There’s a category of website problem that shares an uncomfortable characteristic: you don’t see it until it’s too late. The expired SSL, the backup that was never configured, the out-of-date plugin with a known vulnerability. Nobody checks them because they don’t cause trouble while they’re working.
By the time they stop working, the damage is done.
SSL: not optional, it’s the floor
The SSL certificate is what turns http:// into https://. It ensures the connection between the visitor’s browser and the server is encrypted. Since 2018, Google has marked sites without SSL as “Not secure” in Chrome — and that appears immediately before the domain, visible to every visitor.
The most common problem isn’t lacking SSL — most modern hosting includes it. The problem is having no system that renews the certificate automatically. SSL certificates are valid for 90 days or a year depending on the type. When they expire, the site shows a security warning that blocks access for most users.
For a B2B company using its site as a commercial tool, that kind of interruption isn’t just technical — it’s reputational.
What to verify:
- That the site uses HTTPS on every page, including internal ones
- That the certificate has automatic renewal configured
- That there’s no mixed content (images or scripts loading over HTTP inside an HTTPS site)
Backups: the system nobody configures until they need it
A backup is a copy of the site’s state that allows it to be restored if something goes wrong. Things go wrong for several reasons: an attack, an update that breaks something, human error while editing, a server problem.
The reality on many corporate sites: there are no automated backups, or backups exist but nobody has tested them to confirm they work.
A backup that can’t be restored isn’t a backup.
What to have in order:
- Automated backups on a defined frequency (daily for active sites, weekly at minimum for more static ones)
- Backup storage somewhere other than the main server
- A restore test at least once a year to verify the process works
Updates: the technical debt that accumulates in silence
Content management systems (WordPress and similar) and their plugins update constantly, partly for functional reasons and partly for security fixes. Every known vulnerability in an out-of-date plugin is a potential way in.
The typical cycle on sites without active maintenance: the site gets installed, the first months of hosting get paid, and the content management system is never touched again. After a year there are dozens of pending updates — among them, probably, some that patch vulnerabilities already being actively exploited on other sites.
The most common result isn’t a spectacular attack. It’s a site that starts showing strange content, redirects to spam pages, or is used to send junk mail from the server. All of it without the site owner noticing immediately.
What’s needed:
- A defined process for applying updates regularly, with a backup beforehand
- Periodic review of server logs to detect anomalous activity
- The minimum necessary plugins — every additional plugin is another potential attack surface
Server performance: slow isn’t just inconvenient
Server response time directly affects SEO and the visitor’s experience. Google measures it as TTFB (Time to First Byte). A slow server, saturated shared hosting, or a configuration without caching can make a well-built site perform badly in search.
For B2B corporate sites depending on organic search to generate enquiries, that has a direct cost.
Warning signs:
- Load times over 3 seconds on mobile devices
- A low PageSpeed Insights score in the server category
- Shared hosting plans with no ability to scale
The pattern behind these problems
What expired SSL, missing backups, out-of-date plugins and a slow server have in common is that none of them raises a visible alert until the damage has already happened. There’s no notification saying “your site is at risk”. It simply happens.
Active ongoing support and monitoring exists precisely to watch these points before they become problems. It isn’t a luxury service — it’s the minimum any company should have to protect its digital asset.
PTW’s support plan includes SSL monitoring, verified backups, managed updates and periodic performance review. If you don’t know your site’s current state on any of these points, that is exactly the diagnostic to run first.