Website maintenance in 2026 is the ongoing work of keeping a live site secure, legal, and functional: patching the software it runs on, updating plugins and themes, meeting accessibility law, and holding page performance steady. It affects everyone who operates a public website, but the pressure is sharpest for WordPress and Drupal owners, e-commerce stores selling into the EU, and anyone still running outdated PHP. The evidence this year points to two priorities that outrank the rest: applying security updates promptly and meeting accessibility requirements. Speed matters, but the documented facts suggest it deserves less of your budget than either of those.
Table of Contents
- The PHP deadline that forces action
- Why plugin and theme updates are the real workload
- Who the European Accessibility Act affects
- Where performance fits — and where it doesn't
- A practical 2026 maintenance order
- Frequently Asked Questions
The PHP deadline that forces action
PHP is the server-side language that runs WordPress, Drupal, and most of the web. Its version support has firm expiry dates, and two of them land right now. According to php.net's supported-versions page, PHP 8.1 reached end-of-life on 31 December 2025 and receives no further security updates at all. That makes any site still on 8.1 unpatched against new flaws — a concrete risk, not a theoretical one, given how many hosts default to older PHP.
PHP 8.2 is close behind: it now gets only critical security patches and reaches full end-of-life on 31 December 2026. The practical move is to plan an upgrade to PHP 8.4 or 8.5, which php.net lists as supported through 2028 and 2029 respectively. Test on a staging copy first, because a major PHP jump can break older plugins or custom code. Your host's control panel usually offers a one-click switch once you have confirmed compatibility.
Why plugin and theme updates are the real workload
For wordpress sites, the recurring maintenance burden is not core updates — it is the plugins and themes bolted on top. The scale is easy to underestimate. In a single week ending 24 December 2025, SolidWP's vulnerability report recorded 150 newly disclosed WordPress-ecosystem vulnerabilities: 140 in plugins and 10 in themes. The danger is not that these bugs are unknown, but that fixes go unapplied.
SolidWP reports nearly 9 million exploit attempts against three critical plugin flaws in October 2025 alone — a full year after patches shipped. Attackers are betting on the gap between a fix being released and a site owner installing it. That gap has real victims. Early-2025 exploitation of the GutenKit and Hunk Companion plugin vulnerabilities compromised over 40,000 and 8,000 WordPress sites respectively, per SolidWP. The lesson is blunt: updates you postpone are the ones attackers use.
- Enable auto-updates for plugins and themes you trust, and review them weekly
- Remove deactivated plugins entirely — dormant code is still exploitable
- Watch a vulnerability feed so you can prioritize critical patches within days
- Keep offsite backups so a compromise is recoverable, not fatal
Who the European Accessibility Act affects
The European Accessibility Act (EAA) is EU law requiring digital services to be usable by people with disabilities. It took effect on 28 June 2025, and it reaches well beyond Europe. According to Kinsta's summary of the EAA, it applies to non-EU businesses that sell to EU consumers — so a US store shipping to Europe is covered. The standard is WCAG 2.1/2.2 Level AA, a technical checklist for accessible web content: sufficient color contrast, keyboard navigation, alt text, labeled forms, and more.
New content must comply now; Kinsta notes all existing content must comply by 28 June 2030. That later date is a runway, not permission to ignore it. There is one carve-out. The EAA exempts micro-enterprises — fewer than 10 employees and no more than €2 million in turnover or balance sheet — from the main obligations. If you are larger than that and sell to EU consumers, an accessibility audit belongs on your 2026 maintenance plan alongside security patching.
Where performance fits — and where it doesn't
Core Web Vitals are Google's measurable page-experience signals. Per Google Search Central, they are LCP (loading), CLS (visual stability), and INP (responsiveness). INP, where under 200ms counts as good, replaced First Input Delay as a Core Web Vital in March 2024. Performance is worth maintaining, but keep its ranking role in proportion.
Google uses these signals as a tiebreaker between comparable pages — not as a primary ranking factor. Google's own guidance is explicit that passing Core Web Vitals will not lift low-quality content over better content. That is a useful budgeting rule. Marginal speed gains sit below security and accessibility in priority, because a fast site that is unpatched or legally non-compliant is exposed in ways a slightly slower one is not. Fix the vitals that hurt real users — a layout that jumps, a button that lags — and stop chasing perfect scores.
A practical 2026 maintenance order
If you maintain a single site or a portfolio, sequence the work by risk rather than convenience. The costliest failures this year are an unpatched exploit and an accessibility complaint, not a mediocre performance grade.
Do the security and legal items on a calendar, not on inspiration. The exploit attempts SolidWP counted arrived a year after fixes existed — the sites that got hit were the ones running on "we'll update it later.".
- Check your PHP version today; schedule the move off 8.1 or 8.2 to 8.4/8.5
- Audit and update plugins and themes, then set a weekly patch cadence
- Run a WCAG 2.1/2.2 AA audit if you sell into the EU and aren't a micro-enterprise
- Confirm backups run and restore correctly before you change anything major
- Address only the Core Web Vitals that measurably affect real visitors
Frequently Asked Questions
Does the European Accessibility Act apply to a US-based website?
Yes, if you sell goods or services to EU consumers, per Kinsta's EAA summary — unless you qualify as a micro-enterprise with fewer than 10 employees and no more than €2M turnover or balance sheet.
My site runs PHP 8.1 and works fine. Is that a problem?
Yes. php.net lists PHP 8.1 as end-of-life since 31 December 2025, meaning no more security updates. Working today does not mean patched against new flaws.
Are WordPress core updates the main security risk?
No. SolidWP's December 2025 report attributed 140 of 150 weekly vulnerabilities to plugins and 10 to themes — the add-ons, not core, are the recurring burden.
You Might Also Like
- How to Verify Website Maintenance Claims in 2026: release notes and search documentation, Evidence, and Red Flags
- What Is New With Website Maintenance in August 2026? Latest release notes and search documentation and Key Takeaways
- Website Maintenance FAQ for August 2026: Source-Checked Answers to Common Questions
