What a vulnerability is and where it comes from
A vulnerability is a flaw in the code that an attacker can exploit to access your site, database, or server. It might be in your CMS (WordPress, Joomla), in plugins, in libraries, or in your own code.
Developers find these flaws and release updates - security patches. But if you don't install them, the vulnerability stays open. And the information is public: attackers know where to look and scan thousands of sites automatically.
The most common scenario: an outdated WordPress install with a plugin that had a known hole two years ago. There are many sites like this, and they get compromised in batches, not manually.
What happens after a breach
A compromised site doesn't always look broken. More often, attackers inject hidden code: redirects to gambling or pharma sites, malicious scripts to steal visitor data, cryptocurrency miners.
You find out when Google marks your site as dangerous and traffic drops to zero. Or when your host blocks the site for sending spam. Or when customers write that their antivirus flagged it.
Recovery takes time. You need to find all infected files, clean the database, close the hole they got in through, and get the 'dangerous site' flag removed from search engines. It costs more than installing updates regularly.
PHP, libraries, and compatibility
A site runs on a stack of technologies: programming language (PHP, Node.js), database, CMS or framework, libraries. All of these update independently.
If you leave a site untouched for two or three years, the old PHP version loses support. The host updates the server environment - and the site breaks because the new PHP doesn't support old syntax. Or the opposite: the host keeps ancient PHP for backward compatibility, but it has known vulnerabilities.
Same with libraries. A React project might have dozens of dependencies. If you don't update for a long time, technical debt accumulates: you can't update one library without breaking three others. Eventually it's easier to rebuild than fix.
Speed, performance, and SEO
Search engines factor loading speed into rankings. If your site isn't optimized for current standards - loads slowly on mobile, doesn't use caching, drags along old libraries - it loses to competitors.
Updates often include performance optimization. A new framework version might load 30% faster, a new database version might process queries more efficiently.
Without maintenance, these improvements pass you by. The site doesn't get worse in absolute terms, but it falls behind the market.
How to check if everything is okay
If you have WordPress, log into the admin panel - there will be a list of available updates. If there are more than five and security updates are among them, that's a warning sign.
For any site, you can check the PHP version through your hosting panel. If it shows PHP 7.4 or lower, support has ended and you need to update.
There are online scanners like Sucuri SiteCheck or Quttera - they check sites for free for known vulnerabilities and malicious code. It's not a replacement for professional audit, but it will catch basic problems.
If the site is React or another framework, ask a developer to run npm audit or yarn audit - these are commands that check dependencies for vulnerabilities.
What maintenance costs and what's included
Technical maintenance isn't a one-time service but a subscription. A basic package usually includes: installing CMS and plugin updates, site availability monitoring, backups, minor content edits.
Price depends on site complexity. We list starting prices on our site in the services section - there's a range depending on workload. We calculate exact quotes after looking at the project: maintaining a landing page on a site builder is one thing, an online store with integrations is another.
If you already have a site and don't know who maintains it (previous contractor disappeared, freelancer isn't responding) - we can take the project on. First we'll run an audit, install updates, set up backups.
When maintenance isn't needed
If the site is static (coded in HTML/CSS with no CMS or server logic) and sits on a host that updates the environment itself - you can get by without regular maintenance. There's simply nothing to break.
If the site is on a platform like Wix or Squarespace - updates and security are the platform's responsibility. You pay the platform's subscription fee and that's enough.
In all other cases - CMS, online store, web service, custom development - maintenance is needed. The only question is who does it: in-house developer, agency, or yourself if you know how.
A site without updates is like a car without maintenance: it runs for a while, then breaks at the worst moment. Check when you last updated your CMS and plugins. If it was more than six months ago, order an audit or at least install security updates. It's cheaper than recovering a compromised site and losing leads.
Frequently asked
How often should a site be updated?
Critical security updates - immediately when released. Everything else - once every month or two. If you have WordPress, check the admin panel at least weekly: you'll see right away what needs attention.
Can I update the site myself?
On simple CMS like WordPress - yes, if you make a backup before updating and check the site works after. On complex projects it's better to let a developer handle it: an update there can break integrations or custom functionality.
What to do if the site is already compromised?
First - change all passwords (hosting, FTP, database, admin panel). Then order cleanup from a specialist: they need to find all infected files, check the database, close the vulnerability. Trying to clean it yourself without experience usually leaves backdoors, and the site gets compromised again a week later.
How much does it cost to recover a compromised site?
Depends on the scale of infection. Simple WordPress cleanup starts at a few hundred dollars. If the database is infected and you need to restore from backup and sort out integrations, it can run into thousands. It's cheaper to pay for maintenance than for recovery.