A message that came in through the form on my own website on 22 April 2026, I read in August. Four months. The website worked, the form said “sent” and the email died on the way.
I'm Nico, a freelance digital marketing consultant in Seville. I handle website maintenance for self-employed professionals and small businesses, and I apply that lesson to myself first. Here's what maintenance includes, how often each task is done and what happens when it isn't.
What does website maintenance include?
Five blocks of work. The first three are technical and almost nobody sees them. The last two are the ones that cause the most grief.
- Updates. WordPress, the theme and the plugins, every week. Before updating, a backup, in case something breaks.
- Security. A firewall, a malware scan and someone who looks at the alerts.
- Backups. Automatic and tested. A backup that has never been restored is a promise.
- Domain, hosting and certificate. Renewed on time and in your name.
- A website that does its job. Forms that arrive, reasonable speed and up-to-date copy.
This is the table I use to explain it, with how often each task is done and what's at stake in each case:
| Task | How often | What happens if it isn't done |
|---|---|---|
| Update WordPress, theme and plugins with a backup first | Every week | The known flaw stays open. Half of high-impact vulnerabilities are attacked in under 24 hours |
| Security: firewall and malware scan | Always on, weekly review | Google may flag the website with “This site may be hacked” |
| Backups and restore test | Automatic; test restore every quarter | If something breaks, there's nothing to go back to |
| Hosting PHP version | Once a year | PHP 8.2 stops receiving security patches on 31 December 2026 |
| SSL certificate with automatic renewal | Check it every month | The browser warns that the connection isn't secure. Certificates last less and less: from 398 days to 47 in 2029 |
| Domain and hosting in your name, with a renewal date | Once a year | If it expires or sits in someone else's account, the website goes dark and you can't do anything |
| Forms and email notifications | Every month, with a test submission | Enquiries get lost without anyone knowing |
Why do you have to update every week?
Because flaws are published every week and attacks arrive within hours. Patchstack, a WordPress security company, counted 11,334 new vulnerabilities in 2025. That's 42% more than in 2024.
Almost all of them are in pieces you add yourself. 91% were in plugins and 9% in themes. WordPress core had 6, all low priority.
Two more figures from the same report explain the hurry. 46% of vulnerabilities had no developer patch when they were made public. And half of the high-impact ones started being attacked within the first 24 hours. The median was 5 hours.
That's why the backup comes before the update. A new plugin version can break the design or a form. With the backup, you roll back in minutes. Without it, the temptation is to never update, which is exactly what attackers are counting on.
Every plugin you don't use is one more door to watch. If you don't use it, delete it.
What happens if you don't maintain your website?
Nothing usually happens in the first month. The problem builds up.
Google warns you and your clients. If Google detects that the website has been hacked, it can label it in the results with “This site may be hacked”. Chrome usually shows a warning screen before you go in. And Google says it can affect your search rankings for a while. Getting the warning removed is a process: clean up, request a review in Search Console and wait. According to Google's help pages, a malware review takes a few days and a spam review, several weeks.
The hosting stops receiving patches. PHP is the language WordPress runs on. According to php.net, version 8.2 stops receiving security patches on 31 December 2026, and earlier versions are no longer supported. Many old websites are still on old versions because an outdated plugin can't handle the change. One problem leads to another.
The certificate expires. The SSL certificate is the padlock in the browser. In April 2025 the CA/Browser Forum, which sets the rules for certificates, approved cutting their maximum validity from 398 days to 47 between March 2026 and March 2029. With automatic renewal, you don't notice. Without it, the browser warns that your website isn't secure.
The domain expires or isn't yours. No technical knowledge needed here: a date in the calendar and an account in your name are enough.
What I see with my clients
I maintain 11 WordPress websites with my own system that updates every week, with a backup before touching anything. In 2026 I've had to fix 4 incidents by hand. An incident is an update that breaks something and that the backup lets me undo.
Four in a year sounds like very little. Now picture those four with no backup and nobody watching. That would have been four websites with something broken until a client pointed it out.
What I come across most when I start has little to do with tech. 28% of the clients who come to me don't have the logins for their domain or their hosting. They're in a nephew's account, the previous agency's, or the account of someone who no longer picks up the phone. That's why, in everything I do, the domain and hosting are in the client's name from day one.
When websites need moving to a new server, the discipline is the same: backup, staging environment and checks before making the jump. That's how we moved the Factoría Serendipia website ecosystem: everything moved, nothing broken.
If you're deciding how to build your website, this cost belongs in your numbers from the start. I cover it in WordPress or a hand-coded website and in how much a website costs.
How much it costs and who can do it
You can do it yourself if you have an afternoon a week and the WordPress dashboard doesn't scare you. The checklist below is for exactly that.
If you'd rather not think about it, my website maintenance costs from €120 a month, excl. VAT and with 30 days' notice. It includes weekly updates with a backup first, security, backups and a status report. The Plus and Pro plans add a monthly report, hours for changes and an SEO review, at a fixed price based on your website. If you're looking for someone to build the website from scratch, here's how to hire a web designer without nasty surprises.
If you don't know what state your website is in, for the Diagnostic Session I look at it before we talk. It's 30 minutes, free, and you leave with three priorities. Book yours.
Sources
- Patchstack, State of WordPress Security in 2026 (11,334 new vulnerabilities in 2025, +42% compared with 2024; 91% in plugins, 9% in themes, 6 in core; 46% unpatched when made public; half of high-impact ones attacked within 24 hours, median of 5 hours; updated on 25 February 2026): https://www.patchstack.com/whitepaper/state-of-wordpress-security-in-2026/
- Search Console Help, Security issues report (“This site may be hacked” label, browser warning, effect on search rankings, review times; accessed on 28 October 2026): https://support.google.com/webmasters/answer/6347750?hl=es
- PHP, Supported Versions (PHP 8.2 with security patches until 31 December 2026; accessed on 28 October 2026): https://php.net/supported-versions
- CA/Browser Forum, Ballot SC-081v3 (maximum certificate validity from 398 to 47 days between March 2026 and March 2029; vote closed on 11 April 2025): https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/
- My own data: WordPress websites maintained by Auve Nico and 2026 incidents; clients who arrive without logins (September 2026 data); auvenico.es form (April–August 2026); published Factoría Serendipia case study.
Freelance digital marketing consultant in Seville. I work on the digital presence of professionals and small businesses with one simple principle: your website as your operations hub. Building websites, doing SEO and running social media with my own hands since 2018.
Get to know me
