The old agency model is built to win and launch projects, not to keep them working, so most sites start failing in year two for want of anyone whose job it was to look, and looking after a site is a set of tasks on cadences set by published standards, priced for the work and not as a share of the build.
A website project in the old model has a shape. A pitch, a proposal, a design phase, a build, a launch, an invoice, and then a thirty-day warranty after which the agency moves to the next pitch. Nothing in that shape pays anyone to look at the site in its second year, which is when the decay below begins to show. This piece sets out what clients say when they leave, what happens to a site nobody looks at, and what looking after one actually involves, how often, and at what cost.
The reason clients leave is measured, in the United States at least, and it is not the reason agencies think. In a survey of more than 400 marketers in 2024, dissatisfaction with delivery was the top reason clients ended an agency relationship, at 48 per cent; agencies ranked it seventh among the causes. In the 2025 edition, a smaller sample of about a hundred, delivery and value were each named by 61 per cent of clients, while agencies believed delivery was the cause 18 per cent of the time and blamed budget cuts instead. Treat the figures as a direction, given the sample. The direction is that clients leave because the work did not arrive or did not keep arriving, and agencies do not know it.
A site that is launched and left does not stay as it was. It decays, in four ways that are measured.
It falls behind. Among WordPress sites that report their versions, 28.5 per cent are on a version below 7.0 and a third are on a version of PHP that is past the end of its security support. That is not a rounding error. It is a third of the WordPress web running on software nobody fixes.
It gets broken into. In one large security vendor’s report on 2023, 39.1 per cent of hacked sites were running out-of-date software at the moment they were compromised. The site did not fail on the day the warranty ended. It failed some months later, when a flaw was published and nobody was watching.
It loses its pages. The Pew Research Center found that 38 per cent of the web pages that existed in 2013 were gone a decade later. Pages are deleted, addresses change, links break, and each is a buyer who arrives at an error.
It drifts. Its certificate lapses, its form stops delivering because a service changed its terms, its speed slips as the browsers move on, and its search ranking follows. Nobody has measured the rate of that drift in isolation, and we will not pretend to. Everyone who has looked after a site has seen it.
The cadences are not ours. They come from the standards and the people who set the rules, and the job is to keep to them.
Patching. The UK’s Cyber Essentials scheme requires any critical or high security fix to be applied within 14 days, and says that is the maximum, not the target. The UK National Cyber Security Centre’s own guidance for internet-facing software, which a public website is, says five days. Where a public exploit exists the right window is shorter still. Unsupported software must be removed, not left.
Backups. The UK National Cyber Security Centre’s principles say a backup must survive an attacker who has the main system, and must be tested as routine. For a site built from a repository, the repository is the backup of content and code, and the test is to rebuild and redeploy from it alone and time it. We ran that test on each of the sites in our case studies on 28 October 2026. The first time we ran it for one shop it failed for want of 32 settings, which is why the test exists.
Certificates. The maximum lifetime of a security certificate is 200 days now, 100 from March 2027 and 47 from March 2029. Renewal must be automatic and watched, because the failure is a full-page browser warning and no visitors.
Code, links, speed and search. Broken links, redirect chains and failing forms are crawled for monthly. Google’s thresholds for loading, responsiveness and stability are measured on real visitors at the 75th percentile and reported in Search Console, which is read monthly. Google’s own advice is to check previously published content and update or remove it, so a dated review of each page is part of the job.
The log. Every task above produces a line in a log the client can read: what was done, when, and what it found. A care arrangement without a log is a direct debit.
You may have been told that a website should cost 15 to 20 per cent of its build price each year to maintain. We looked for the source of that rule and found none. It resembles figures from the software-maintenance literature of the 1980s, which were about something else, and the modern literature puts maintenance at most of a system’s lifetime cost, not a fifth. The honest statement is that upkeep costs what the work costs, so we price the work.
The market gives a range. Commodity WordPress upkeep, meaning updates, backups, scans and monitoring with little engineering time, is sold in the United States at between $39 and $359 a month per site. Plans that include engineering hours, performance guarantees and monitoring run from $435 to $2,190 a month. UK agencies rarely publish retainer prices at all, which is itself a finding. Our own tiers, and what each covers, are on the ongoing care page. There is no contract longer than a month, and thirty days of Essential comes with every site we build or move.
Strip away the pitch, the office and the account manager, and what a business is paying for is three things.
The build, which should be a fixed price for a written scope, by the engineers who will do it, with the measurement that shows it met the standard. The ownership, which means the domain, the hosting and the code in your name, or transferred to you on request with a written handover. And the looking: someone whose job it is, every week, to patch what needs patching inside the window the standards set, to restore a backup to prove it works, to crawl for broken links and failing forms, and to read the search figures. That last part is what the old model does not sell, because it does not fit the shape of a project, and it is the part that decides whether the site is still working in year two.
An engineering-led firm has no office to carry, no pitch team, and nobody between you and the engineer. What it sells instead is the build at a fixed price, the handover, and the care as a monthly arrangement with a log you can read. That is our model, set out on the About page. If your site was launched and left, tell us when it was last looked at and an engineer will say what the first month would cover.