Why Websites Crash: The Seven Ways Sites Die

When a site goes down, the owner almost always says the same sentence: "It just stopped working." It's an honest sentence, and it's never true. Websites don't just stop. After twenty-seven years of repair calls, every crash we've ever billed sorts into seven families — and knowing the seven turns "it just stopped" into "ah, it's probably that one."

1. Something expired

The calendar kills more websites than hackers do. Domains expire because the renewal email went to an address nobody reads. SSL certificates lapse and browsers greet every visitor with a security warning. The credit card on file at the host expires, the invoice fails quietly, and thirty days later the hosting does too. None of this is technical — it's clerical, which is what makes it both the most embarrassing family and the easiest to prevent: auto-renew everything, and put the expiration dates on a calendar a human actually looks at.

2. An update went wrong

Updates are good. Skipping them is how sites get hacked. But updates fail mid-flight, new versions collide with old plugins, and a host flipping the PHP version can snap a decade of accumulated shortcuts in one night. The prevention isn't avoiding updates — it's updating deliberately: backup first, then update, then run the ten-minute smoke test. Breakage you catch in minute one is an errand; breakage a customer reports in week three is a crisis.

3. The site ran out of something

Memory, processes, database connections, disk. Every hosting plan has ceilings, and sites grow toward them — more plugins, more traffic, bigger images — until one busy afternoon the site hits its head. The cruel joke is timing: resource crashes arrive precisely when traffic peaks, which is precisely when you least want to be down. If your site slows before it dies, or dies only when business is good, this is your family.

4. Somebody broke in

A hacked site may crash, but the nastier versions don't — they redirect your visitors, host spam in your basement, and get you quietly removed from Google while the homepage looks fine. Nearly every break-in walks through one of two doors: outdated software with a known hole, or a stolen password. Which means nearly every break-in is prevented the same way: update on schedule, use real passwords with two-factor, and skip the pirated "premium" themes that come with malware pre-installed.

5. A human did something

DNS changes made confidently and wrongly. The folder that "wasn't important." The migration attempted on a Friday afternoon. Human error is the family nobody budgets for because everyone assumes it happens to other humans. Two habits neutralize most of it: change one thing at a time (so you know what to undo), and back up before you touch anything (so you can undo it).

6. The host had a bad day

Sometimes it genuinely is them: hardware dies, a datacenter loses power, a big provider takes a chunk of the internet down with it — we wrote up what those mornings teach. And some hosts have quirks that manufacture outages all their own, which is why we keep host-specific playbooks. Your move here is knowing whose outage it is before you "fix" anything — the down checker answers that in five seconds — and judging hosts by how rarely you have to think about them.

7. Silent rot

The seventh family is the slowest and the most common of all: nothing dramatic happens, ever, until it does. Software ages, deprecation warnings pile up unread, the theme's developer moves on, and the site becomes a museum of borrowed time — until one routine change, anywhere in the stack, finds the weak joint. Rot doesn't announce itself; it has to be looked for. That's the case for an occasional professional once-over — or at minimum our free health check, which grades the visible symptoms in twenty seconds.

The uncomfortable arithmetic

Notice what six of the seven families have in common: they're preventable, and the prevention is cheap — a calendar, a backup habit, a ten-minute checklist, real passwords, updates on schedule. The seventh (the host's genuinely bad day) is rare and survivable. Which means most downtime isn't bad luck. It's deferred maintenance, presenting its invoice at the worst possible moment, with interest.

If the invoice just arrived — site down, customers bouncing — skip the reading and take the emergency lane: stabilize today, flat quote in writing, and then we'll fix the family that caused it so you don't meet it twice.