What Happens After Your Website Goes Live?

Your new website is up. It looks finished, the invoice is paid, and it feels like the project is over. You can tick it off the list.

But a website isn’t like a brochure you print once and put in a drawer. It’s software. And software never stands still.

What happens after launch is usually the thing nobody mentions when you order a website. Plugins need updating. Security holes appear. Things stop working, sometimes completely silently. This article is about what WordPress maintenance actually means for a business, why it matters, and what’s at stake if you leave the site to look after itself.

A WordPress site can’t be left alone

WordPress is made of three parts: the core system itself, your theme, and your plugins. All three are updated, but on different schedules and by different developers. That’s why you almost always see something waiting to be updated when you log in.

And it’s the plugin layer that carries the real risk. According to security firm Patchstack’s report State of WordPress Security in 2026, 11,334 new vulnerabilities were discovered in the WordPress ecosystem during 2025. Of those, 91 percent were in plugins. Just two were found in WordPress core itself.

What does that mean in plain terms? The problem is almost never WordPress itself. It’s the plugins. The small features that add a booking form, an image carousel, or a contact box are at the same time the most common ways in for someone with bad intentions.

Patchstack also measured how quickly a new vulnerability gets exploited. For the most exploited holes, the median time from becoming public to the first attack was just five hours. You can’t sit and watch security feeds around the clock yourself. That’s why fast security fixes, tested updates, a firewall, and someone who follows up on the alerts actually matter.

“But who would want to hack us?”

This is the most common thought, and the one that causes the most damage. The logic feels reasonable. Your business is small, local, of no interest to hackers. Who would care?

The problem is that almost no attack is carried out by a human who picks you specifically. It’s done by bots that scan the entire internet for known patterns: a WordPress login at the standard address, a plugin with a known security hole, a visible version number. The bots don’t care about your revenue or your visitor numbers. They hit everything.

The scale of this is hard to take in. Security firm Wordfence blocked over 55 billion password attacks during 2024. New sites with zero traffic often get their first attack attempts within minutes of launch.

And a hijacked site is rarely used for anything dramatic aimed at you. It becomes a tool. It sends spam. It fills up with hidden links to fake pharmacies or gambling sites that wreck your visibility in Google. It’s used to trick others. None of that requires your business to be interesting. It’s enough that the site exists and is open.

What actually breaks when nobody’s watching

Most of what breaks does so without any drama. You often notice only once the damage is already done.

The most serious one for a service business is the contact form that stops delivering. There’s no error message. The form looks like it works, the visitor gets a thank-you, but the email never reaches you. Leads vanish in silence. The cause is almost never the form itself, but how WordPress sends email at a basic level, which many hosts block or let through as spam. One simple habit saves you here: send a real test message through your own forms now and then and check that it lands.

Then there’s the white screen. “There has been a critical error on this website,” or just a blank page. It usually comes down to an update clashing with something else, for example when the host switches PHP version and an old plugin can’t keep up. A maintained site keeps all the parts in step and tests updates before they go live.

And then the digital certificate, SSL, the thing that makes the address start with https. When it expires, the visitor is met by a red warning page from the browser saying the connection isn’t secure. Most turn back at the door. Certificates also have ever-shorter lifespans. The maximum validity is being stepped down from 200 days in March 2026 to 100 days in 2027 and 47 days in 2029, following a decision by the CA/Browser Forum. Renewing by hand quickly becomes impractical. It needs to be monitored and renewed automatically.

Beneath the surface, other things pile up. The database swells with old drafts and junk. Abandoned plugins the developer has stopped updating become permanent holes. None of it shows on an ordinary day. But it builds up.

The part most people skip: a neglected site is a data-protection problem

This is where it gets serious, and where almost no guide dares to go. For a site that collects customer data, maintenance isn’t just a technical question. It’s a question of compliance.

