Web TeamMost small business websites don’t break all at once. They wear down. A plugin here, a skipped update there, a login nobody remembers. Then one day the contact form stops working and nobody notices for a month.
We look at a lot of WordPress sites. The same mistakes show up again and again. Here are the ten we see most, and what to do about each one.
1. Skipping updates
WordPress, your theme, and your plugins all get updates. Many of them are security fixes. On October 28, 2026, WordPress released version 7.1.4, a security release that fixed 22 separate issues. The WordPress team told everyone to update right away.
If your dashboard shows a pile of updates waiting, that is a risk sitting in plain sight.
2. Too many plugins
Every plugin is code someone else wrote. Some are great. Some haven’t been touched in years. Patchstack, a WordPress security company, found that 91% of new WordPress security holes reported in 2025 were in plugins. Only 6 were in WordPress itself.
Fewer plugins means fewer doors to lock. If you don’t know what a plugin does, find out before you keep it.
3. Old plugins nobody maintains
A plugin can work fine and still be a problem. If the developer walked away, nobody will fix it when a hole is found. Check the “last updated” date on each plugin. If it’s been more than a year or two, look for a replacement.
4. Running old PHP
PHP is the language WordPress runs on. Your host controls which version you use. As of October 2026, PHP 8.1 and older no longer get security fixes. PHP 8.2 stops getting them on December 31, 2026. Many sites are still on old versions because nobody asked the host to change it.
5. No real backups
Lots of owners think their host backs up the site. Sometimes it does. Sometimes it keeps one copy for a few days. Sometimes the backup sits on the same server that just got hacked.
A good backup is automatic, stored somewhere else, kept for weeks, and tested. If you have never restored one, you don’t know it works.
6. Everyone shares one admin login
We see this a lot. The owner, the office manager, and a freelancer from 2019 all use the same admin account. When someone leaves, the password never changes.
Give each person their own login. Give them only the access they need. Remove people when they leave.
7. The web guy owns everything
Your domain, hosting, and Google accounts should be in your name. Too often they’re in the name of whoever built the site. If that person stops answering, you can lose your site or your email. We wrote a whole post on this one.
8. Contact forms that quietly fail
A form can look fine and still not send anything. Emails land in spam, or go to an old inbox. Test your forms every month. Fill one out yourself and make sure it shows up.
9. A slow mobile site
Most of your visitors are on their phones. Big images, heavy page builders, and too many scripts make pages crawl. Google’s own research found that more than half of mobile visits are dropped when a page takes longer than 3 seconds to load. Slow costs you calls.
10. Set it and forget it
A website isn’t a brochure you print once. Hours change. Staff change. Services change. If your site still lists a person who left two years ago, customers notice.
Quick checklist
- WordPress, theme, and plugins are up to date
- Every plugin is in use and updated in the last year
- Your host runs PHP 8.3 or newer
- Backups run daily, are stored off the server, and you’ve tested one
- Each person has their own login
- Domain, hosting, and Google accounts are in your name
- You tested your contact form this month
- Your homepage loads fast on your phone
- Hours, staff, and services are current
The bottom line
None of these are hard to fix. They just need someone to own them. If you’d rather not be that someone, that’s what we do.
Not sure where your site stands? Book a free 30-minute website audit. We’ll go through your site with you on Zoom or the phone and tell you what we see.
