A while back, a business asked us to take over their website — a neglected WordPress site that had been put up once and then left to fend for itself for years. The request was simple: “can you host this and keep an eye on it?” It still loaded, so on the surface everything seemed fine. It wasn’t. What we found is a good illustration of why we don’t just move a site onto our servers — we adopt it. Here’s the whole story, anonymized down to “a small in-home care provider” because we don’t put client names on our site.
“Still loads” hides a lot
The most dangerous kind of neglected site is the one that looks okay. It answers when you visit, the homepage appears, nothing’s obviously on fire — so nobody worries. But a website with no one tending it doesn’t fail loudly. It quietly falls behind on updates, its defenses lapse, and it sits in the open until an automated attacker finds it. This one had been in that state for a long time.
So before moving anything, we did what we do with every site that joins: we opened it up and looked properly. That audit is where the real picture came out.
What we found
It was the classic autopilot-site inventory — a pile of small problems that together make a serious one:
- Everything out of date. WordPress itself, plugins, and the theme were all behind, some badly. Each missed update is a documented door.
- Premium licenses expired. Paid plugins and a premium theme had stopped getting security updates when their licenses lapsed — still running, no longer protected.
- No real backup. Nothing off-site, nothing you’d trust to restore from on a bad day.
- Doors left open. Login names easy for attackers to look up, the usual weak spots open to probing, and an uploads folder that could run code — the precise things bots scan for around the clock.
- Email going to spam. No sender authentication, so the site’s own mail often didn’t arrive.
- Slow for no reason. Heavy, unoptimized images and an outdated database setup dragging the whole thing down.
To be clear, this site hadn’t been dramatically hacked. But it was one out-of-date plugin away from it. If you want to see what the same conditions look like once an attacker has walked through them, we cover it in how to fix a hacked WordPress site — the point being that prevention is a much better place to stand.
What “adopting” it meant
We didn’t copy the neglected site to a faster server and call it managed. We brought it home properly:
- Restored it clean. We built a fresh copy on our platform, verified it working, and switched over with zero downtime — so what went live was healthy, not the old mess relocated.
- Closed every open door. A layered firewall and a live list of known attackers stop bad traffic before it reaches the site, and breached-password login defense guards the login. We shut off the ways attackers look for login names and weak spots, locked the uploads folder so it can’t run code, ran a full malware scan and cleanup, blocked AI bots that copy site content, and put the site behind a fast global network.
- Fixed what was broken. Reconnected the premium licenses so they get security fixes again, brought everything up to date, trimmed the dead-weight plugins, and set up the site’s email so it’s trusted and actually reaches inboxes.
- Sped it up. Optimized images to modern, lighter picture formats, tuned the speed settings, made the site’s database sturdier, and set HTTPS to auto-renew.
- Built the safety net it never had. Backups running locally and to off-site copies locked for 90 days against changes or deletion, monitored — the standard we explain in WordPress backup best practices — plus uptime monitoring, and verified checks after every update so updating never breaks the site.
What changed — and what didn’t
From the owner’s seat, almost nothing changed, and that’s the win. The site looks the same, loads faster, and its email arrives. Mostly, they just stopped having to think about it.
Underneath, everything changed. Since the site came under our care, a steady stream of malicious traffic has been aimed at it — password guessing, automated hunts for weak spots, bots hunting for the exact holes we’d already closed — and it’s being stopped out front before it reaches the site at all. The owner never sees those attempts. There’s no 2am outage call, because the paths the attackers were counting on aren’t there anymore.
Signs your own site might be neglected
Most neglected sites don’t announce themselves, so here’s a quick self-check. If more than one of these is true, your website is probably running on borrowed time:
- You can’t remember the last time it was updated. If nobody’s applying WordPress, plugin, and theme updates on a schedule, they’re not being applied.
- You’re not sure a backup exists. “The host probably has one” is not a backup you can count on — especially if it lives on the same server as the site.
- A premium plugin or theme is nagging about an expired license. That usually means it stopped getting security fixes some time ago.
- Your site’s emails don’t arrive. Contact-form messages and receipts landing in spam is often a sign email authentication was never set up.
- Nobody’s job is the website. This is the real one. A site with no owner drifts into every problem above on its own.
None of these are emergencies on their own. Together, they’re the profile of a site that’s one bad day away from a problem — and every one of them is something onboarding fixes.
Why we tell this story
Because “just host it” almost always turns into more than hosting, and we think the fix for a neglected site should be included, not sold back as a rescue package. It is. Every site that joins gets this same adoption — moved, hardened, repaired, sped up, backed up, and watched — as standard onboarding, at no extra cost.
If that describes a site you’re responsible for — loading fine, cared for by no one in particular — it’s exactly the kind of thing we take on. Have a look at our managed WordPress and WooCommerce plans, and let us adopt yours.