In 2025, 11,334 new vulnerabilities were published in the WordPress ecosystem, 42% more than the previous year: 91% were in plugins and six in WordPress core (Patchstack, State of WordPress Security in 2026). Put another way: a website doesn’t break because of the technology it chose, it breaks because of the number of pieces we keep plugging on top of it. And each piece sends you a monthly bill that isn’t paid in euros, it’s paid in attention. Here is that bill broken down by type of website, with what has to be done, what happens if you don’t do it and who each option is worth it for. Because a website can be many things, but it shouldn’t be a headache.
Quick summary
| Question | Answer in one sentence | What doesn’t fix it |
|---|---|---|
| What happens if I don’t update the plugins? | The window between a flaw being published and being exploited is measured in hours, not months | Keeping the site “hidden” or believing nobody is looking for it |
| How much work does each type of website ask of you? | From nothing to half an hour a month, and it depends on the pieces, not the CMS | Changing hosting |
| Do I need maintenance if my website is HTML? | Almost none: domain, certificate and a backup. Nothing to update every week | Paying a monthly fee for a website with nothing to break |
| How often does a website need updating? | Plugins, within days; the rest, when it’s due and with a backup first | Turning on automatic updates and never looking again |
| Why does a five-page website end up with twenty plugins? | Because every small addition arrives with its plugin, and none is ever removed | Installing a plugin to manage the plugins |
| How much of the maintenance does your hosting already do? | Less than you think: its defenses block a minority of attacks | Assuming that “it’s in the cloud” means “it’s protected” |
| Can I do it myself or do I need someone? | You can, if your website has few pieces and you have the habit | Good intentions without a calendar |
What happens if I don’t update the plugins?
The time you have to react is much shorter than it seems.
According to the Patchstack report, the median time from a vulnerability becoming public to its mass exploitation beginning is five hours, and around half are exploited within the first twenty-four. 46% of the flaws published in 2025 had no fix available the day they were made public. It’s not that someone is looking at your website: it’s bots running through lists of vulnerable versions, and WordPress powers about 43% of the world’s websites (W3Techs), so the list is enormous and your website is on it because of sample size, not interest.
What really happens when a site isn’t updated isn’t a movie-style hack. It’s spam injected into pages nobody visits, redirects that only trigger for visitors arriving from Google, or outgoing mail that ends up with your domain on a blacklist. It’s detected weeks later, usually because a customer tells you.
A tip: look at the date of the last update before looking at the design. If nobody has touched the site for more than three months, that’s the urgent task.
How much work does each type of website ask of you?
It depends on the number of moving parts, not on the brand of the software.
| Type of website | What has to be done each month | What happens if you don’t | Who it’s worth it for |
|---|---|---|---|
| Static HTML | Nothing. Renew the domain yearly and keep an eye on the certificate | Nothing, until the domain expires | Presence websites: who you are, what you do, how to find you |
| WordPress with the bare minimum | Review and update, 10 minutes | Low but growing risk | Those who publish content often and want to do it themselves |
| WordPress with a page builder and plugins | Update with a backup first and check nothing broke, 30–45 minutes | Design glitches, forms that stop sending, open doors | Websites that grow and change every month |
| WooCommerce | All of the above plus orders, gateway, stock and test purchases | Lost sales without you noticing | A store with its own catalog and the will to control everything |
| Shopify | Almost nothing technical: maintenance is the platform’s job | Nothing breaks from not looking | Those who prefer to pay a fee and focus on selling |
The interesting comparison isn’t WordPress versus HTML. It’s how many things can break versus how much time you have. A five-page HTML website goes years without asking for anything because it has nothing to ask for: no database, no plugins, no versions. A website with a page builder and eighteen extensions demands constant attention, and in return lets you change everything yourself without calling anyone. Both are reasonable decisions. The bad decision is choosing the second believing it behaves like the first.
A tip: count your website’s active plugins right now. That number is your approximate monthly bill.
Do I need maintenance if my website is HTML?
Almost none, and it’s worth saying clearly because almost nobody does.
A static website is files served as they are. There’s no admin panel to update, no plugins to clash, no database to corrupt. What does have an expiry date are three things outside the website: the domain, which is renewed every year; the hosting; and the security certificate, which renews itself if it’s properly configured. Here comes a change worth having on your radar: the CA/Browser Forum approved reducing the maximum lifetime of certificates, which drops in stages from 2026 down to 47 days in 2029. Manual renewal stops being viable for anyone, so the only thing to make sure of is that it’s automated.
If your website is a well-made brochure — who you are, what you offer, how to find you — and you update it once a year, a monthly maintenance fee isn’t protecting you from anything. It’s charging you to watch something that doesn’t move.
A tip: before signing up for a fee, ask what would break if nobody touched the website for twelve months. If the honest answer is “nothing”, you have your answer.
How often does a website need updating?
At two different paces, and confusing them is what ends in scares.
Plugins and the theme are updated as soon as the notice comes out, because that’s where 91% of the flaws are and because the five-hour window doesn’t wait for your Tuesday to-do list. The rest — PHP version, major page builder changes, migrations — is done calmly, with notice and with a recent backup, because that’s where something can really break. The PHP point isn’t theoretical: PHP 8.1 stopped receiving patches in January 2026, so a website still on it is running on something nobody fixes anymore.
