No system breaks suddenly. It slowly stops protecting itself, and one day somebody finds it.
What it means for a system to age
A website or an e-shop is not a painting you hang and forget. It is closer to a car: it works fine until the day it does not, and servicing is what makes the difference.
The software your site stands on — the platform, the extensions, the language, the server — is updated constantly. Every update closes a security hole somebody discovered. When you stop taking them, your site stands still while the world around it moves on.
A true story
A few days ago we checked a hotel's website. It was running a content management system ten years old, which has not had security updates in years.
Somebody had got in. The page was showing visitors a fake verification window — one of those "prove you are not a robot" prompts — and walking them through running a command on their own computer. Anyone who followed it installed password-stealing malware by hand.
The most troubling part: the owner had never seen it. This kind of attack hides — it appears once per visitor and skips the logged-in administrator. The owner opened his own site every day and saw nothing wrong, while his customers were at risk.
No exotic attack was to blame. What was to blame is that for ten years nobody touched it.
What breaks along the way
Security is the most dramatic, but not the only one:
- Payments. Banks and providers change their requirements. An old integration stops accepting cards — usually at the busiest time of the year.
- Couriers. Courier systems change and vouchers stop being issued.
- Hosting. The provider upgrades the PHP version and the old site simply does not open.
- Google. Slow or insecure pages lose positions. A hacked site gets flagged and the traffic disappears within days.
What doing nothing costs
Maintenance looks like an expense because, when it works, you see nothing happening. That is precisely what you are paying for.
The alternative is not "no cost". It is one large, unpredictable cost at the worst possible moment: cleaning up after a breach, orders lost while the site is down, a lost position in Google, and customers who saw a security warning with your name on it.
What proper maintenance involves
There is no mystery to it. Regular platform and extension updates, backups somebody has actually tested restoring, monitoring that the site is up and fast, checks that payments and shipping still work, and a look through the logs for things that should not be there.
And every few years, an honest conversation: is this still worth maintaining, or is it time to rebuild it?
The conclusion
Software does not rust on its own. It rusts because the world around it changes and it stays the same.
If you cannot remember when your site was last updated, the answer is probably "a long time ago". An audit costs very little. Learning from a customer that your site infected them costs considerably more.
