Is your old website a liability?

Aging happens underneath, on published schedules

The software your site stands on has support calendars anyone can look up. PHP 7.4 stopped receiving security patches in November 2022. OpenSSL 1.1.1 ended in September 2023. A site running on ended components does not break on the anniversary; it just stops getting fixes while the list of known holes grows, and many servers advertise their exact versions to anyone who asks.

I recently reviewed several brand websites sharing one platform: a genuinely well-built content layer sitting on components years past end-of-life, zero of six standard security headers, no measurement anywhere, and a handful of silent defects nobody had noticed. Nothing looked wrong in a browser. Everything was findable in twenty minutes of instrument work.

The house-inspection way to think about it

You would not sell or insure a building on "it looks fine from the street." A website is the same class of asset: what matters is the wiring, and the wiring is inspectable. Accessibility is part of that inspection; gaps there are customer-losing and, in California especially, demand-letter bait. So are privacy pages that promise things the site does not do, and forms that collect data over yesterday's protections.

Repair or rebuild? Let the numbers decide

Old is not the same as bad, and rebuild is not the default. A Full Website Audit prices the question: every page, every check, severity-ranked, with a what-to-do column that separates the cheap fixes from the structural ones. When repair wins, you get that answer. When rebuild wins, you get the evidence that says so, and a build with published measurements to hold me to.

"But my site still gets calls." Then something is working, and the audit will say what, in writing, so any change protects it instead of guessing at it.