Dark room setup with code displayed on PC monitors highlighting cybersecurity themes.

28 October 2026Updated 2 November 2026

What Developers Mean by Technical Debt on Your Website

“Every time we change something, something else breaks.” If a developer has ever said that about your website, or you’ve said it yourself, you’ve met technical debt. It’s the trade’s name for the shortcuts, quick fixes and leftovers that pile up on a site over the years. Each one made sense on the day. Add them together and every change takes longer, costs more and carries more risk than it should. Most of it can be paid down. Some of it can’t, and knowing which is which saves a lot of wasted money.

In brief

Technical debt is the cost of past shortcuts. You pay it back in slower, riskier changes.
On WordPress sites the usual culprits are old PHP, plugins nobody maintains any more and edits made straight into the theme.
WordPress’s free Site Health screen will flag some of it in a couple of minutes.
Tidy up first. Rebuild when the foundations themselves are the problem.

Why it’s called debt

The idea comes from money. A shortcut is a loan. You get something now, a feature live by Friday or a bug patched without anyone digging into the cause, and you pay it back later with interest. The interest is the extra time every future job takes because somebody has to work round the shortcut first.

A bit of debt is normal. Nobody builds a business website perfectly, and a quick fix to get a booking form working before a bank holiday weekend is often the right call. Trouble starts when nobody goes back. Picture a small hotel that adds a booking plugin, then a second one when the first stops talking to its room management system, then a scrap of custom code to hide the first one. Three years on, no one remembers why both are there. Nobody dares switch either of them off.

How shortcuts pile up on an ordinary site

It rarely comes from one big decision. It drips in. Someone installs a plugin to sort a one-off problem and it’s still sitting there five years later, deactivated but never deleted. A designer changes the footer by editing the theme’s own files, because that’s quicker than setting up a child theme. The freelancer who wrote your custom quote calculator moves on and leaves no notes. Meanwhile the server ticks along on whatever version of PHP it had at launch, because nothing’s gone wrong yet.

Those direct theme edits are a classic. Child themes exist so your customisations live separately and you can still take updates to the parent theme without losing them. Edit the parent instead and WordPress’s own theme handbook warns what can happen next time it updates. Your changes disappear. So people quietly stop updating the theme, and a theme that never updates soon falls out of step with everything else on the site. That’s debt earning interest.

Builders can add to the pile too, through layers of settings, add-ons and code for features a page isn’t even using. They don’t doom a site on their own, and our piece on whether page builders really slow a site down goes into where the weight actually comes from.

The signs you’re carrying it

You don’t need to read code to spot it. It shows up in how the site behaves and in what changes cost.

Small jobs come back with big quotes, or with a nervous “it might break something”.
Updates get skipped for months because the last one took the site down.
There are plugins on the list that nobody can explain.
The site still drags after the obvious speed fixes have been done.
Only one person really understands how it hangs together.

That last one can bite charities and community groups hard, where the site was built by a volunteer who’s since moved away. It can catch out a family-run accountancy practice too, if the site was a favour from a friend’s son. If several of these ring a bell, have a look at our list of warning signs that a website needs a full redesign as well.

Checking your own site in ten minutes

On a WordPress site, log in and go to Tools, then Site Health. The Status tab sorts its findings into critical issues, recommended improvements and passed tests. An out-of-date PHP version can turn up there as a critical issue. So can plugins waiting to be updated. The Info tab lists plugins and themes that are installed but switched off, and WordPress recommends removing inactive themes you’re not planning to use.

PHP deserves a proper look. It’s the programming language WordPress runs on, and the recommended version right now is 8.3 or greater. WordPress will still limp along on PHP 7.4 in legacy setups. Versions that old have reached end of life, though, and WordPress warns they may expose your site to security vulnerabilities. Even 8.2 is on borrowed time. The PHP project’s support table has its security fixes ending on 31 December 2026. Not an emergency today. A good reason to ask your host or developer what the upgrade plan is, mind.

Then look up each plugin on wordpress.org. If its page says it “hasn’t been tested with the latest 3 major releases of WordPress”, the directory is telling you it may no longer be maintained or supported. That doesn’t prove it’s broken. It’s a nudge to find a replacement before it becomes one.

Why it matters beyond the irritation

Security is the big one. When nobody’s issuing security updates for a piece of software any more, holes get found and stay open. Attackers know it. The NCSC goes as far as saying the only fully effective fix for an obsolete product is to stop using it, and to use end-of-support dates to plan a move to supported alternatives. They’re talking about software and devices in general. An abandoned plugin sitting on your website fits the bill all the same.

Speed suffers too. Old code, unused plugins and stacked scripts all add weight, and our guide to website speed and performance explains how that shows up in Google’s Core Web Vitals. Hosting can be part of the story as well. A bargain plan that’s stuck on old server software is debt of a different kind, which our comparison of cheap and managed hosting for business sites picks apart.

And then there’s plain cost. An online shop that wants to add a new delivery option shouldn’t need a developer to spend half a day working out why the checkout has three different shipping plugins.

Refactor or rebuild?

Developers use ‘refactoring’ to mean tidying the site you’ve got without changing what visitors see. Unused plugins get deleted, which WordPress’s hardening guidance tells you to do anyway. Theme edits move into a child theme where updates can’t wipe them, and abandoned plugins make way for ones that are still looked after. The PHP upgrade gets tried on a test copy of the site before anyone goes near the live one. Somebody finally writes down what the custom bits do. Back up before any of it, and check the backup is actually there and usable, because WordPress’s own upgrade instructions call that step essential.

For plenty of sites that’s a tidy-up job rather than a new website. A rebuild starts to make sense when the foundations are the problem. The theme’s maker has given up on it and it won’t update without wrecking your layouts. The site’s tied to a platform or builder you want to leave. Or the business has simply changed shape. Think of a manufacturer whose product catalogue was bolted onto a five-page brochure site and now runs to hundreds of items. If the clean-up quote is creeping towards the price of a fresh build and you’d still be left on shaky foundations, redesigning the website properly is usually the better spend. Rebuild quote come back proposing a headless setup? Find out what going headless means for a smaller business first.

Stopping it creeping back

Debt comes back if nobody’s watching. The NCSC suggests staggering updates and having a way to roll back if one goes wrong, which works just as well for a website as an office network. Keep a short note of what each plugin is for. Remove before you add. Review the plugin list and the PHP version a couple of times a year rather than waiting for something to break.

Plenty of owners would rather not do this themselves, which is what a website care plan is for. Our website security and maintenance guide covers the routine in more depth.

Getting a straight answer about your site

Not sure whether yours needs a tidy-up or a fresh start? We’ll look under the bonnet and tell you plainly, and if it does need rebuilding, our web design and development work starts with clean foundations that are easy to keep up to date. Get in touch with the address of the site that’s giving you grief.

Keep reading

Sources

Scott Woodfield

Founder of TWA. Scott has spent 17 years in web design and digital marketing, nine of them inside agencies and eight running his own practice. He plans, designs and builds the sites himself, from single landing pages to full ecommerce builds, and he's the person you speak to when you call.

Let’s have a chat