Short answer: neglected WordPress sites rarely crash. They decay quietly. Contact forms stop sending with no error message, plugins drift out of date, and the site gets slower. The damage is usually invisible from the outside, which is why most people find out from a customer rather than from their website.
Nothing dramatic happens when a WordPress site goes unmaintained.
That is the part people get wrong. They picture a site going down, a white screen, an error message, something obvious enough to act on. In seven years of looking after other people’s websites, that is almost never how it arrives.
What actually happens is quieter. The site keeps loading. It keeps looking the way it always did. And somewhere underneath, a thing that used to work has stopped working, and nobody has been told.
The failure you will not see coming is the contact form
If you take one thing from this article, take this one.
A contact form can stop sending and give you absolutely no sign at all. The page still loads. The form still submits. The visitor still sees the little “thank you, I’ll be in touch” message. The email simply never arrives, and the person who filled it in assumes you got it and are choosing not to reply.
I know this because I caused it once. I changed a client’s email password during a visit and did not update that same password in the website’s mail settings, where the site used it to send enquiry emails. The form sent nothing for four days. No error, nothing in a log anyone was looking at. They found out when somebody rang them to ask why they had not heard back. I owned it, waived the invoice for the visit, and held a credit against the next job.
Then it happened again on another site, for a completely different reason. A caching plugin was serving stale security tokens on the cached pages that carried the form, so submissions were being rejected before they ever became an email. Because the form sat in the footer, the fault was site-wide.
Two sites, two unrelated causes, the same symptom: silence that looks exactly like nobody getting in touch.
That is the honest argument for maintenance, and it is not really about plugins. A quiet week is ambiguous. It might mean business is slow. It might mean your form has been broken since a Tuesday in June. Without something checking, you genuinely cannot tell the difference, and most people assume the first one. I wrote a separate guide on how to check whether your contact form is actually working if you want to test yours properly.
Where the security risk actually comes from
There is a lot of frightening writing about WordPress security, most of it trying to sell something. The real picture is duller and more useful.
Almost none of the risk is in WordPress itself. Patchstack’s State of WordPress Security report, covering 2025, found that 91% of newly reported vulnerabilities were in plugins and 9% in themes. WordPress core accounted for six, all of them low priority.
So the thing to keep an eye on is not the platform. It is the dozen or so plugins sitting on top of it, each one written by a different person, each on its own update schedule, any of which might be quietly abandoned by its author.
The timing matters too, and this is the bit that surprises people. The National Cyber Security Centre makes the point plainly: “once the updates become available to install, attackers can work out what the original flaws were that have been patched in the update and start attacking devices that haven’t had the updates installed.”
A published security update is also a published description of the hole. The gap between the fix existing and the fix being applied is the window, and on an unmaintained site that window never closes.
For context on how common that is, WordPress.org’s own statistics show the current major version running on roughly 55% of WordPress sites. Just over 45% are on something older. That is not a moral failing on anybody’s part. It is what happens when updating is a job that has no owner.
What “out of date” turns into over a year or two
Left alone, a WordPress site does not stay still. It drifts, and the drift compounds.
Updates get harder the longer they are left. Applying eight months of plugin updates in one afternoon is a genuinely different job from applying them weekly, and considerably more likely to break something. The longer the gap, the bigger the jump, and the more places a conflict can hide.
Plugins get abandoned. Developers stop maintaining things. A plugin that has had no update in two years is a plugin nobody is fixing when a flaw is found in it. You will not get an email about this.
PHP versions age out. The language WordPress runs on has its own support timetable, separate from WordPress. When a version stops receiving security support, hosts eventually move you off it, and plugins written for the old version can break when that happens.
Backups quietly stop. This is the cruel one, because a backup system that has silently failed looks exactly like a backup system that is working. You discover the difference on the single worst day, when you actually need it.
None of these announce themselves. That is the whole shape of the problem.
So what does a WordPress website maintenance service actually do?
Stripped of the marketing language, a decent WordPress website maintenance service is a short list of dull, repeated jobs:
- Core, plugin and theme updates, applied regularly rather than in an annual panic, with a check afterwards that the site still works
- Backups that are verified, not just scheduled, and stored somewhere other than the website itself
- Security monitoring for known plugin vulnerabilities, which is where nearly all of the real risk lives
- Uptime monitoring, so a site going down is something you are told about rather than something you discover
- Contact form testing, which almost nobody includes and which is the failure most likely to cost you actual work
- A person who knows the site and can fix it when something does go wrong
That last one does more work than the list suggests. Most of what I do on care plan sites is not glamorous. It is noticing that something looks off before it becomes a problem, which is only possible if somebody is actually looking.
I would rather be straight about the cost side too. I wrote a full breakdown of what UK maintenance packages cost recently, and a companion piece on what should be included in a plan. Between them they will tell you whether a quote you have been given is reasonable.
Do you definitely need one?
Not necessarily, and I would rather say so than sell you something you do not need.
If your site is genuinely a brochure, five pages that never change, no forms, no bookings, no shop, and you are comfortable updating it yourself every few weeks, you can absolutely look after it yourself. Plenty of people do. What matters is that somebody does it, deliberately, on a schedule, rather than it being a job that exists in theory and never in the calendar.
