What does a website that hasn’t been updated for years cost?

A site that has not been updated for years breaks because of changes outside it, even though it has not changed itself: analytics data stops, content that does not open on a phone does not enter Google’s index, most AI crawlers cannot read text drawn with JavaScript, the server software falls out of security support, and the browser warns the visitor. Google does not say it demotes an old page for being old; the cost comes from these dated changes.

What does a site that is not updated cost the company?

It costs in seven places. Measurement: the old analytics tag has not collected data since 2023, and what visitors do is unknown. Visibility: content that does not open on a phone does not enter the index. AI: most crawlers cannot read text drawn with JavaScript. Security: software whose support has ended receives no patches for new vulnerabilities. What the visitor sees first: a browser warning at an address that does not redirect to HTTPS. Accuracy: an old address, an old certificate or a discontinued product can be carried into answers. Trust: broken links and outdated information are the buyer’s first clue as to whether the site is looked after.

Why does a site break when it has not changed?

Because the environment the site lives in changes on a schedule, and each change has a date. The table below lists the changes of the last three years and the next three years that directly affect a website.

The calendar that changes while the site does not, 2023–2029

1. 01July 1, 2023 · end of Universal Analytics data processing
2. 02July 5, 2024 · all sites crawled with the smartphone crawler only
3. 03July 1, 2025 · Cloudflare’s option to block AI crawlers
4. 04December 31, 2025 · last day of PHP 8.1 security support
5. 05March 15, 2026 · maximum certificate validity 200 days
6. 06September 22, 2026 · Chrome 154: a question before an HTTP page
7. 07December 31, 2026 · last day of PHP 8.2 security support
8. 08March 15, 2027 · maximum certificate validity 100 days
9. 09March 15, 2029 · maximum certificate validity 47 days

The nearest step on the list is PHP 8.2: its security support ends on December 31, 2026. Find out which PHP version your site runs on from your hosting panel or your developer; 8.3 and later are supported into 2027 and beyond.

How is visibility in Google lost?

Not through age but through access. Google does not say in any official source that it demotes pages because they are old or neglected. It says two things: it does not index every page, and for queries that call for freshness, newer content comes to the fore. The “Discovered – currently not indexed” and “Crawled – currently not indexed” rows in Search Console’s page indexing report show pages Google has found but not indexed; that is the first place to look.

On old sites, the real loss is on the phone. Since July 5, 2024, Google has crawled the remaining sites with its smartphone crawler only, and content that cannot be accessed on a phone at all can no longer be indexed. If a product table that opens on a desktop is hidden on a phone, or the menu does not work on a phone, that content does not exist for Google.

Why does it not appear in AI answers?

For two reasons. The first is reading: most major AI crawlers do not execute JavaScript; they download the file but do not run it, so they cannot see text drawn in the browser. A product list that arrives only through JavaScript is a blank page for these crawlers. The second is permission: a site that blocks OpenAI’s search crawler OAI-SearchBot is not shown in ChatGPT’s search answers; GPTBot, which crawls for training, is managed separately.

You may not even have given the permission yourself. Since 2025, Cloudflare has offered an option to block AI crawlers and can add a section it manages to robots.txt. In our own measurement of the top 500 .tr domains, the number of sites explicitly blocking GPTBot in robots.txt rose from 16 to 24 between October 7 and November 1, 2026, and most of the new blocks were in the section Cloudflare manages. The details are in the AI bots measurement.

You can test both yourself. Turn off JavaScript in your browser’s settings and reload your product page: if product names and technical data are still visible, crawlers are reading them too. Then add /robots.txt to the end of your site’s address: if there is a section starting with “BEGIN Cloudflare Managed content”, or GPTBot, ClaudeBot or OAI-SearchBot lines you did not write, check in your hosting and Cloudflare accounts who made which decision.

Do old pages carry wrong information into answers?

They can, but there is no study measuring this for brand websites. The broadest measurement is on news: the European Broadcasting Union’s 2025 study, led by the BBC with 22 public service broadcasters from 18 countries, examined more than 3,000 answers from four AI assistants in 14 languages; it found at least one significant issue in 45% of the answers and major accuracy issues, including outdated information and fabricated details, in 20%. Carrying this over to a manufacturer’s website is our inference: an old address, an expired certificate or a discontinued product left on the site can make its way from where it is read into an answer. The way to prevent this is not to leave outdated information on the site.