The GDPR requires that you, as someone handling personal data, take appropriate technical and organisational measures to protect it (Article 32). For a WordPress site, that means in practice that security has to be handled continuously: updates, backups, access control, monitoring, and the ability to restore the site if something goes wrong. And that means something important: an outdated site sitting there collecting bookings or form responses can be in breach of the GDPR before anything even happens. Failing to handle security is itself a shortfall, not just a risk.

And if you actually are hit, the clock starts ticking. In the event of a personal data breach, you must report it to the supervisory authority (in Sweden, IMY) without undue delay, and at the latest within 72 hours. If the risk to those affected is high, you may also have to inform them directly. For a clinic or consultant whose site has leaked customer data, this is not a theoretical question.

That it has consequences isn’t speculation. In January 2026, IMY decided on an administrative fine of 6 million kronor against Sportadmin i Skandinavien AB after a data breach. What’s telling for an ordinary business is what IMY seized on. Not bad luck. Not a super-sophisticated attack. But everyday security shortfalls: a vulnerability from a 2022 code change that went uncaught, gaps in review routines, over-generous permissions, the absence of a working WAF, and monitoring that didn’t detect the intrusion in time.

Those are exactly the gaps that ongoing maintenance exists to close.

Two things are worth keeping in mind here. The decision can be appealed, and most fines against small businesses land well below the million mark. Not every incident leads to a fine, and IMY weighs in proportionality and ability to pay. The point isn’t to scare with numbers. The point is that inadequate security in itself is what IMY reacts to, not merely that a leak happened to occur.

If you run a clinic or collect health data, the security level needs to be higher. Health information is specially protected under the GDPR, and the security requirements tighten in step with how sensitive the information is. A physiotherapist whose booking page collects details of ailments and diagnoses carries a considerably heavier responsibility than a tradesperson collecting names and phone numbers.

So what does “maintenance” actually mean?

Maintenance sounds abstract until you break it down. Here’s what it actually comes down to:

• Updates to core, theme, and plugins, ideally tested before they go live. That closes the holes behind the vast majority of break-ins.
• Backups that are independent and stored off the host, so the site can be restored after a break-in, a broken update, or a misclick.
• Uptime monitoring that checks the site every few minutes and alerts you when it’s down, so you find out before your customers do.
• Security monitoring and a firewall that block malicious requests and can patch known holes before you’ve had time to update. It was precisely the absence of one of these that weighed heavily in the Sportadmin case.
• Malware scanning that finds injected code and hidden accounts early.
• SSL certificate renewal so https never expires without warning.
• Performance and link checks that keep the site fast and free of dead links, something both visitors and Google notice.

The backup that saves you

One thing deserves to be singled out, because it’s the last line of defence when everything else fails: the backup.

Many assume the host takes care of it. And sure, many hosts do take copies. But they often sit on the same server as the site itself. If the hosting account is hacked, shut down, or hit by a failure, the live site and the copy can disappear together. Then you’re left with nothing.

A sensible backup is independent, stored somewhere else, and contains both the files and the database. And, most importantly, it’s tested. A copy that has never been restored isn’t reassurance. It’s an assumption. You don’t want to discover it was broken on the very day you need it.

Questions to ask whoever looks after your website

If you don’t know where your site stands today, this is a good list to run through, either yourself or with whoever is responsible for the site:

• Who updates WordPress, the theme, and the plugins, and how often?
• Are backups stored off the host, and has anyone tested restoring from them?
• Does anyone get alerted if the site goes down or comes under attack?
• Are the contact forms tested at regular intervals so leads actually get through?
• Who helps you, and how quickly, if something breaks?

If you don’t get clear answers, that’s often a sign that nobody is really holding it together.

Frequently asked questions

The launch was the beginning, not the end

The site going live doesn’t mean the work is done. It means a new phase has begun, one about keeping the site secure, working, and in step with the world around it.

For many business owners, this is exactly what they don’t want to spend their time on. And that’s entirely fair. You have a business to run.

Not sure who’s actually keeping an eye on your site today? Get in touch with us at Monprez. We’re happy to do a simple review and show you what needs fixing first.