What breaks on a website, and roughly when
Unmaintained sites fail in a predictable order: forms stop delivering within months, certificates expire around the year mark, dependency vulnerabilities accumulate continuously, and speed degrades gradually. A monthly routine of twelve checks catches all of them.
Key takeaways
- Submit your own contact form monthly — silent form failures are extremely common.
- Restore a backup quarterly. An untested backup is an assumption.
- Sites do not get slow suddenly; they drift, which is why nobody notices.
- Review who still has access — ex-staff and ex-agency accounts accumulate.
Nothing changed, and yet the contact form stopped emailing four months ago, the certificate is due next week, six dependencies have published advisories, and the last backup anyone can find is in a hosting panel nobody has the login for.
The timeline
- Weeks 1–8
- Forms and integrations. A mail provider changes a policy, an API key rotates, a plugin updates — and submissions stop arriving with no error anywhere a human looks.
- Months 3–6
- Speed. Images added by the content team without optimisation, a new tracking tag, one more chat widget. Nothing dramatic; the page is just a second slower each quarter.
- Months 6–12
- Dependencies. Security advisories accumulate against packages nobody has updated. Individually minor, collectively an upgrade project rather than a routine.
- Around month 12
- Certificates and domains. Auto-renewal fails on a card that expired, and the site is unreachable on a Sunday.
- Year 2+
- Knowledge. The people who built it have moved on, nobody has repository access, and small changes start being quoted as projects.
The monthly routine
- Uptime for the month, with any incidents and their causes noted.
- Error logs reviewed — a rising error rate usually precedes a visible failure.
- Submit the contact form yourself and confirm the email and the CRM record both arrive.
- Complete a test purchase if you sell online, including a COD order.
- Restore a backup into a scratch environment. Quarterly at minimum.
- Apply dependency and security updates, tested in staging first.
- Check certificate expiry for every domain and subdomain.
- Core Web Vitals in Search Console, compared with last month.
- Search Console coverage — pages newly excluded or erroring.
- Analytics sanity check — is traffic recording, are conversions firing.
- Broken links, internal and outbound.
- Access review — who has hosting, repository, CMS and analytics access, and should they still.
Why a retainer beats calling someone when it breaks
Emergency work is the most expensive way to buy engineering: no context, no preparation, and it always coincides with something else important. Someone who works on your system monthly fixes an incident in an hour; someone meeting it for the first time spends that hour reading. You pay for the reading either way — the scope is on Maintenance & Support.