Your Website Went Down Three Weeks Ago. You Had No Idea.

A client came to us after noticing that enquiries from their website had dropped off sharply over about six weeks. The site looked fine to them — logo, photos, services page, contact form, all present. But submissions were going nowhere. A plugin update three months earlier had quietly broken the form handler. Every person who'd filled in that form during those three months got a confirmation screen that said "Thank you" while the submission evaporated into nothing.

They had no way to know how many enquiries they'd missed. Based on their historical average, we estimated somewhere between 60 and 80 leads. At their average job value, that was over R 100,000 in potential work that their competitors received instead.

The illusion of the working website

A website that looks fine is not necessarily a website that works fine. The visible layer — design, images, text — can be intact while the functional layer breaks underneath it. Forms that don't submit. Security vulnerabilities that aren't visible to a casual visitor but are trivially obvious to an automated scanner. Page speeds that have slipped from two seconds to five over eighteen months of accumulated images and outdated code. Rankings that have gradually declined because Google's crawlers see a different picture than a human loading the homepage.

The thing that makes this particularly damaging for service businesses is that the failure is silent. A printed brochure with a typo is obvious. A broken contact form delivers no signal whatsoever. You see zero new enquiries and assume it's a slow week.

What actually happens to an unmaintained website

Months 1–3: Nothing seems wrong. But in the background, plugins are accumulating updates that haven't been applied. Each unpatched plugin is a potential entry point. Security researchers and attackers both monitor newly disclosed vulnerabilities; after a CVE (a documented security flaw) is published, automated scanners find sites running the affected version within 24 hours.

Month 6: A plugin vulnerability is exploited. The attacker doesn't want to break your site — a broken site gets noticed. They want quiet, persistent access. They plant hidden files that allow them to use your hosting to send spam, inject invisible links into your pages for their own SEO benefit, or redirect visitors to phishing pages that look like banks.

You don't notice. Your site still loads. It still looks the same. But Google does notice. Within days to weeks, your domain gets flagged. Your site disappears from search results entirely, or browsers show a "This site may be dangerous" warning.

Month 9–12: Even without a successful attack, performance has degraded. Images uploaded without compression, JavaScript that was never optimised, a cache that hasn't been cleared — all of it accumulates. Page speed drops from the 2.5 seconds you launched with to 4 or 5 seconds. Google measures this through real user data (Core Web Vitals), and sites that score poorly rank lower. You're not being penalised — but your competitors who maintain their sites are outranking you, and the gap widens every month.

Month 12–24: Contact details may have changed. Your SSL certificate, which makes the padlock appear in browsers, may have expired (some renew automatically; many don't). Without that padlock, browsers show a "Not Secure" warning on your site, and 30–40% of visitors won't proceed past it. Google also gives a ranking signal to secure sites over insecure ones.

The WordPress reality

65% of South African small business websites run WordPress. This is not a criticism of WordPress — it powers a third of the entire web, and it's a reasonable choice for most SME sites. But it does mean that most SA websites are running a platform with a very large plugin ecosystem, and that ecosystem has a significant and well-documented vulnerability surface.

The average WordPress site has 20–30 active plugins. The WordPress repository has over 60,000 plugins. New security vulnerabilities are disclosed across this ecosystem constantly — somewhere between 50 and 100 per month across WordPress core, popular plugins, and popular themes. Attackers specifically target sites running outdated versions because they know the vulnerability has been documented and they know which sites haven't patched.

The rough picture for unmaintained SA sites:

• 40% have not had a core update or security patch applied in over two years
• 1 in 3 have a plugin with a known vulnerability that's been public for at least six months
• When attacked, recovery takes between one day and one week, and costs between R 3,000 and R 15,000 depending on severity

Neither of those last figures includes the revenue lost while the site is down or flagged as dangerous.

The cost of a broken form

The scenario above — a form that silently stops working — is one of the most expensive and least visible failure modes.

Let's run the numbers for a mid-sized service business generating 15 enquiries per week through their website. Three weeks with a broken form: 45 enquiries gone. At a 40% close rate and an average job value of R 2,500, that's 18 lost jobs worth R 45,000 in revenue. The cost to debug and fix the form: R 500–1,000. The net damage: R 44,000–R 44,500.

Nobody sent them an invoice for R 45,000 in missed opportunities. The site just quietly cost them that.

How uptime monitoring actually works

Uptime monitoring is a service where an external system checks your website at regular intervals — typically every 1–5 minutes — and sends an alert the moment it fails to respond. When your site goes down, you find out within minutes, not weeks.

This matters because:

1. Hosting providers have outages, sometimes affecting specific servers for hours
2. A WordPress update can occasionally conflict with a plugin and break the frontend
3. SSL certificate issues sometimes cause browsers to block the site without warning the site owner
4. Traffic spikes (a social media post going unexpectedly viral, a large press mention) can overwhelm underpowered hosting

Without uptime monitoring, you find out about any of these from a customer who mentions they couldn't reach your site. With monitoring, you find out within minutes and can have the issue resolved before most visitors encounter it.

What a maintenance plan actually covers

A monthly maintenance plan is not a retainer for future work — it's an ongoing service that keeps a live system healthy. In practice, that means:

Security patching: WordPress core, theme, and plugin updates applied when they're released, after testing them against your specific setup to make sure nothing breaks. This single action eliminates the vast majority of successful attacks.

Performance monitoring: Regular checks on load time, Core Web Vitals scores, and anything that's accumulated and started slowing the site down. Keeping a site fast is far cheaper than fixing a slow one after Google has already noticed.

Uptime monitoring with alerts: Automated checks every few minutes, with immediate notification if the site goes down for any reason.

Content and contact checks: Confirming that your phone number, address, and email match what's on your Google Business Profile. Checking that forms submit correctly. Ensuring the information a visitor finds in November 2026 is the same information they'd find if they called your number.

Backup management: Regular off-site backups mean that if something goes wrong, recovery is a matter of restoring a clean version, not rebuilding from scratch.

Small changes included: In most plans, a bank of hours covers the small things that always accumulate — a new team member to add to the about page, updated pricing, a new photo from a recently completed project.

The R 8,400 calculation

Our basic maintenance plan starts at R 699/month — R 8,388/year.

Compare that to:

• One hacked site recovery: R 5,000–R 15,000 (one-off, unpredictable)
• Three weeks of broken form enquiries at R 2,500/job: R 45,000 (silent)
• One week of downtime during your peak season: R 14,000–R 35,000 depending on your volume

Any single one of those scenarios costs more than two years of maintenance. Together — and for an unmaintained site, all three are plausible within a two-year window — they represent losses that compound.

More importantly, the value is not just the avoided cost. It's the time and mental energy you don't spend thinking about your website infrastructure. A maintained site is a system you trust. You're not wondering whether the form is working. You're not getting a call from a client who says the contact page is broken. You're not spending a Tuesday trying to understand what a "fatal error in WordPress" means.

The question to ask right now

When did someone last check whether your contact form actually works?

Not whether the form loads. Whether a submission made right now, from a phone, on a mobile connection, actually arrives in your inbox.

If you can't answer that with certainty, it's worth finding out today.

---

We offer monthly maintenance plans starting at R 699/month for small sites, covering updates, monitoring, backups, and an hour of small changes. If you're not sure whether your current site needs attention, reach out — we'll take a look and tell you honestly what we find.