It’s hard to say exactly what the shelf-life of a website should be – their longevity depends entirely on who built it, and what you use it for.
Still, you usually know when it’s time for a new one. If frustrations are mounting and performance is dropping, the obvious answer is to look at a refresh.
But when budgets are tight in the arts and culture sector, and funding opportunities are even tighter, spending thousands for a new website is unlikely to be on the cards.
That’s when effective maintenance becomes all the more important – the right approach to ongoing development and support can breathe new life into an old site, and make it fit-for-purpose for a few more years.
We’ve compiled a helpful list of tips and tools that can help you make the most of your existing site – our tried and tested approach to maintaining not just our websites, but sites that have been transferred to us for a bit of TLC.
Why proper WordPress maintenance matters
Websites designed for theatres, museums, or any busy venue are always going to be complex web applications because of their ticketing integrations, donation tools, and membership functions.
As well as seeking information, the users coming to a theatre or museum website are often visiting the site to purchase tickets for presales, season launches and exhibition openings, often in large numbers when compared to your daily website traffic. With such high demand comes a small window for error, so you’ll need to be prepared for these big events.
This is true for any CMS platform, but WordPress in particular can require some extra vigilance. WordPress powers over 43% of all websites in the internet, which means it is statistically the most targeted CMS in the world by cybercriminals. Partially by weight of numbers, but also because the ubiquity of WordPress means its as popular with amateur devs as it is with professionals.
The core software of WordPress itself is highly secure – the majority of issues and vulnerabilities come from outdated third-party plugins and themes which less experienced developers tend to use, and which hackers can target. This just highlights the importance of regular maintenance to avoid your arts and culture organisation from being targeted.
How to protect your theatre or museum website from security breaches
DDoS attacks
A Distributed Denial-of-Service attack, or DDoS attacks, are a malicious attempt to disrupt the normal traffic of a server or website. Automated floods of dodgy traffic are designed to overwhelm the server and take your site offline. Unless it’s spotted early and blocked, it can be really hard to get things back online. The cybercriminals running these coordinated attacks are clever – they can change IP addresses and methods of attack at will, so it’s best to use a combination of tools at your disposal to combat these attacks.
To avoid DDoS attacks, you can use Cloudflare WAF and DDoS mitigation, which absorbs attack traffic before it reaches your server. Similar to the security in your venue, using these handy tools is like having a security guard at the front of house; they’re the first line of defence and will spot any issues before they happen.
According to data from early 2026, approximately 71% of WordPress sites do not use a dedicated Content Delivery Network (CDN), often relying solely on their host’s server or built-in caching plugins. Without a dedicated server, your hosting should still have some form of hardware firewall, which will block most things, but the most secure approach is to have multiple layers of security and protection.
Server-level malware protection
Occasionally, some threats are already in your WordPress application layer without you knowing it. Using a tool like Imunify360, which scans for malware and suspicious file changes across the server, can help avoid any issues. This level of security is similar to having someone watching your CCTV in the control room; they can spot any suspicious activity and alert the wider team before it becomes an issue.
Penetration testing
Penetration testing is an expert audit of your security systems, where a trusted individual or team runs an authorised attack on your server or website to check for any breaches and suggest areas to secure. Annual CREST-certified pen testing provides documented evidence for funders and procurement processes, and shows data protection accountability. This is generally quite expensive to carry out, often costing upwards of £3,000 for a test, but it might be something your agency or hosting company can do for you. Often, they will have done penetration testing on other applications within the same setup and infrastructure of your site, and if that’s carried out annually, then that is a good step towards compliance.
Login breaches
Hackers will use credential stuffing and general password guessing using bots and leaked passwords from other services to gain access to your website and customer data. To avoid this happening, it’s important to enforce multi-factor authentication (MFA or 2FA) on all admin area accounts to keep your information secure, and never share or allow a visitor to use your login details. Tools like Wordfence monitor login attempts, rate-limit failures, and enforce role-based permissions for your team so you can easily see if there is a login breach, where it came from, and which account was compromised.
Plugin vulnerabilities
The most common route into a WordPress site is through outdated plugins. Other tools exist to monitor this, but we recommend using Patchstack, which tracks installed plugins against a live vulnerability database to alert you to any issues. Virtual patches block known exploits, often 48 hours before an official fix is released. If you’re not using this type of tool, it’s important to keep on top of using the latest plugin versions. You can set all plugins to auto-update if you like, but it’s not recommended, as some updates can break other plugins or disable website functions if the version isn’t fully stable or tested, so we generally like to update plugins manually.
WordPress User and Plugin audits: The maintenance tasks that marketing teams overlook
User audits
Arts organisations often accumulate accounts over time from ex-staff, freelancers, agency partners and volunteers. You can run a quarterly audit of who has access and at what role level, and remove accounts for anyone who has left your organisation or no longer needs access. Installing 2FA and getting your team to install the Authy app or similar provides a much more secure layer than just using a username and password to log in.
Plugin audits
It’s best practice to review all of your installed plugins at least twice a year and remove anything you no longer need, ones that are no longer maintained, or are duplicating other functionality. Fewer active plugins = fewer vulnerabilities and a faster site!
