Does My Website Need Maintenance? 11 Warning Signs (October 2026)

You need website maintenance if your site runs on WordPress, Joomla, Drupal, WooCommerce or any other PHP system, because each part of it gets security fixes that only work once someone installs them. How much you need depends on what it's built on:

• WordPress or WooCommerce: the most. WordPress, the theme, every plugin and the PHP version underneath all update on their own schedules.
• Wix, Squarespace, Shopify or Webflow: the platform patches its own software. You still look after your content, apps, logins and domain.
• A static site: very little to patch, more on that further down.

The question I'd ask before "is website maintenance necessary?" is "who maintains my website right now?" If the answer is a shrug, keep reading.

You can tell nobody is looking after your website when the footer year is old, the browser shows a "Not secure" warning, the contact form doesn't deliver, or the site has slowed to a crawl. These four need no login at all. Check them on your phone now.

1. The copyright year in the footer is old. "© 2021" in October 2026 means nobody has opened the footer in years. It's harmless by itself, and it's the quickest clue that the rest hasn't been touched either.
2. Chrome shows "Not secure" or a red warning. Google's Chrome help page says "Not secure" means something is wrong with the privacy of the connection, usually an expired or missing SSL certificate. "Dangerous", or a full red screen, means Google's Safe Browsing has flagged the site as unsafe. You can look your site up on Google's free Safe Browsing status check.
3. The contact form doesn't arrive. Send yourself a test enquiry. Forms break quietly when a mail setting changes or a plugin stops working, and nobody notices because nobody is sending complaints through a broken form.
4. The site is slow on a phone. A site that used to load fast and now takes ages usually has old plugins, oversized images or cheap hosting nobody has reviewed.

Inside WordPress, the signs are red update badges left for months, plugins whose makers have stopped updating them, an old PHP version, and critical issues on the Site Health screen. You need an admin login for these. If you can't get one, that's sign 11.

5. Update badges are piling up. A red number next to Updates or Plugins in the dashboard means fixes are waiting. A few for a week is normal. Twenty for a year means nobody logs in.
6. Plugins nobody updates any more. On a plugin's WordPress.org page, look for "Last updated" years ago, or a warning that it "hasn't been tested with the latest 3 major releases of WordPress". A badge you can clear is one problem. A plugin with no update coming is a bigger one.
7. PHP 8.1 or older. PHP is the software on the server that runs WordPress. The PHP project released fixes for PHP2Shell only for 8.2 and newer, per its security advisory. My guide on how to check your PHP version shows where to find the number.
8. Site Health shows critical issues. Under Tools, then Site Health, WordPress runs its own checks and lists critical issues and recommended improvements, as its documentation explains. One catch: it judges the PHP branch, not the patch, so a green result doesn't prove you have this month's fix.

Whoever has the hosting login, the WordPress admin login and the domain login maintains your website in practice, and if nobody in your company can name them or produce those logins, nobody is maintaining it. These last three signs are about people, and they're the ones I see most.

9. Nobody can say where the backups are. "The host does it" isn't an answer until someone has restored one. Ask: how often, kept where, and when was one last tested?
10. The developer has stopped replying. Two unanswered messages about a broken page usually means the job has quietly ended, whatever the last invoice said.
11. Nobody has the logins. The hosting account is under an ex-employee's email, the domain is registered to the developer who built the site, and WordPress sends its alerts to an address nobody reads.

To find out who you're paying, search your email for "hosting", "renewal" and your domain name. The renewal invoices name the host and the registrar, and either can reset the account for its owner.

One sign on its own, such as an old footer year, is a tidy-up; update badges or abandoned plugins mean the site is drifting; and PHP 8.1 or older, a security warning or an admin you don't recognise mean act this week. Here's how I'd read what you found:

Website maintenance includes updating the software, backing up the site, applying security fixes, watching for outages and making the small changes a business needs each month. In plain words:

• Updates: WordPress, the theme and plugins kept current, ideally tested on a copy of the site first so an update doesn't break the live one.
• PHP: the server's PHP kept on a supported version. PHP's support dates end 8.2 on 31 December 2026, so this comes up again in ten weeks.
• Backups: files and database copied daily and kept off the server.
• Security: fixes applied when they come out, and the site checked for malware.
• Uptime: a monitor that tells someone when the site goes down, before a customer does.
• Changes: new prices, photos, promos and staff pages.
• Accounts: the hosting, domain and licences kept in the business's name and renewed on time.

Speed isn't on that list, on purpose. A site doesn't get faster every month because someone is paid to watch it. A slow site is a one-off fix.

