Why Small Websites Fail After Launch: A 30-Minute Audit

The site that still loads

Consider a family furniture workshop in Bikaner whose website went live in March 2023. This is an illustration and describes no real business. Three years on, the site opens fine on every phone, so nobody thinks about it. Underneath:

• The domain renews in six weeks, and the reminders go to the freelancer’s old email address.
• The contact form sends enquiries to a Gmail inbox, where they are filed as spam.
• The analytics tag is the Universal Analytics kind, which stopped collecting data on 1 July 2023.
• The phone number on the page is the one the owner dropped after changing SIMs.
• The opening hours on the site and on the Google profile disagree.

Nothing in that list crashes the site, which is exactly why nobody notices. A site does not have to crash to fail. It drifts, and the drift is invisible from the home page.

This article sorts the usual causes by mechanism, gives a source wherever one exists, and ends with an audit you can run in 30 minutes. It does not rank them by how common they are, because we found no verifiable published failure rate for small-business sites. The order is by how silent each failure is and how little it costs to check. Most of it applies equally to static sites and WordPress. Where the stack changes the risk, we say so.

The accounts are in someone else’s name

Five logins decide who controls your site: the domain registrar, the hosting or CDN account, the Google Business Profile, Search Console and Analytics. For each one, ask who can sign in today and whose email receives the alerts.

The domain is the sharpest case. ICANN’s guidance for registrants says registrars must send at least two renewal reminders before a domain expires, about a month and about a week ahead, and at least one more within five days after expiry if it has been deleted. All of them go to the registrant email address in the official contact record. If that address belongs to a freelancer who moved on, the warnings go to them. After deletion there is a narrow window: the .IN Registry FAQ describes a 30-day Redemption Grace Period in which a registrar can restore an unintentionally deleted domain, and says the registrant must act immediately through the registrar.

Two practical fixes follow. Make the business the registrant, with a registrar login you hold. And use a renewal email address that does not live on the domain it protects: if the domain lapses, a mailbox on that domain goes dark with it. A business Gmail address that two people can read is a better choice than an address on the domain itself.

Nobody is assigned to change things

Phone numbers change. Diwali timings come and go. A price list is revised and an offer banner expires. If the path to a change is “message the freelancer and wait”, the site and the signboard will disagree within months, and a stale festival banner in January reads as a business that has stopped paying attention.

On WordPress the same gap has a security edge. WordPress’s documentation says plugin and theme updates are not automatic by default, apart from special cases. PHP versions leave support on a fixed calendar: on php.net, as of 3 October 2026, PHP 8.2 gets security fixes only until 31 December 2026 and 8.1 is no longer listed. And Patchstack’s report on 2025 found that 46% of new WordPress vulnerabilities had no fix when they were disclosed, with a median of five hours to mass exploitation for the most heavily exploited. A skipped month is not neutral there. On a static site nothing on the public server needs patching, but content still goes stale.

Pages also get heavier by accretion: a chat widget one quarter, a festival video the next, a bigger hero image after a photoshoot. None is wrong alone. web.dev’s Core Web Vitals thresholds give you a fixed bar: LCP within 2.5 seconds, INP of 200 milliseconds or less and CLS of 0.1 or less, at the 75th percentile of page loads. Re-run PageSpeed Insights each quarter and see whether the site still clears it.

The fix is administrative. Name one person, one channel and one stated response time. Then test it with a harmless change, such as a typo, and note how long it takes.

The contact paths quietly stop working

Forms fail first, and they fail silently. A common setup sends the enquiry from the web server with the visitor’s own address in the From field. Google’s sender guidelines, in force since 1 February 2024, require every sender to Gmail accounts to authenticate with SPF or DKIM. Messages that fail may be marked as spam or rejected with a 5.7.26 error, and Google warns that impersonating Gmail From: headers can affect delivery. A form on your server that sends as visitor@gmail.com is exactly that. The sturdier setup sends from an address on your own domain with SPF and DKIM configured, and puts the visitor’s address in Reply-To.

WhatsApp and call links fail more simply. The number changes, or the link is built wrongly. WhatsApp’s help page says a click-to-chat link needs the full number in international format with no zeroes, brackets or dashes, so an Indian number is 91 followed by ten digits. Test every contact link from a phone on mobile data, the way a customer would.

Domain and certificate dates pass unnoticed

Certificates now expire on a schedule that punishes memory. The CA/Browser Forum’s ballot SC-081v3 reduces the maximum lifetime of public TLS certificates from 398 days to 47 days by March 2029. DigiCert’s summary gives the steps: 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. The habit of buying a one-year certificate and installing it by hand is over. Manual renewal now means about twice a year, and about four times a year from 2027. If nobody owns renewal, or automated renewal fails without alerting anyone, the certificate lapses and browsers stop trusting the connection.

Ask whoever runs your site two questions. Is certificate renewal automated? Who is alerted if it fails? Then write down both expiry dates, domain and certificate, in one calendar entry with alerts at 60 and 30 days.

Measurement was never set up, or died quietly

Google’s Universal Analytics timeline says standard properties stopped processing hits on 1 July 2023. A site still carrying that tag has been counting nothing for years. A GA4 setup with no key events counts visits but not enquiries, because a key event has to be marked deliberately.

Search Console has its own trap. Google says verification lasts only as long as it can confirm the verification token is present and valid. A redesign, migration or DNS change that drops the tag or record can end verification, and with it the alerts Google sends when it finds indexing, spam or other issues. Nobody notices, because the alerts were the only sign.

The site becomes invisible by accident

A site can be live for visitors and invisible to Google. WordPress has a Discourage search engines setting that adds a noindex tag, and a staging configuration can reach a static site’s live build in the same way. Separately, a rebuilt site with new URLs and no redirects throws away what the old addresses had earned. Google’s site-move guidance is to map every old URL to its new one with server-side permanent redirects and keep them, generally for at least a year.

To check, use Search Console’s URL Inspection tool on the home page and one service page. A site: search is a quick look, but Google says it does not necessarily return every indexed URL, and recommends URL Inspection for a specific page.

The 30-minute audit

Take a phone on mobile data, a pen and this table.

Then fill in the site passport, one page you keep with the business papers.

What a fix looks like

You can do all of this without Dwize. If you already have a vendor, ask for the passport answers in writing, along with what happens to your files, accounts and domain if you part ways.

The Dwize Care Year is built around these gaps. In-scope content updates go live within 2 business days, and 12 are included. Even when you are silent, Dwize reaches out at least once a month with a status update and one question. Dwize monitors the delivered site, applies maintenance and responds to service issues through the agreed Care Year path, and every year has an agreed WhatsApp and email route for requests and escalation. Renewal price, scope and terms are written before the next year’s decision, with a preview on Day 305. And under the no-lock-in handover covenant, brand, domain, content, customer data and agreed exports remain portable at year-end. Domain registration and SSL are passed through at cost, about ₹2,100 a year.

The limits are plain. A monthly check-in helps only if you answer it, and the Care Year makes no ranking or revenue guarantees. Dwize Site is a static, coded site with no CMS login for the buyer, so changes go through the team. If your current site is stuck with a vendor who has stopped answering, the migration page explains how a move is scoped.