Skip to content
Work with 3FOLD

care

What happens if nobody updates my website?

By Adam Collins, Founder, 3Fold Labs

A website can quietly fall behind. Old facts, broken forms and unsupported software build up. Illustrative editorial photograph.

Short answer

It depends on the platform. On self-hosted WordPress, the software ages: plugins, core, and the server's PHP version stop getting security fixes. On any platform, the facts on the page age, and forms or certificates can quietly fail. Nothing dramatic happens on day one; problems build until a customer notices before you do.

Nothing dramatic happens on day one if nobody updates your website. Problems build until a customer notices before you do.
On WordPress the software ages; on any platform the facts age, and forms or certificates can fail without looking broken.
Problems build until a customer notices before you do.

Does it matter which platform my site is on?

Yes. On Wix or Squarespace, the platform handles hosting, security patches, and SSL certificates. Squarespace says all its plans include fully managed cloud hosting and free SSL. On self-hosted WordPress or a custom-coded site, someone has to update the software.

On every platform, a person still has to keep your hours, services, phone number, and form routing correct.

What happens on WordPress when plugins and core don't get updated?

WordPress says "The only current officially supported version is the last major release of WordPress." Fixes for older versions are backported only "as a courtesy," with "no guarantee and no timeframe." Its docs also say "you should always update your plugins and themes to the latest version."

A real example shows how this plays out. In 2024, the makers of the LiteSpeed Cache plugin announced a security fix and told users to update immediately. Their notice ended: "if you are keeping your LiteSpeed Cache plugin up-to-date, there is nothing you need to do. If you have not updated in a while, please do so today." The fix existed. Sites that never updated simply didn't have it (more on what a website care plan is).

WordPress can update plugins automatically since version 5.5, plugin by plugin, and emails the owner when updates succeed or fail (more on how often to update your site). Its docs note that scheduling may not work correctly on some servers, so check Tools, then Site Health.

What happens when my host's PHP version reaches end of life?

PHP is the language WordPress runs on. Each PHP version gets security fixes for a set time, then reaches end of life, and PHP says users "may be exposed to unpatched security vulnerabilities." PHP 8.2's security support ends 12/31/2026, and 8.3's ends 12/31/2027. If your site runs on PHP 8.2, ask your host or developer now what the upgrade plan is, and whether your plugins are ready for it (more on what a care plan costs).

PHP 8.2 security support ends 12/31/2026, and PHP 8.3's ends 12/31/2027. Ask your host or developer about the upgrade plan.
After its end of life, a PHP version stops getting security fixes, so ask your host what the upgrade plan is.
PHP 8.3's ends 12/31/2027.

What happens when my SSL certificate expires?

Visitors see a browser warning instead of your site. Google Chrome's help page lists errors like "Your connection is not private" and "NET::ERR_CERT_DATE_INVALID," and tells visitors to "contact the website owner."

Certificates are getting shorter lives by industry rule. The maximum is 200 days since 03/15/2026 and drops to 100 days on 03/15/2027, then 47 days from 03/15/2029 under a later ballot. That makes automatic renewal a must. And Let's Encrypt, a widely used free certificate provider, stopped sending expiry reminder emails on 06/04/2025, so if automatic renewal breaks, nobody may warn you first (more on the ongoing costs of a business website).

Timeline of maximum certificate lifetimes: 200 days since 03/15/2026, 100 days from 03/15/2027 and 47 days from 03/15/2029.
An expired certificate puts a browser warning in front of your site, and with shorter lifetimes, renewal has to run on its own.
That makes automatic renewal a must.

On Wix and Squarespace, SSL is the platform's job. Wix says renewals "are handled automatically," and Squarespace says it "automatically creates and configures free SSL certificates" for its sites.

Why can a contact form stop sending leads without looking broken?

The form on the page can look fine while the emails behind it fail. Since 02/01/2024, Gmail has required all senders to set up SPF or DKIM email authentication, and says messages that don't meet its rules "might not be delivered as expected, or might be marked as spam." A website form that sends from your domain without that setup can land in spam or bounce.

There's no official figure on how often this happens. The fix is simple: submit your own form every month and confirm the lead arrives where it should.

What happens when my hours, services, or phone number go stale?

Customers and AI answers end up seeing two versions of your business. Google's guidelines ask you to "Provide your regular customer-facing hours" and to set special hours for holidays. Google also says it may contact businesses by call, text, or WhatsApp to confirm details, and that responses "may be used to update your profile."

If nobody checks, your Google profile and your website can drift apart. Google doesn't say a mismatch is a ranking penalty, but a customer who sees two sets of hours has to guess which one is right.

Sample with made-up hours: the website says Mon to Fri, 7am to 4pm, and the Business Profile says Mon to Sat, 8am to 5pm.
A sample with made-up hours: when the site and the Business Profile drift apart, nobody can tell which one is right.
Customers and AI answers end up seeing two versions of your business.

Getting found on Google and in AI answers

What should I check each month?

You can do this yourself:

  • Submit your quote form and confirm the lead arrives.
  • Tap the phone number on your site from a phone and confirm it dials you.
  • Open your site in a private browser window and confirm there's no security warning.
  • Compare your hours, services, and service area with your Google Business Profile, and review any info Google has collected.
  • On WordPress, open Site Health and look for pending updates.
Monthly checklist: submit your quote form, tap your phone number, open the site in a private window, compare your Business Profile, check Site Health.
A monthly check of the form, the phone link, the security warning, your Business Profile and, on WordPress, Site Health.
You can do this yourself.

How 3Fold Labs helps

If your site has fallen behind, rebuilding an outdated site is one of the jobs my websites work covers. I can keep the parts that still serve you and replace the parts that don't. Start with the monthly checks in this post so you know what's out of date.

Here's more on websites for service businesses.

FAQ

Can I just leave my website alone?

On Wix or Squarespace, the software side is handled, but your business facts and form still need checking. On self-hosted WordPress, leaving it alone means it stops getting fixes.

Will my site get slower if I don't touch it?

A site doesn't slow down by sitting still. What changes is the software around it, like plugins, PHP versions, and browser rules.

Why does my site say "not secure"?

Often an expired or misconfigured certificate. Chrome notes the date error can also come from the visitor's own clock being wrong, so test on more than one device.

Do I need a care plan to handle this?

Not necessarily. The monthly check above covers a lot. A care plan makes sense when nobody on your team will do it, or when your site runs on WordPress.

Sources

Analytics and session replay stay off until you accept. Form answers are not recorded by these tools. Privacy policy