Most WordPress disasters aren’t sudden. The hacked site, the white screen after an update, the checkout that silently stopped working. The story is the same in almost every rescue we’ve done: the warning signs were visible for months; it’s just that nobody was watching.
Here are seven signs you can check yourself, today, in about ten minutes. No technical skills required!
1. You don’t know when your site was last backed up
Ask yourself one question: if my site disappeared right now, who would I call, and what would they restore? If the answer involves the word “probably,” you don’t have a backup; you have a hope. A real backup setup means daily copies, stored off your hosting account (if your host has a bad day, backups stored with them go down too), and the part that almost everyone skips, occasional test restores. A backup you’ve never restored is untested equipment you’re betting your business on.
2. The plugin update count keeps growing
Log in to your WordPress admin dashboard and look at the number badge next to “Plugins.” Five pending updates is a normal week. Fifteen-plus that have been sitting for months is update debt. Old plugins are the number one way WordPress sites get hacked, because every published update is also a public announcement of the hole it fixed. Attackers automate scanning for sites that haven’t been patched. The longer you wait, the bigger the version jump when you finally update, and big jumps are exactly when things break.
3. Your site was built by someone you can no longer reach
This might be the most common situation we see: the site works, but the person who built it has moved on, and nobody has the keys, or the knowledge. Nothing is wrong yet. But you’re one bad update, one expired plugin license, one hosting migration away from needing someone who understands the site, urgently, with no documentation. If this is you, get a technical audit before something breaks. Handover under calm conditions is cheap; handover during an outage is not!
4. Pages take more than three seconds to load
Test your site right now at pagespeed.web.dev. This is Google’s own free tool. If your mobile score is in the red, you’re paying for it twice: visitors leave (half of mobile users abandon pages that take over three seconds), and Google ranks you lower, because speed is a confirmed ranking factor. Slow WordPress sites are usually slow for boring, fixable reasons: oversized images, too many plugins, no caching, cheap hosting. An afternoon of engineering routinely cuts load times by more than half.
5. There’s no padlock or mixed-content warnings
Look at your address bar. If your site shows “Not secure” instead of a padlock, that’s visible to every visitor and every search engine. Even with SSL installed, half-migrated sites often load some images over the old insecure connection (“mixed content”), which browsers increasingly punish. This is a solved problem in 2026; there is absolutely no legitimate reason for a business site to have it.
6. You’ve never seen a maintenance report
If you’re paying someone for “maintenance,” when did you last see proof? A real maintenance service sends a monthly report: what was updated, what was backed up, what security events occurred, how the site is performing. If the answer to “what did I get for last month’s fee” is silence, you might be paying for a service that isn’t happening or is not complete. Invisible maintenance and no maintenance look identical, that is, until the day they don’t.
7. Your contact form goes to an inbox nobody checks or spam folder
Submit your own contact form right now. Did the email arrive? In the inbox, or spam? WordPress’s default email sending is notoriously unreliable! Form notifications silently vanish more often than anyone realizes. Every lost submission is a customer who tried to reach you, failed, and called your competitor instead. This one costs real revenue and is completely invisible from the outside.
What to do with this list
If you checked all seven and everything passed, well done! Your site is in better shape than most. If two or more failed, your site isn’t broken, but it’s drifting toward the expensive kind of problem.
That’s exactly what our free written audit is for: send us your URL, and within two business days you’ll get a plain-English review covering all of the above and more: what’s solid, what’s risky, and what fixing it would take. No obligation, no sales call unless you want one.