Managing Traffic Spikes: Keeping your site up during on-sales
Season launches and presales can see your website traffic spike from a few hits to hundreds of times the normal load in seconds, with a mass of people descending on your site all at once. Standard shared hosting cannot always adapt to spikes and hits, but more flexible and modern-day cloud hosting using Cloudways on AWS, DigitalOcean, or Google Cloud can scale resources up and back down with a click of a button. Using these cloud servers allows you to have a incredibly high powered server spec for as little as a few hours, just when you need it.
Uptime monitoring
Helpful tools like UptimeRobot can checks your site at one-minute intervals, giving your support team the ability to act instantly if your site goes down for any reason. Monitoring across your website regularly means problems are caught even when nobody is actively on your website. The combination of using flexible hosting and active monitoring means capacity can be monitored and upgraded before the next big launch, allowing you to sell tickets for large-scale events with ease.
How to speed up theatre, museum and art gallery websites
The page speed on your booking and ticketing pages can directly impact conversion rates – any friction at the point of purchase can harm sales. If your potential customers see that the website has crashed, or they’re unable to secure tickets due to the page being too slow, they will simply abandon their carts.
Arts venue websites are content-heavy by nature, full of photos, videos and marketing content – but this creates a speed risk, and potentially, a full server! If you want to showcase a lot of images, we suggest using Imagify, which compresses and converts images to the highly efficient WebP format automatically on upload and in bulk across your media folder and theme images.
Other speed essentials:
- Serve assets (like images, some files and URLs) through a CDN so content is delivered from close to the user
- Implement lazy loading so offscreen images don’t delay the initial render
- Avoid bloated multipurpose plugins where a leaner build would do the job because, before you know it, you’ll have 50+ plugins, and things will fall over constantly
- Check Core Web Vitals scores regularly – speed drifts over time as content and plugins grow and change
GDPR and Data Retention: Review data sitting in your CMS
Managing your security isn’t just about preventing a breach; it’s about making sure that if a breach were to happen, the damage is as limited as possible.
WordPress sites often quietly gather personal data over time without anyone actively managing it, and this is a red flag.
Theatre and museum websites will often have multiple forms across different areas of your site, like contact forms, enquiry forms, and newsletter sign-ups. These forms and plugins will store submissions directly in the database, but do you know what form data is stored in your CMS? If not, you should find out.
Your privacy policy and data retention policy should cover how long this data is kept for and explain to customers why their data is being kept. Any old form entries should be reviewed regularly and deleted in line with your retention policy, as holding personal data longer than necessary is a huge GDPR risk.
There are other data sources to check, such as user-generated content and event booking data passed through integrations. If you use a ticketing platform such as Spektrix, Tessitura, Beacon or WooCommerce, you should ensure that any order history or comments are stored on secure databases and old data is deleted regularly.
Practical steps you can take
- Audit what data your plugins are storing and where
- Set a retention schedule and stick to it by deleting or anonymising old records regularly if you can
- Consider whether form submissions need to be stored in WordPress at all, or if can they be handled by a CRM widget or email platform instead
How much support time should a Theatre or Museum need for WordPress?
While they are really handy for support and alerting you to any issues, the tools mentioned above are not enough on their own. Someone should be reviewing and updating your website’s security and back end at least once a month, minimum. If you have a small team that may not be as technically savvy as they are creative, or you simply don’t have the time, digital agencies (like Splitpixel!) offer website support services for those in the arts and culture sector.
Having a support agreement with a web agency who are experienced at developing museum and theatre websites gives you peace of mind – you’ll be getting assistance from a team that knows your integrations, your seasonal patterns, and your WordPress setup. Without this help, you may end up having to do a lot of reactive emergency fixes after a breach or failure, which can end up costing more than the proactive support, and it takes up so much more of your time.
What to look for in a theatre and museum website support agency
If you’re shopping around for an agency to help with website maintenance, look for one that offers security monitoring and regular manual plugin updates. These are the key things you will likely need support with. Agencies will often put you on a retainer, where you pay monthly for support hours, but ask whether they can be banked or rolled over during quieter periods so you can use them during busier ones. This can also help if you need to change anything on your website, like a broken or incompatible plugin – you can opt to use these hours to change or fix it.
Another perk you may want to look out for is having direct access to the development team managing your website. Some agencies and support systems have a ticketing system where you have to wait until they are available to work on your fix, which could be a while. Being able to talk directly to the people who know your website in and out and can jump right on the fix can be invaluable.
Museum and theatre website maintenance essentials
To keep your website as up-to-date as possible and running smoothly for your audience, you should have the following in place:
- Flexible or scalable cloud hosting
- Web Application Firewall and or a Content Delivery Network
- Server malware protection
- Vulnerability monitoring
- Multi-factor authentication (MFA)
- Image optimisation
- Regular audits
- Annual penetration testing
If you’re looking for a dedicated arts and culture website support agency that ticks all the boxes, get in touch with our team today. We’re happy to answer any of your questions and offer support where we can!
If you have all of these set up already, then you’re in a good place! Maintaining a website for an arts and culture venue that has a lot of moving parts, both on the front and back end, is no easy feat, and there are agencies out there that can help.
