The hidden cost of a set-and-forget website
approx 6 minute read
How’s the website doing?
Here’s a conversation we have more often than you’d think.
“How’s the website doing?”
“Great, yeah. Enquiries are coming in, nothing’s broken. Haven’t touched it in ages, to be honest.”
And that last part is usually said with a bit of pride.
Fair enough. You paid for a website, it went live, it does its job, and it hasn’t demanded anything from you since.
That feels like a win. A website that just gets on with it while you get on with running your business.
The trouble is, “haven’t touched it in ages” and “it’s fine” do not belong in the same sentence.
A neglected website fails in 2 ways
A neglected website fails in two different ways, and both are invisible until they’re expensive.
The first is security
In the background, your site drifts out of date and becomes a softer target.
The second is relevance
Left to gather dust, your site stops reflecting who you are and stops being found by the people looking for you.
One of these can take your site down overnight. The other harms you over time, with enquiries you never knew you missed.
We’ll deal with them in that order, because they’re not equal in urgency.
If your site gets compromised, nothing else on this page matters until it’s fixed.
Security underpins everything. So let’s start there.
Part 1: The update you didn’t know you needed
Of everything on a website that needs the occasional bit of attention, security updates are the one that can cause nightmares, literally overnight.
That’s not hype. It’s just the nature of the thing. A stale bit of copy costs you gradually.
An unpatched security flaw can cost you everything, all at once, on a day you didn’t choose.
Your site goes down, or worse, it stays up but starts serving malware to your customers, or leaking their details.
The reason this catches people out is that there’s often no warning.
Your site looks and behaves exactly as it always has.
The risk builds gradually, and the first sign that anything was wrong is often the disaster itself.
But WordPress is solid, right?
Yes. If your site runs on WordPress, you’re in excellent company.
It powers a huge slice of the entire web, it’s mature, it’s actively developed, and it has one of the biggest support communities on planet earth. Or the Moon, or Mars. For the moment, anyway.
When something goes wrong, fixes tend to arrive fast, because there are a lot of very clever people and AI systems whose job is watching for exactly that.
But its popularity also makes it a target. It’s just maths. Probability.
Luckily, fixes are done quickly. But a fix only protects you if it’s actually applied to your site.
Let’s look at a very real, very recent example…
wp2shell
On 17 July 2026, security researchers disclosed a flaw in WordPress core nicknamed wp2shell.
In plain English, an attacker could run their own code on a vulnerable site without needing to log in, without a password, without any special access at all.
The instinct for a lot of small business owners is, “I’ve only got a simple little site, why would anyone bother with me?”
This flaw doesn’t care how simple your site is.
It doesn’t care whether you sell software or sausages.
It’s not targeting you personally.
Automated tools sweep the entire web looking for vulnerable versions, and a stock install with zero plugins is squarely on the menu.
To put the scale into perspective, researchers estimate more than 500 million websites run WordPress.
Fixes shipped promptly in versions 6.8.6, 6.9.5 and 7.0.2, and the WordPress team took the unusual step of force-pushing that update out to all supported sites automatically, precisely because the risk was serious enough to warrant it.
That is a mature, well-supported platform behaving exactly as it should. The system worked.
Worked, that is, if your site was in a position to receive the fix.
The platform was fine. The fix existed within days.
The only variable that actually mattered was whether someone was looking after the site well enough for that fix to land.
Sites with automatic updates switched off, or quietly stalled months ago, or never set up in the first place, were the ones left hanging out in the open while public exploit code did the rounds.
The platform didn’t fail those sites. Set-and-forget did.
Part 2: the enquiries you never knew you missed
Now for the thing that’s happening every single day, no drama required.
If security is the risk that ends your site, relevance is the one that slowly makes it pointless.
A website that’s technically secure but hasn’t been touched in two years isn’t in danger.
It’s just failing at the actual job you built it for, which is to win you work.
And because there’s no crisis, no downtime, no scary email, most owners never notice it happening at all.
A website is not a leaflet you print once and file away.
It’s often the single most visible thing your business owns, and it’s being read by two very different audiences who’ve both moved on since you last looked at it.
Your customers have moved on
The services you offer now, the projects you’re proudest of, the prices, the team, the testimonials, the fact you’ve been going five years and know exactly what you’re doing.
If your site still shows the business you were when it launched, you’re introducing yourself to every visitor as an older, smaller, less impressive version of what you actually are.
You might’ve even pivoted twice as a business since then.
People make a judgement about whether you’re any good in seconds, and a site that clearly stopped being cared for tells them you might have stopped caring generally.
Fresh, accurate, genuinely useful content does the opposite. It shows a business that’s active, confident and worth calling.
And search has moved on more than anything.
This is the part that’s changed fastest.
It’s not just about ranking on Google anymore. People are increasingly finding businesses through AI assistants and answer engines that pull from your site to decide whether to recommend you at all.
And here’s the thing they all have in common, old-school search and new AI alike: they favour sites that are current, clear and regularly updated.
A site that hasn’t changed in years reads as stale to a search engine and invisible to an AI.
If your content doesn’t clearly say what you do, where you do it and why you’re the right choice, you don’t just rank lower. You increasingly don’t get mentioned at all.
And you’ll never see those missed enquiries, because they simply go to whoever did keep their site current.
That’s the damage done in the background. Not a disaster you’d notice, just a steady leak of work going to competitors whose only real advantage is that their website still reflects reality.
So what can you check yourself?
Plenty, actually.
We’re big believers in showing people how to look under their own bonnet, so here are a handful of checks you can run today.
No tools, no cost, no catch.
They split neatly along the same two lines: is my site safe, and is my site still doing its job.
On the security side
#1 What version of WordPress are you actually on?
Log into your dashboard and go to Dashboard → Updates.
If it’s nagging you to update, that nag has probably been there a while.
This is the single most useful thing you can check after reading this.
While you’re there, also check your php version.
Are automatic updates activated?
Auto-updates can be switched off without anyone remembering doing it.
Or they can stall on a technical hiccup and just stop.
“I think we have auto-updates” is not the same as knowing they worked. Remove any unused plugins.
Check your backups
When did you last take a backup you know actually works?
A backup you’ve never tested restoring is a backup you’re hoping exists.
There’s a difference, and you really don’t want to discover it on the worst possible day.
Our Nettl hosting automatically takes backups. Check you also have a system in place.
On the relevance side
When was your content last updated?
Read your homepage and services pages as if you were a customer who’d never heard of you.
Is it still accurate? Are there recent reviews?
Does it mention everything you now do? (Or want to do?)
If your “latest news” is from 2023, that’s the impression you’re making.
How visible is your business?
Could a customer easily find your solutions?
Search for the thing people would type to find a business like yours. Are you on page one? Top three lists? Who appears in the sponsored listings? How about maps?
Go a step further and ask an AI assistant to recommend a business like yours in your area.
Do you get a mention? That’s fast becoming just as important as the Google result.
Whatever your results, use AI to compare your website offering to your competitors and point out strengths and weaknesses.
AI isn’t perfect, but it’s good for perspective. A second set of eyes.
Do those tasks and you’ll already know more about your website’s real health than most business owners ever bother to find out.
With the context you can provide, any action points will become clear.
One last thing
If you’d rather not go it alone, we’re always happy to run a free website health check for you. Just ask.
And if you’d like to read more about keeping your site secure with a Nettl Care Plan, here’s where to start.