An unmaintained website keeps running until a known security hole is used against it, which can mean spam pages, redirects to scam sites, stolen customer details or a Google warning that scares visitors off; PHP2Shell is this month's example.

PHP2Shell is two flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, that can let a stranger run code on a web server without logging in. The fix came out on 21 October 2026, and Singapore's Cyber Security Agency told organisations to update immediately. Its chief executive warned, AsiaOne reported, that many SMEs relying on outside IT vendors and hosting providers may not realise they're affected. That's the owner this post is for.

About 36% of WordPress sites that report to WordPress.org ran PHP 8.1 or older, which got no release from the PHP project. Plugins are the everyday risk. Patchstack counted 11,334 new WordPress vulnerabilities in 2025, 91% of them in plugins, and for the heavily exploited ones the weighted median time to the first attack was five hours. A site checked once a year loses that race every time.

What follows a break-in costs more than the upkeep would have. Google can flag the site in its Security Issues report and in Chrome, a cleanup is billed by the hour, and if customer details were exposed you may have duties under the PDPA. My plain-English guide to PHP2Shell has the 24-hour plan.

A static website needs far less maintenance than WordPress, because its pages are built ahead of time and served as plain files, so there's no PHP, database or plugin to patch; what's left is the logins, the domain, the forms and any third-party scripts.

PHP2Shell had nothing to reach on a static site, because no PHP runs when someone visits. The upkeep that remains is two-factor on the domain registrar and the hosting account, renewals on a card that won't expire, spam protection on the forms, and a short list of embedded scripts reviewed once a year. My guide to static vs dynamic websites goes through it in detail.

That's why, for a brochure site nobody edits weekly, I often suggest rebuilding static instead of paying for WordPress upkeep forever. In August 2026 I moved MET Interior's 176-page site from WordPress to Astro. A shop, a members' area or a team that publishes daily is usually better off on a well-kept WordPress.

Maintain your website yourself if you're comfortable in the WordPress dashboard, can log in to the hosting, and will actually check it every week; pay someone if the site takes payments, nobody has the logins, or the last person who touched it has gone.

Doing it yourself on a small WordPress site looks like this:

• Log in weekly and clear the update badges, after a backup.
• Check Site Health monthly, and the PHP version whenever PHP announces a security release.
• Restore a backup to a test copy once a quarter, to prove it works.
• Send a test enquiry through every form after each round of updates.
• Keep the hosting, domain and admin logins in a password manager the business owns.

Budget an hour or two a month when nothing goes wrong, and an afternoon you didn't plan for when an update breaks a page. The cost of DIY isn't the hours. It's the month you're busy and skip it, which is how a lot of unmaintained sites got that way.

My website maintenance is a content retainer at SGD 550 a month for 5 hours of changes or SGD 950 a month for 10 hours, with updates, daily backups and security included in both; without a retainer, it's SGD 150 an hour or a one-off fix from SGD 850.

• Content retainer, 5 hours: SGD 550 a month, which works out at SGD 110 an hour. WordPress, theme and plugin updates tested on a staging copy first, daily backups, security fixes, uptime monitoring, and your changes.
• Content retainer, 10 hours: SGD 950 a month, SGD 95 an hour, for a site that changes more often.
• Hours past a retainer: SGD 120 an hour, agreed before I start.
• Ad hoc: SGD 150 an hour, booked in 30-minute blocks, no minimum.
• A one-off fix: from SGD 850 for something broken, with a fixed price for the known work and a cap you agree on the rest.

Both retainers are month to month with 30 days' notice, and unused hours roll over one month. Your hosting, domain and licences stay in your name. For a site I built, the website partner retainer at SGD 3,045 a month spends 20 hours growing it through Google Ads, SEO and new landing pages, with hosting and upkeep included. The full details are on my website maintenance page.

Taking over starts with your site's address. I look at what it's built on before I quote, you give me the logins, and I back everything up before I change anything. To compare with other providers, see my website maintenance cost guide. If the first job is getting PHP current, here's what a PHP update costs.

A website that hasn't been updated for years is rarely too late to save, but it often costs more to repair than a regularly kept one, and sometimes a rebuild costs less than the repairs. The first step is the same either way: a full backup, then a look at the PHP version, the plugins and any signs of a break-in. If an abandoned page builder holds the whole site together, I'll quote the repair and a rebuild side by side so you can compare.

A WordPress site needs website maintenance every week for updates and every day for backups, with security fixes applied within a day or two of release. PHP put out five security releases between May and October 2026 alone. A static site can go months between checks, as long as someone renews the domain and reads the security emails.