How to use this list
Websites rarely fail all at once. They decline slowly: a page that takes a little longer to load, a form that stops delivering, a warning in the browser that nobody reports. Each of the seven signs below is something an owner or office manager can notice without technical knowledge. For each one we explain why it usually happens, what you can check yourself today and when it needs a professional.
If you recognise one sign, fix that one. If you recognise three or more, the site probably has no regular maintenance routine at all, and setting one up will save you more than fixing problems one by one.
Sign 1: pages take too long to open on a phone
Many of your visitors probably arrive on a phone, often on mobile data; your website analytics will show the exact share. If the home page shows a blank screen for several seconds, many of them will go back and call the next result instead. Owners often miss this because they test the site on office Wi-Fi on a computer where everything is cached.
Why it happens: photos uploaded straight from a camera at full size, too many plugins or scripts loading on every page, no caching, an outdated PHP version, or a low-cost hosting plan shared with too many other sites.
What to do: open the site on your own phone with Wi-Fi switched off. Then run the page through Google's free PageSpeed Insights tool and note the suggestions. Compressing images is something you can often do yourself; caching, script clean-up and hosting changes usually need a developer. Our article on mobile-first websites that bring local enquiries explains what a fast phone experience should look like.
Sign 2: browsers show a 'Not secure' warning
When a visitor sees 'Not secure' next to your address, or a full-page warning that the connection is not private, trust drops immediately. People will not type their phone number into a form on a page their browser has just warned them about.
Why it happens: the site has no SSL certificate, the certificate has expired, it was issued for a different version of the address (with or without www), or some images and scripts on an https page still load over plain http.
What to do: click the icon to the left of the address bar to see the certificate status and expiry date. An expired or missing certificate is usually fixed quickly through the hosting panel. Mixed content and redirect problems need someone to correct links in the site and its settings.
Sign 3: enquiry forms go quiet
This is the most expensive sign because it is invisible. Imagine a diagnostic clinic whose website form stopped emailing the front desk after a hosting change. Visitors still saw a "thank you" message, so nobody complained; the clinic simply received fewer online enquiries and assumed demand had dropped.
Why it happens: email sent directly from a web server is often treated as spam, especially without proper sending authentication. Plugin updates, a changed recipient address, a broken spam-protection check or a hosting move can also stop delivery.
What to do: submit your own form once a week and confirm the message arrives. If it does not, check the spam folder first. Reliable delivery usually means configuring authenticated mail sending and, ideally, saving each enquiry in the website's database as well, so nothing is lost even if an email fails.
Sign 4: old timings, prices or staff are still online
A doctor who left last year still listed, last session's admission dates, a phone number that no longer works or a festive offer from two seasons ago. Visitors notice, and they wonder whether the business is still active.
Why it happens: nobody owns the content, editing the site is difficult, or the only person with the login has left.
What to do: name one person responsible for website content and give them their own login. Put a quarterly content review in the calendar: contact details, timings, team, prices, offers and dates. If editing requires a developer every time, include a monthly edit allowance in your maintenance arrangement.
Sign 5: strange redirects, spam pages or pop-ups appear
A customer tells you your website sent them to a betting or pharmacy site. Google results for your business show page titles in another language or for products you do not sell. An unexpected pop-up appears on mobile only. These are classic signs of a hacked site, and some infections deliberately hide from logged-in administrators so the owner does not notice.
Why it happens: outdated plugins or themes, pirated premium themes, weak passwords or forgotten admin accounts gave an attacker a way in.
What to do: search Google for site:yourdomain.com and look for pages you did not create. Do not start deleting files yourself. Change passwords and get professional help to clean the site, close the entry point and restore from a clean backup. The full clean-up order is explained in our guide to website security updates and backups.
Sign 6: a renewal reminder, or an expiry, catches you off guard
The site disappears one morning and the hosting company says the domain has expired. Or you receive an urgent "domain renewal" email with a payment link and nobody in the office knows whether it is genuine.
Why it happens: renewal notices go to an email address nobody checks, the card on file has expired, or the domain was registered by a former staff member or agency. Fake renewal notices exploit exactly this confusion.
What to do: find out which company your domain is registered with, whose name and email it is under, and when it and the hosting expire. Put those dates in two people's calendars. Never pay a renewal through a link in an unexpected email; log in to the registrar's site directly instead.
Sign 7: Search Console shows errors, or nobody has set it up
Google Search Console is Google's free tool that shows how your site appears in search. It reports pages Google cannot index, security issues it has detected and any manual actions taken against the site. If you receive emails from it that nobody understands, or if no one in the organisation has access to it at all, you are missing the clearest early warning system available.
Why it happens: broken links after pages were renamed, pages blocked from indexing by mistake, duplicate pages, a hacked section, or simply nobody looking.
What to do: make sure Search Console is set up under an account your organisation owns. Read the summary once a month. Google's Search Central help pages explain each report. Fixing indexing and security errors normally needs a developer; ongoing improvements to rankings are a separate job for search engine optimisation.
Fix it yourself or call a professional: a quick guide, and how MATROP helps
| Sign | What you can do yourself | Usually needs a developer |
|---|---|---|
| Slow pages | Test on mobile data, compress large images | Caching, script clean-up, PHP or hosting changes |
| 'Not secure' warning | Check certificate expiry, renew in hosting panel | Mixed content, redirect and certificate set-up problems |
| Silent forms | Weekly test submission, check spam folder | Authenticated email sending, storing enquiries in the database |
| Outdated content | Content owner and quarterly review | Only if the site is hard to edit |
| Spam pages or redirects | site: search, change passwords | Clean-up, finding the entry point, restoring clean files |
| Renewal scare | Know your registrar, dates and account owner | Recovering lost domain or hosting access |
| Search Console errors | Set up access, read the monthly summary | Fixing indexing and security issues |
MATROP's website maintenance service starts with an audit of exactly these areas: security, speed, broken links, forms, hosting health and backups. We then apply updates and fixes and send a monthly report of what was done and what we recommend next. If you want to understand what an ongoing arrangement should contain before agreeing to one, read our guide to what a website AMC should include.
Sometimes maintenance is not the right answer. If the site is several years old, cannot be updated without breaking and no longer reflects your business, fixing each sign may cost more than starting again with a new website design. We will tell you honestly which situation you are in after the audit.
Questions people ask
Our website looks fine to us. Can it still have problems?
Yes. A site can look normal while its forms fail to deliver, its backups have stopped or it carries hidden spam pages that only search engines see. A short audit of forms, backups, updates and search results usually reveals whether anything is wrong.
Does a slow website affect our Google rankings?
Page experience, including loading speed, is one of many signals Google considers, but relevance of content matters more. The bigger cost of a slow site is usually visitors leaving before the page loads, especially on mobile data.
We have lost the logins from the developer who built our site. What can we do?
Start with the domain: the registrar can help you recover access through the registrant email or with proof of ownership. Your hosting company can then help with hosting access, and a developer can reset the website admin login from the hosting account.