How big is the security risk?

On the server side, there is a measurable share. By our calculation from W3Techs data of November 10, 2026, about 46% of sites using PHP are on a version whose security support has ended. When support for PHP 8.2 ends on December 31, 2026, this share will rise to about 64%. An unsupported version means new vulnerabilities found in that version will not be patched.

On the application side, the risk is concentrated in plugins: according to Patchstack’s 2026 report, 91% of the 11,334 new vulnerabilities found in the WordPress ecosystem in 2025 were in plugins, and 46% of vulnerabilities were unpatched at the moment they were disclosed. The cost of a hacked site is not just repair: Google can show pages with security issues with a warning label in search results or with a full-page warning in the browser.

On the core side, the picture is better than assumed. WordPress officially supports only the latest version, but it also backports security fixes to all older branches back to 4.7. In W3Techs data, about a third of WordPress sites are on a major version older than 7; those on branches that receive no fixes at all are about 0.7%. The condition: a fix protects only if the latest minor release of that branch is installed. An old branch alone is not the problem; falling behind within the branch is.

What does the visitor see?

First, the address bar. Since Chrome 154, on desktop, the visitor is asked before an HTTP address that does not redirect to HTTPS is opened; the choice of a user who changed this setting earlier is kept. As certificate lifetimes shorten, a manually renewed certificate expiring also becomes more frequent; for an expired certificate, the browser shows a warning before opening the page. The details are in the “Not secure” warning guide.

Then the page itself. In credibility research, the look of the design, typos and broken links come up among the first clues of trust; these studies were done with consumers and the oldest dates from 2002, but a copyright year stuck at 2019 or an outdated announcement also gives a purchaser a first clue about whether the site is looked after.

How do you audit your own site in thirty minutes?

None of the twelve checks below needs a specialist tool; most are done from the browser, one from Search Console and one from the hosting panel.

1. Type your site’s http:// address into the address bar: does it go permanently to the https:// address?
2. Look at the certificate’s expiry date: how many days are left, and is renewal automatic?
3. Find out the server’s PHP version: is it 8.3 or later?
4. If you use a content management system, is the core on the latest release of its branch; are the plugins up to date?
5. Does the page source have an old analytics tag starting with “UA-” or a new one starting with “G-”?
6. Do the whole menu, the product table and the certificate record open on a phone?
7. Are there AI rules you did not write in your robots.txt file?
8. With JavaScript off, are product and certificate texts visible?
9. What is the latest update date in the sitemap?
10. How many pages are in the “not indexed” rows in Search Console?
11. What is the latest date and copyright year visible on the site?
12. Are the address, phone, certificate and product details correct today?

The visibility check tool runs some of the first eight checks for you.

Repair or rebuild?

Look at which layer the problem is in. Problems such as the certificate, PHP version, plugins, analytics tag and robots.txt are in the server and maintenance layer; most are repaired without rebuilding the site. Content that does not open on a phone, text drawn only with JavaScript, or product and certificate information that does not fit the template at all are problems of structure; here repair often costs more than rebuilding. If you decide to rebuild, do not move to the new site without redirecting the old addresses: the keeping rankings when rebuilding a site guide explains it step by step.

Let’s run the twelve checks on your site together, and write down in a preliminary review which ones call for repair and which for a rebuild.

Request a free preliminary review

For a site that shows your certificates as a record buyers can verify, B2B website builds and measures the certificate page, the product scope and the path to a quote together.

FREQUENTLY ASKED QUESTIONS

Does Google penalize old websites?

Google does not say it demotes pages because they are old or neglected. What lowers visibility is content that cannot be accessed on a phone, newer content coming to the fore for queries that call for freshness, and pages that are not indexed.

Do I have to have my site rebuilt to update it?

Often not. The certificate, server software, plugins and analytics tag are updated without rebuilding the site. A rebuild is needed if content does not open on a phone or the structure does not carry your information.

How do I find out my PHP version?

It is shown in your hosting panel’s PHP settings; if there is no panel, ask your developer or your hosting company. After December 31, 2026, the versions that receive security support are 8.3 and later.