What is a vulnerability, and why does your website need maintenance?

A website is not a printed brochure you design once and forget. It is software: a set of parts (the server, the language it is written in, the content management system, the plugins, the libraries) that someone wrote and that, like everything people write, contains mistakes. Most are harmless. Some are not.

The mistakes that let a third party do something the system should never allow are called vulnerabilities. Understanding what they are, and why they show up even on sites nobody has touched in years, is the best way to understand why maintenance is not an optional expense.

What exactly is a vulnerability?

Picture a lock with a manufacturing defect: any key, turned a certain way, opens it. Nobody has walked into your house yet, but the defect is there, and it is the same in every lock of that model. The moment the manufacturer acknowledges and publishes it, everyone knows which doors to try.

Software works the same way. A vulnerability is a flaw in the code that lets someone, for example, reach the admin panel without a password, read data that should be private or run instructions on the server. The flaw rarely sits in the code written for your business: far more often it is in a component shared by thousands of sites.

Why is your site exposed even if nobody knows it?

Because attacks are no longer carried out by a person picking victims. They are carried out by automated programs that crawl the internet day and night, trying the same known flaws on every address they find. They are not looking for your company, they are looking for the vulnerable version of a component, and they do not care whether a bank or a corner shop is behind it.

That is why “we are small, nobody is interested in us” offers no protection. To an automated program, a small outdated site is exactly as attractive as a large one: one more door that opens.

What happens on the day a flaw is published?

When someone discovers a vulnerability, they usually report it privately to whoever maintains the software. The maintainers prepare a fix, release a new version and, at the same time, announce the flaw with a unique identifier called a CVE (for example, CVE-2026-12345) and a severity score from 0 to 10. Anything above 9 is considered critical.

That announcement is necessary, because it tells everyone to update. But it also starts a clock: anyone who wants to exploit the flaw compares the old version with the new one, works out what was fixed and builds an attack. Sometimes that takes weeks; in serious cases, hours or a few days.

The real risk lives in that gap. The fix already exists, but your site does not have it yet. The longer it takes to apply, the longer the door stays open with a sign above it.

What can someone do with a vulnerability?

It depends on the flaw, but the most common consequences for a business website are nothing like the movies. They are quieter, and that makes them more damaging:

• Hidden spam pages on your domain, which Google eventually spots and which sink your rankings for months.
• Redirects to fraudulent sites that only some visitors see, for instance those arriving from a phone.
• The “dangerous site” warning in the browser, which scares off any customer before they see your homepage.
• Stolen form data: the names, emails and phone numbers of people who trusted you enough to get in touch, with all the legal obligations that brings.
• Your server sending junk mail, until email providers block your domain and your own messages stop arriving.
• The site going down, or being held for ransom.

Several of these go unnoticed for weeks. The site keeps opening normally for its owner.

Why does software age even if you leave it alone?

This is the part that surprises people most. A site that worked perfectly in 2020 and that nobody has changed still works today, so it looks fine. But the world around it has moved on: since then, flaws have been found in almost every part it relies on.

On top of that, every version of a language or a content management system has an end-of-support date. From that day on, its maintainers stop releasing fixes. The site keeps working, but every new flaw discovered in that version stays open for good. “It works” and “it is secure” are two different things.

What does maintaining a website involve?

Maintenance is more than clicking “update” when a notice pops up. Serious maintenance includes:

1. Knowing what you have. An inventory of components and their versions: server, language, content management system, plugins, libraries. Without it there is no way to tell whether an announcement affects you.
2. Watching the advisories. Someone who reads the security announcements for those components and decides which ones are urgent.
3. Updating with method. Testing each update on a copy before applying it in production, so the fix does not break something else.
4. Backups that restore. Making them is not enough: every so often you have to check they can actually be recovered.
5. Monitoring. Knowing the site went down, or that something changed, before a customer tells you.
6. Shrinking what is exposed. Removing unused plugins, closing access nobody needs and not announcing to the world which version of everything you run. HTTP security headers are part of that layer.
7. Planning migrations. When a version approaches end of support, moving to the next one calmly, not on the day a critical flaw appears.

How can you tell where yours stands?

A good first step is to look at your site the way an attacker does. Our website technology checker shows which content management system, server and libraries can be identified from the outside, sometimes down to the version number. If you can see it, so can the automated programs.

With the security headers checker you can review which basic protections the server has switched on, and the safe browsing checker confirms that Google has not flagged your domain as dangerous.

None of these checks replaces a full review, but they give you a quick sense of whether there is reason to worry.

---

Website security is not solved once: it is maintained. If you are not sure who is looking after yours, our ongoing support and evolution service takes care of the inventory, the patches, the backups and the monitoring, with a record of everything applied. And if your site runs on versions that no longer receive fixes, legacy platform modernization is the way to stop relying on luck.