitor clicks, finds “page not found”, and the credibility lost is not the supplier’s. It is yours.

What it says stops being true

The third kind of decay has nothing to do with technology, and that is exactly why everyone overlooks it.

Your opening hours change, and the site shows the old ones. Your prices change, and the site shows last year’s. A team member leaves, and their face stays on the page. You stop offering a service, and the site keeps offering it. A “new” collection has been new for three years. And the phone number is the one for the old office, which now rings for someone else.

The visitor does not know which of these is just forgotten. They see one mistake and start doubting everything else. If the opening hours are out of date, are the prices too? Has the business closed?

And these days old text is not read only by people. Answer engines, such as ChatGPT, may read your site to answer anyone who asks about you. If the site gives the opening hours of 2023, those may be the hours they give. More on how they see you in the guide to answer engines.

Why none of this makes a sound

As you may have noticed, none of the above stops the site from opening. It opens, it loads, it looks nearly right. That is why no tool that only checks “does the site open or not?” will ever warn you. In “I changed one setting and broke my own site” I explain why “it opens” does not mean “it works”.

Decay does not look like a fault. It looks like dust. A little more settles every day, and every day the site looks the same as yesterday. Until the day someone looks at it with fresh eyes, usually a prospective customer, and thinks “these people don’t seem to care much”.

They will not tell you. They will go to the next one.

Someone has to keep an eye on it

You do not need to become technical. But someone, on your behalf, needs to know what is ending and when, what the site borrows from others, and whether what it says is still true. Three kinds of decay mean three different things to watch, and none of them watches itself. There is a way to do this regularly and without surprises, and it is learned in practice: it is part of our job.

If you want a single sign of whether this concerns you: if nobody can tell you, with a date, until when the software your site runs on is supported, the decay has already started. “It’s up to date, don’t worry” is not a date.

And on when decay stops being a matter of maintenance and becomes a reason to change, I have written in “When it’s time to change your site”.

Decay does not mean you throw it away

It would be easy to read all this and think “so I need a new one”. Usually you do not.

You do not knock a house down because the paint on the door has faded or a gutter is dripping. You paint it and repair it, and every year you do, you avoid the big bill. The same goes for a website. A site that is updated, checked and re-read regularly can last many years. You need a new one when it can no longer do what the business needs, not because a certain number of years has gone by.

The forgotten site, on the other hand, saves nothing. It just pushes the cost further down the road, and makes it bigger.

Remember the business owner at the start? They were right: nobody touched their site. Not to break it, and not to look after it. And a site that nobody looks after rots on its own.

If you do not know what state your site is in today, we look at it with you and give you our findings in writing, in order of priority. In the paid tiers of our maintenance and support, regular care of the site is part of the job, and stepping in when something breaks is our contractual obligation. Send us your website address through the contact form.

The whole picture: this article covers one part of a larger subject. If you are after the whole of it, from commissioning to replacement, it is in the guide to your website.