The normal thing is to turn on automatic updates and consider the matter closed. What really happens is that one day an automatic update changes how a block behaves, the page builder rearranges half a page and nobody notices until a customer can’t find the form. Automating is fine; automating without looking afterwards isn’t.
A tip: back up first, update second, then open the website and do two things — send the form and browse an inner page. Three minutes that save a whole afternoon.
Why does a five-page website end up with twenty plugins?
Because every small favor arrives with its own extension, and nobody ever removes any.
The sequence is always the same. A form is needed: plugin. A cookie notice is wanted: plugin. A carousel the theme doesn’t include: plugin. Backups: plugin. Caching because it’s slow now — naturally, there are fourteen plugins — another plugin. In the end the website has more pieces than pages, and half were installed by someone who’s no longer around.
Here’s a detail from the report that dismantles a comfortable belief: paid components were only 29% of the flaws reported, but had three times as many vulnerabilities with known exploitation as the free ones. Paying for a plugin doesn’t buy peace of mind. What buys it is having few and knowing why each one is there.
A tip: make a list of the active plugins and write next to each what it does. The ones you can’t explain are candidates for removal.
How much of the maintenance does your hosting already do?
Less than the price would suggest.
The figures in the Patchstack report are fairly direct: hosting providers’ standard defenses blocked 26% of attacks, and traditional firewalls stopped 12% of attacks targeting WordPress-specific vulnerabilities. They’re a layer, not an umbrella. The same goes for backups: almost all hosts make a daily one, many keep it for only a few days, and restoring it gives you back the whole website, including rolling back the orders and comments made since.
That doesn’t mean the hosting doesn’t matter. It means its job is to keep the server standing, not to keep your website up to date. They’re two jobs and you’re only paying for one.
A tip: log in to the panel today and check two things: how many days of backups it keeps and whether you can download one. If you can’t download it, it’s not your backup.
Can I do it myself or do I need someone?
You can, if your website has few pieces and you have the habit. Both conditions count.
With a simple site, maintenance fits into fifteen minutes a month: backup, updates, checking the form, seeing that the certificate is still alive. What fails isn’t technical ability, it’s consistency: invisible tasks get postponed at no apparent cost until the day they cost everything at once.
Delegating makes sense in three cases. When the website sells and downtime is measured in money. When it has so many pieces that an update needs things checked. And when you know, honestly, that you’re not going to look at it. That third one is the most common and the least often said out loud.
A tip: if you choose to do it yourself, put a recurring appointment in the calendar the same day you publish the website. Without an appointment there’s no maintenance, there’s intention.
How we do it at Mister Mikel
We build websites and stores, and before proposing anything we ask how much you’ll be able to look at your website each month: if the answer is “not much”, the website is designed with fewer pieces, not with more monitoring. Sometimes that means a static website that won’t ask you for anything in years, and then we say so and there’s no fee. When the site does need hands every month — because it sells, because it changes, because it has a lot built on top — we cover it with a development subscription: how it works (in Spanish).
Frequently asked questions
Not because it’s paid. In Patchstack’s 2026 report, premium components were 29% of the flaws reported in 2025, but accounted for three times as many vulnerabilities with known exploitation as the free ones. What reduces risk is something else: that the plugin is actively maintained, has many installations, a track record of fast patches and a function you really need. An abandoned paid plugin is more dangerous than a free one with updates every month.
Because they’re usually bought together and arrive on the same invoice, but they’re two different services: the domain is the name and the hosting is the space where the website lives. It matters the day something fails, because the place you have to log in to differs depending on the symptom: if the website doesn’t load but email works, it’s usually the hosting; if nothing works and the notice mentions expiry, it’s usually the domain. And it matters even more when changing providers, because they can be moved separately. Knowing who holds each one and which account gives access is half the work in any emergency.
If it’s static, yes, with the domain paid and certificate renewal automated. If it’s WordPress with plugins, a year is a long time: what you usually find on returning isn’t a site that’s down, but accumulated updates that can no longer be applied in order, and that’s where incidents appear. If you know you’ll go a year without touching it, the sensible thing is to plan for it beforehand and leave it in a format that can withstand the absence. A website that’s going to sit still is built differently from one that’s going to change every month.
When maintenance turns into propping up, that is, when every small change forces you to check three other things. It usually coincides with three signs together: plugins nobody updates anymore, a page builder several versions behind and nobody who remembers why something is set up the way it is. From then on, the time spent making sure nothing breaks is greater than what it would cost to rebuild it properly, and on top of that it leaves nothing behind. Rebuilding is also worth it when what the business needs no longer resembles what the website was designed to do.
Five things that save arguments later. Whose name the domain is in, which should be yours and not that of whoever builds it. Which hosting and with what access. Who updates and how often, in writing. Where the backups are kept and whether you can download them yourself. And the question that puts all the others in order: how much time you’ll be able to give it each month, because that determines whether your website should be static, a bare-minimum WordPress or something with more pieces. Answering this at the start is what prevents the website nobody maintains.
Keep reading
- Development subscription: your design department (in Spanish)
- Custom web development
- Managing your Shopify store with AI
- Shopify online stores
Sources
- Patchstack, State of WordPress Security in 2026 (2025 data): vulnerabilities, breakdown by component, time to exploitation and effectiveness of hosting defenses.
- CA/Browser Forum, ballot SC-081v3 (April 2025): schedule for reducing the validity of TLS certificates.
- php.net, supported versions schedule: end of security patches for PHP 8.1.
- W3Techs, content management system usage statistics.
