Most business owners know their website is getting old. Very few have ever seen the cost written down.
That is not negligence. A legacy website does not fail loudly. It does not send an invoice. It degrades quietly, in three separate places that rarely get discussed in the same conversation: the visitors who leave before the page finishes loading, the hours absorbed by maintenance that produces nothing, and a security surface that has grown considerably more dangerous in the last two years.
This article puts numbers to all three. The companion piece, what actually replaces it, covers the architecture.
A note on the numbers below: every figure is linked to its primary source. Some are industry-wide averages that will not map cleanly onto any single business. Where that is true, we say so.
Cost One: The Visitors Who Never See the Page
Speed is the easiest cost to measure and the most consistently underestimated.
Google and Deloitte studied 37 retail, travel, and luxury brands for Milliseconds Make Millions. A 0.1-second improvement in mobile load time raised retail conversion rates by 8.4% and average order value by 9.2%. Travel conversions rose 10.1%.
Read that interval again. One tenth of a second is below the threshold of conscious perception. Nobody in the study noticed the site was faster. They simply behaved differently.
The other side of the curve is steeper. Google and SOASTA’s modelling of real mobile sessions found that as load time moves from one second to three, the probability a visitor bounces rises 32%. At ten seconds, it is up 123%.
Two controlled results make the mechanism concrete:
| Business | Change made | Measured result |
|---|---|---|
| Vodafone Italy | 31% better LCP on an otherwise identical page | 8% more sales |
| Rakuten 24 | Passed all three Core Web Vitals | 33.1% higher conversion rate, 53.4% more revenue per visitor |
Vodafone’s is the more instructive of the two, because it was an A/B test between two pages that were visually and functionally identical. The only variable was speed.
Why old sites are slow in a way that resists fixing
A typical legacy CMS page load involves the server waking up, querying a database several times, assembling HTML through a theme layer, and then delivering a payload that triggers dozens of additional plugin scripts in the visitor’s browser.
You can buy faster hosting. You can install a caching plugin. Both help. Neither changes the fundamental sequence, which is why speed work on aging sites so often produces a modest improvement and then stalls.
As of the January 2026 CrUX field data, roughly 55.7% of web origins pass all three Core Web Vitals. The remainder are not broken. They are just paying this tax continuously without seeing the line item.
Cost Two: The Maintenance That Produces Nothing
Every plugin is a dependency on a third party’s release schedule, security practices, and continued existence.
The arithmetic gets uncomfortable quickly. A site running 25 plugins is running 25 independent codebases, each updating on its own timetable, each capable of conflicting with the others. The update that breaks your contact form arrives at 2 a.m. on a Saturday because that is when the automatic updater ran.
This is the cost that shows up as staff time rather than dollars, which is exactly why it escapes scrutiny. It is real regardless. Hours spent confirming that a plugin update did not break the booking form are hours that produced nothing a customer will ever see.
Worth stating plainly: none of this maintenance makes the website better. It keeps the website the same. That is the entire return.
Cost Three: The Security Exposure, Quantified
This is the section most owners have never seen numbers for.
Patchstack’s State of WordPress Security in 2026 catalogued the 2025 disclosure year:
- 11,334 new vulnerabilities disclosed across the WordPress ecosystem — a 42% increase over 2024
- 91% were found in plugins; 9% in themes
- 6 were found in WordPress core itself, all low priority
- High-severity vulnerabilities more than doubled, up 113%
- More high-severity vulnerabilities appeared in 2025 than in the previous two years combined
That third bullet deserves emphasis, because it reframes the problem. WordPress core is not the weak point. The core team’s security record is genuinely good. The exposure comes from the plugin ecosystem sitting on top of it — the very thing that makes the platform attractive in the first place.
Patchstack also found that premium plugins carried nearly three times as many zero-day vulnerabilities as free ones. Paying for a plugin is not the safeguard it is often assumed to be.
What an incident costs
Breach cost figures vary enormously by source and methodology, so treat these as a range rather than a forecast:
| Measure | Figure | Source |
|---|---|---|
| Reported US cybercrime losses, 2025 | $20.9 billion (+26% YoY) | FBI IC3 Internet Crime Report |
| Typical SMB incident range | $120,000 – $1.24 million | Verizon DBIR 2025 |
| Downtime | ~$53,000 per hour | VikingCloud 2025 |
The per-hour downtime figure is an average across business types and will overstate the cost for a small service business considerably. We include it because the shape of the number matters more than its precision: downtime costs accrue by the hour, while recovery takes days.
For most small businesses reading this, the realistic exposure is not a headline breach. It is a defaced site, an SEO penalty from injected spam links, a cleanup bill, and a week of your web presence being untrustworthy. That is survivable. It is also entirely avoidable.
The Part That Is Genuinely Nobody’s Fault
It is worth being fair to the platform here.
WordPress was designed in an era when the alternative was hand-editing HTML files over FTP. It democratised web publishing for millions of businesses, and it did so brilliantly. A business owner who chose WordPress in 2015 made a sound decision with the information available.
What changed is the threat environment and the performance floor. Automated scanners now probe for newly disclosed plugin vulnerabilities within hours of publication. Customers now form an impression of your business from a page that either appears instantly or does not.
The decision was correct then. The question is only whether it is still correct now.
How to Assess Your Own Site
Three checks, no vendor required:
- Run your homepage through PageSpeed Insights. Look at the field data section, which reflects real visitors rather than a lab simulation. If Core Web Vitals shows a failure, that is the speed tax made visible.
- Count your active plugins. Log into the admin panel and look at the number. Anything above fifteen is a maintenance surface worth examining; above thirty is worth examining urgently.
- Check your last successful backup restore. Not the last backup — the last time someone confirmed a backup could actually be restored. These are different things, and the gap between them is where disasters live.
If all three come back clean, your site is in better shape than most and this article does not apply to you. That is a legitimate outcome.
The Honest Framing
An aging website is not an emergency. Businesses run on them for years.
But the costs are real, they compound, and they are invisible precisely because they never arrive as a single bill. A slow site loses a fraction of its visitors continuously. A plugin-heavy site absorbs maintenance hours indefinitely. An unpatched site carries a risk that stays at zero right up until it does not.
The companion piece covers what a modern replacement actually is — and, more usefully, what it removes.
If you would like a straight assessment of what your current site is costing on these three axes, we will run the numbers and tell you. Including if the answer is that it is holding up fine.