Where I would push back is when a site is doing real work. If enquiries come through it, if people book through it, if it takes payments, then the cost of a silent failure is no longer theoretical. It is the enquiry you never knew about.
Be honest with yourself about one question: when did you last send yourself a test enquiry through your own contact form? If the answer is that you cannot remember, that is worth ten minutes this week whether you ever pay anyone for maintenance or not.
A ten-minute check you can do today
No purchase required. Work through this and you will know roughly where you stand.
- Send yourself a test enquiry through every form on your site. Wait five minutes. Check the spam folder as well as the inbox.
- Log in and look at your updates screen. Count how many plugins are waiting. If it is more than a handful, that is your drift.
- Look at the “last updated” date on each plugin in the WordPress plugin directory. Anything untouched for two years or more deserves a closer look.
- Find out when your last backup ran, and whether anyone has ever restored from one. A backup nobody has tested is a hope, not a backup.
- Check your PHP version in Tools, then Site Health. If WordPress is warning you about it, your host can usually move you in minutes.
If all five come back clean, your site is in better shape than most and you can stop reading with a clear conscience.
Frequently asked questions
What happens if you never update WordPress?
The site usually keeps working, which is what makes it risky. The visible experience stays the same while three things get worse underneath. Known security holes in outdated plugins stay open, and because security updates are published alongside a description of what they fixed, an unpatched site is a documented target rather than a hidden one. Updates also get progressively harder to apply, because a year of accumulated changes is far more likely to cause a conflict than a week of them. And features that depend on other services, such as contact forms and payment tools, can stop working when those services change at their end. Nothing announces itself. Most site owners find out from a customer, or from a search engine warning, rather than from the website.
How often should a WordPress site be updated?
Weekly is the sensible rhythm for most small business sites, with security patches applied sooner when something serious is announced. Weekly is frequent enough that each batch of updates is small, which matters more than it sounds: small batches rarely break anything, and when they do, the cause is obvious because only a few things changed. Monthly is workable for a simple brochure site with few plugins. Anything less frequent than quarterly and you are into the territory where updating becomes a project rather than a task. The other half of the answer is that updating without checking afterwards is not really maintenance. Somebody needs to load the site and test the important pages once the updates are applied.
Can I do WordPress maintenance myself?
Yes, and for a simple site it is a perfectly reasonable choice. You need three habits: apply updates on a set day rather than when you remember, take a backup before you do it and store it somewhere other than the website, and test the site afterwards including every contact form. The hard part is not the technical skill, it is the consistency, because the job has no deadline and nothing goes visibly wrong when you skip it. Most people who look after their own site do it diligently for a few months and then drift. If you know that is likely, either put a recurring reminder in your calendar or hand it to someone. Either answer is better than intending to.
What is the difference between hosting and maintenance?
Hosting is the space your website lives in. Maintenance is the work of looking after what is in that space. A host keeps the server running, handles the network and usually provides a basic backup, but is not responsible for your plugins being current, your forms working, or your site being free of vulnerabilities. Many hosts sell a “managed WordPress” package that includes automatic core updates, which helps but stops well short of a maintenance plan. It will not notice that your contact form has stopped sending, that a plugin was abandoned by its developer, or that your booking page has broken. Those are all maintenance. The distinction matters because assuming your host covers it is a common and expensive misunderstanding.
How much does a WordPress website maintenance service cost in the UK?
Most UK maintenance plans for a small business site sit somewhere between £30 and £100 a month, with the range reflecting what is actually included rather than how good the provider is. At the lower end you are typically buying updates, backups and uptime monitoring. Higher plans add content changes, performance work, security scanning and a defined response time when something breaks. My own care plan is £39 a month, and maintenance is also included in the Pay Monthly website plans rather than charged separately. The thing to compare is not the headline price but whether a human checks the site after updates are applied, and whether small changes are included or billed by the hour.
Will updating plugins break my website?
Occasionally, yes, and pretending otherwise would be dishonest. Conflicts happen, usually between a plugin and a theme, or between two plugins that both want to control the same thing. This is exactly why the order of operations matters: take a backup first, apply updates, then load the site and check the pages that matter. Done that way, a broken update is an inconvenience of a few minutes rather than a disaster. The risk is also much lower when updates are applied frequently, because you are changing less at a time and the culprit is easy to identify. The genuinely dangerous approach is leaving updates for a year and then applying forty of them at once.
If you would rather not think about any of this
That is a completely reasonable position, and it is most of my clients.
RTWD looks after WordPress maintenance on a care plan at £39 a month: weekly updates, daily vulnerability checks, verified backups, uptime monitoring and a person who knows your site. If you are on one of the Pay Monthly website plans, it is already included.
If you would rather just talk it through first, including whether you need a plan at all, feel free to book a free 30-minute chat. No pressure, no pitch.
And if you do nothing else after reading this, go and send yourself a test enquiry through your own contact form. It takes two minutes and it is the single most useful thing on this page.