Picture a clinic that takes bookings through its website. One Friday a plugin updates itself and the booking form stops working. No alert, no crashed site. On Monday the phone is quieter than usual, but nobody works out why until Wednesday. By then customers have spent three days trying to book, failing, and going somewhere else.
That’s usually what it looks like when a website breaks. Not a dramatic hacker attack, but something small and quiet that nobody notices until the business has already been lost.
This article is about why it happens, what it costs, and why a maintenance plan is, in practice, cheap insurance. Not scare tactics. Just what actually goes wrong, and what actually protects you.
Sites rarely break dramatically. They just stop working.
WordPress itself is small and well maintained. The problems almost always sit in what’s been built on top of it: plugins and themes. A business site easily collects a plugin for every little feature. Every plugin is extra code, and every extra piece of code is something that can clash when it updates.
The most common reason something stops working is exactly that kind of clash. A plugin updates, but it’s no longer compatible with another part of the site. The result is rarely a blank white screen. More often it’s a form that quietly stops sending, a booking button that doesn’t respond, or an image that disappears. The kind of thing you don’t notice until a customer mentions it, or until you happen to test it yourself.
Then there are the plugins nobody maintains any more. The security tool Wordfence treats a plugin as potentially abandoned if it hasn’t been updated in at least two years. The problem is that your WordPress doesn’t warn you when this happens. As Patchstack has pointed out, a plugin that’s been closed on WordPress.org, for example over a security hole, still shows as up to date in your admin, because there’s no new version to fetch. Everything looks calm, even though it isn’t.
On top of that comes old PHP, the programming language WordPress runs on. When your server runs an outdated PHP version, plugins start misbehaving and security weakens. And then the most mundane causes of all: a domain that wasn’t renewed in time, or an SSL certificate that expired. Then the site is down completely, or the visitor is met with a red security warning. None of that has anything to do with hackers. All of it is preventable. If you want to understand how the domain, hosting and email fit together, and why an expired domain can switch everything off at once, we’ve written about exactly that.
What you don’t see: old code is an open door
Now to the part people are afraid of. Hacked sites.
Here’s the important thing, and it’s actually reassuring: the vast majority of break-ins don’t happen because someone targeted your business specifically. They happen because a known hole in an old plugin was left open, and automated bots found it. It’s nothing personal. It’s just an unlocked door someone walked past.
And known holes get exploited fast. Verizon’s major 2026 security report, an independent source covering the whole economy and not just WordPress, shows that exploiting vulnerabilities is now the most common way into the data breaches they analysed. It accounts for 31 percent of breaches and has overtaken stolen credentials.
The security industry’s own figures point the same way: the large majority of WordPress break-ins come through plugins, themes or core that weren’t kept updated. Those figures come from companies that sell security services, so take the exact percentages with a pinch of salt. But the direction is clear and confirmed from independent quarters. Old code is the way in. What you can do about it yourself is covered in our guide to WordPress security for business owners.
What it actually costs when things go wrong
What happens if it does go bang? It depends on the business, but the pattern is the same.
The first thing you lose is customers you never even find out about. A clinic or a tradesperson taking bookings through the site loses every enquiry that comes in while something is broken. It shows up in no statistic. People just move on.
If the site gets hacked and Google flags it for malware, it gets worse. Browsers then show a red warning page, and the site is effectively removed from search results. Security firm Sucuri estimates that a blocklisted site loses almost all of its organic traffic for as long as the warning stays up. That’s a vendor’s estimate, not an independent study, but the order of magnitude matches how Google handles flagged sites. Ads to that page get stopped too.
Then comes the cleanup, and it has no fixed price tag. The cost is driven mainly by how old your last clean backup is and how long the attacker had inside. Content is sometimes lost for good, and it can take a while before the site is back where it was in search results. It’s rarely cheap, and it’s always more expensive than having avoided it.
GDPR: a real obligation, but not scare tactics
This is where a lot of agencies get dishonest, and we don’t intend to be.
If your site is hacked and customer data leaks, that’s a personal data breach, and the GDPR then gives you three days from finding out to report it to the Swedish data protection authority, IMY. If the risk to those affected is high, you also have to inform them directly. It’s a real law with a real deadline, and it’s not something you want to be scrambling to handle in a panic in the days after a break-in.
For a clinic it weighs even heavier, because health data and personal identity numbers count as especially sensitive. That’s exactly the kind of thing many small businesses store.
But now to what agencies rarely tell you: how big is the risk of actually being fined? The GDPR itself says a fine has to be proportionate, and that for a minor infringement the authority can issue a reprimand instead (Recital 148). When IMY decides on a sanction, Article 83 requires it to weigh, among other things, what the business did to limit the damage and how it cooperated.
That means what you do after a breach counts. Reacting quickly, informing those affected and putting new routines in place all weigh in your favour.
That’s the honest picture. A small business that looks after its site and reacts correctly has a lot on its side. The big fines in Sweden have gone to organisations handling data about very large numbers of people, as IMY’s list of administrative fines shows. The point of GDPR here isn’t fear. It’s that you have a genuine obligation, and one that’s far easier to live up to if the site is looked after before anything happens.
Why “just click update” isn’t enough
At this point you might be thinking: surely I can handle this myself? Log in, click update now and then. And sure, that’s better than nothing. But it isn’t enough, and it’s worth understanding why.
First, there isn’t always an update to click. According to Patchstack, 46 percent of the WordPress vulnerabilities reported in 2025 had no fix available when they became known. Abandoned plugins never get one at all. Staying updated doesn’t help against a hole nobody has patched.
Second, the update itself can be what takes the site down. That’s exactly what happened to the clinic in the example at the start. An update pushed without first testing it in a safe environment is a gamble.
Real maintenance is therefore more than pressing a button. It’s updates tested before they go live, regular backups so a crashed site is back in minutes instead of rebuilt from scratch, monitoring that catches break-ins early, and alerts when the site goes down or a certificate expires. It’s also someone who actually notices when a plugin has been abandoned and swaps it out before it becomes an open door.
It’s the difference between hoping nothing goes wrong and knowing someone is keeping watch.
A maintenance plan is cheap insurance
So what does it cost to have someone handle all this? It depends on the site and what’s included: how many plugins need keeping up with, how often it’s done, and whether monitoring and backups are part of it. Ask for a fixed monthly price, so you know what you’re comparing.
Set that against the other side. A cleanup. Lost visibility in search while the warning stays up. Bookings that never came in while the form was down. A 72-hour deadline to deal with in the middle of everything else. Seen that way, a maintenance plan isn’t a cost. It’s cheap insurance against having to pay the bigger price.
Start with the plugin list
Log in and open your list of plugins. How many are there, and when was each one last updated? You can see that on the plugin’s page on WordPress.org. A plugin that hasn’t been updated in a long time, or that has been closed on WordPress.org, is the first one to replace or remove.
Send us the list if you’d like a second opinion on which ones should go. If you’d rather someone else kept an eye on it all the time, that’s exactly what ongoing maintenance does.