What happens to a website that nobody maintains?
5 min read · Updated on 20 October 2026
A website is online and seems to work fine. Yet a lot changes around the site. Without maintenance, risks build up that you only notice when something goes wrong.
Vulnerable software
Most websites run on a CMS such as WordPress, with plugins and a theme. New vulnerabilities are found in that software all the time.
Patchstack counted more than 11,000 new vulnerabilities in the WordPress ecosystem in 2025. Of these, 91 percent were in plugins and 9 percent in themes. For 46 percent, no update was available when the vulnerability became public. The most targeted vulnerabilities were often exploited within a few hours.
A site that nobody updates therefore stays open to known attacks. A plugin that is no longer maintained will never get another update.
Domain name and certificate
If the registration of your domain name is not renewed, your site goes offline and your email stops working. For a .nl domain, cancellation is followed by a 40-day quarantine. During that period only you can reclaim the name. After that, someone else can register it.
SIDN, the .nl registry, warns that traffic to a domain name often continues for years after cancellation. If someone else gets the name, they receive that traffic and the information sent to it, sometimes by mistake.
Most hosting providers renew the TLS certificate automatically. Do check that this really happens, especially after moving your site.
DNS, forms and content
- DNS and email: SPF, DKIM and DMARC records become incorrect when you switch to a different mail or newsletter service. Your mail then ends up in spam.
- Contact form: a form without protection attracts spam. If something changes at your host or in your mail settings, messages sometimes stop arriving without anyone noticing.
- Content: old opening hours, prices or staff who have left cause confusion.
- Privacy statement: you must tell visitors clearly what you do with their data, why, who you share it with and how long you keep it. If you add a form, analytics tool or chat feature, the statement must reflect that.
security.txt expires too
A security.txt file tells researchers where they can report a security issue. The file sits in the /.well-known/ folder of your site. It is defined in RFC 9116.
The Expires field is mandatory. The standard recommends a date less than a year in the future. After that date the content is considered stale. According to the RFC, having no file is preferable to having a file with stale information.
Static sites and a yearly check
A static site without a database and without plugins has fewer moving parts. The risk of a hacked site is therefore lower. Domain name, DNS, certificate, forms, content and security.txt still need attention.
At least once a year:
- Check that the CMS, plugins and theme are up to date, and remove what you do not use.
- Check the expiry date and automatic renewal of your domain name.
- Check that the certificate is valid and renews automatically.
- Check SPF, DKIM and DMARC after every change to your mail or newsletter services.
- Send a test message through every contact form.
- Read through all pages for outdated information.
- Compare the privacy statement with what your site actually does.
- Update the Expires date in security.txt.