Why this actually matters
A website that looks or behaves like it hasn’t been touched in years costs you customers before they ever pick up the phone. In a September 2024 survey of 500 U.S. consumers, 75% said they’d skipped an online purchase because a website looked outdated or unprofessional. The same survey found 93% of respondents had security concerns when a site looked poorly maintained, and 71% said they could spot a DIY or neglected website within seconds.
That last number lines up with older research on how fast people judge a site in the first place. Studies on first impressions have found that users form an opinion about a website’s design in as little as 50 milliseconds, long before they’ve read a word of your content. A separate study on health websites cited in that same research found that 94% of what made people distrust a site came down to design, not the actual information on the page. Stanford’s web credibility research puts a number on it too: 46.1% of people judge a site’s credibility based on visual design alone.
None of this means you need a redesign every year. It means the visible parts of your site, the ones a first-time visitor actually sees, can’t look frozen in 2018.
The part nobody thinks about: security updates
If your site runs on WordPress, which most small business sites in Vancouver do, “updating your website” isn’t just a content and design question. It’s a security one, and it’s the update category with the least room for procrastination.
Patchstack’s 2026 State of WordPress Security report found a 42% year-over-year increase in newly discovered WordPress vulnerabilities, with 11,334 new ones identified in 2025 alone. Plugins accounted for 91% of those vulnerabilities. WordPress core itself had only six, all low-risk. The same report notes that heavily targeted vulnerabilities are often exploited within about five hours of being publicly disclosed, which is a much smaller window than most business owners assume they have to react.
Separately, roughly 48% of WordPress sites run on a version of PHP that no longer receives active security patches, and a small but real percentage are still running WordPress core versions from years ago. Every outdated plugin, theme, or core file sitting on your server is a door somebody else already knows how to open.
This is the one category where “if it’s not broken, don’t touch it” is the wrong instinct. Plugins and core software should be updated as patches are released, ideally within days, not left for the next redesign.
What Google actually thinks about “fresh” content
There’s a persistent myth that Google rewards any site that publishes or edits something constantly, regardless of whether the changes matter. That’s not quite true. When directly asked whether Google favors freshly updated content, Google’s John Mueller has said no, and pushed back on the idea of updating dates purely as an SEO tactic, saying flatly that “SEO hacks don’t make a site great.”
What Google’s own documentation does say is more specific: freshness matters for certain kinds of queries, like recent events, trending topics, and things that recur regularly, not for content in general. In other words, updating your blog post about tax filing deadlines every year matters. Updating your “About Us” page every month for the sake of it doesn’t move the needle.
The practical takeaway: update content when the information has actually changed, gone stale, or stopped answering the question people are searching for. Don’t update it just to trigger a “last modified” date.
A realistic update schedule
Different parts of a small business website age at different speeds. Here’s roughly how I’d prioritize it for a typical Vancouver small business site:
- WordPress core, plugins, and themes: As patches are released, ideally within a few days of each release. This is the non-negotiable one.
- Pricing and service details: Whenever they change. Nothing erodes trust faster than a quote request that doesn’t match the number on the page.
- Homepage and top service pages: A light review every 3 to 6 months. Check that the offer, the photos, and the call to action still reflect what the business actually does today.
- Blog content tied to costs, tools, or “best of” comparisons: Every 6 to 12 months. This kind of content ages the fastest because prices, tools, and platforms change underneath it.
- Testimonials and portfolio work: Add new ones as they come in, and prune anything that’s more than a couple of years old if it no longer represents your current work.
- Full design refresh: Every 2 to 4 years, unless something specific breaks sooner, like the site failing on mobile or a core plugin getting discontinued.
- Backups: Automated and continuous, not something you think about once a year. This isn’t really an “update,” but it’s the thing that makes every other update on this list safe to do.
Signs your website is overdue, right now
A few concrete signs it’s time to stop deferring:
- Your site takes more than a couple of seconds to load. Mobile traffic now makes up more than half of all web traffic, and 53% of mobile users abandon a page that takes longer than three seconds to load, with each additional second of delay pushing bounce rates up further.
- You’re getting update notifications in your WordPress dashboard that you’ve been dismissing for weeks.
- Your pricing, hours, or service area on the site don’t match reality anymore.
- The last testimonial or portfolio piece on the site is from a project you can barely remember.
- You wince a little when you send someone your own website link.
If two or more of those are true, that’s your answer. Not “redesign everything,” just start.
Frequently asked questions
How often should a small business website be updated?
It depends on the content type. Security updates should happen within days of a patch release. Pricing and service information should be updated as soon as it changes. Homepage and blog content benefit from a review every 3 to 12 months. A full redesign is usually only necessary every 2 to 4 years.
Does updating my website help my Google ranking?
Only when the update actually improves the content, whether that’s more accurate information, better answers to what people are searching for, or fixing something broken. Google has said publicly it doesn’t reward content simply for being edited or republished with a new date.
What happens if I don’t update my WordPress plugins?
You leave known security vulnerabilities open. Most newly disclosed WordPress vulnerabilities come from plugins, not WordPress core, and some are exploited within hours of being publicly disclosed. Outdated plugins are one of the most common ways small business sites get hacked.
