Your website has expiry dates in it, and they were published years ago.

The site was finished in 2023. It looks the same today as the day it launched, nothing has broken, and nobody has touched it since the invoice was paid.

That sounds like a success and it is closer to a countdown. Software you own has dates attached to it, most of them published years in advance by people who were not talking to you.

The certificate: 90 days, forever

The padlock in the address bar is a certificate, and if yours comes from Let's Encrypt it is valid for exactly 90 days. Renewal every 60 is the recommendation, the lifetime cannot be extended, and there are no exceptions.

Normally this is invisible, because software renews it automatically. The failure mode is what matters. When that automation breaks there is no gentle warning, no email, no degraded-but-working state where you notice something is off and get round to it next week: visitors simply get a full-page browser warning telling them your site is not safe, which is about the most damaging thing that can appear between a customer and your business.

The direction of travel is shorter, not longer. Let's Encrypt now offers six-day certificates renewed every three days, which tells you how thoroughly this is expected to be automated. Anything in your setup that still depends on a person remembering is a problem with a date on it.

The language underneath has an end-of-life

If your site runs WordPress, or almost anything else in that world, it runs on PHP, and PHP publishes its own schedule. Each release gets two years of active support, then two more years of security fixes only, then nothing.

Four years, start to finish, decided before your site existed.

Here is what that looks like in practice right now. PHP 8.2 came out in December 2022, which made it a perfectly sensible choice for a site built in 2023. Its active support ended at the close of 2024, and its security support ends on 31 December 2026. Anyone whose site is still on it has a few months before it stops receiving security fixes entirely, and almost none of them know the date.

None of this is a crisis if somebody is watching. All of it is a crisis if the plan was that a finished website stays finished.

The platforms move on their own schedule too

The parts you did not build change as well, and this year has been an unusually good demonstration.

Google shut down Business Profile messaging in July 2024 and left the metric sitting in its documentation afterwards. It retired the Google Guarantee in October 2025, which quietly turned a lot of contractor marketing into a promise nobody backs. It switched off the free Business Profile website builder and took thousands of small business sites with it.

Every one of those was announced. Properly, in advance, on the record. And none of it reached the people affected, because a deprecation notice travels to developers and platform administrators and mailing lists and changelogs, which is to say it travels everywhere except to the owner of a plumbing company who paid for a website once and reasonably assumed that was the end of the transaction.

Nobody was hiding anything. The notice just had nowhere useful to land.

What maintained should actually mean

A maintenance retainer that produces no evidence is just a subscription. What you should be able to see is which versions you are on, when each of them expires, what was updated last month, and whether anything broke.

If nobody can answer those questions about your site, you are not being maintained regardless of what the invoice is called. That is worth checking before you renew, and it is a reasonable thing to ask us or anyone else.

Two questions before you sign a build

Ask what the site is built on and when those components reach end of life. A builder who cannot answer that in a sentence has not thought about the second year of your website's life.

Then ask what happens when something expires and they are not around. The answer should involve you holding the accounts, which is the same principle that applies to everything else, and documentation somebody else could pick up.

If you have a site nobody has looked at since launch and you would like to know what is close to expiring, book a strategy call. It is a quick audit, and finding out in advance is considerably cheaper than finding out from a customer who got a browser warning.