{"id":216,"slug":"research-brief-built-to-last","title":"Research brief: Built to Last — why most SMB sites rebuild every 3-4 years (piece 5 of 15)","kind":"reference","scope":"business","status":"current","audiences":["kevin","claude-code","smb-owner","candid-team"],"topics":["agency-methodology","security-vulnerabilities","accessibility","longevity-architecture"],"reference_body":"**Status:** Research material — not a finished article. Compiled May 2026.\n\n## Thesis\n\nMost SMB websites get rebuilt every 2-4 years (Orbit Media: average across the Inc 5000 is **2 years 4 months**). Orbit's own client base — sites under continuous care — averages **6 years 4 months** between rebuilds. **Lifespan is a function of architecture and maintenance, not a fixed property of websites.**\n\nThe argument is **not** \"never rebuild.\" It is \"build so the rebuild is a choice driven by business strategy, not a forced move driven by accumulated debt.\"\n\n## What kills sites in 3-4 years\n\n1. **Plugin abandonment + vulnerabilities.** 96% of WP vulns in 2024 were in plugins; 1,614 plugins removed from the .org repo for unpatched issues; 35% of 2024 vulns still unpatched in 2025.\n2. **Performance decay.** Median desktop page = 2.56 MB and rising YoY; only 40-59% of mobile pages pass LCP.\n3. **Accessibility lawsuits.** 5,000+ ADA filings in 2025; EAA enforceable since June 28, 2025; 95% of sites fail basic WCAG; 40% of new ADA filings are pro se (AI-assisted).\n4. **Page-builder lock-in.** Divi 4 → 5 is a one-way migration; Elementor pricing restructures force decisions; Bricks RCE shows builders are attack surface.\n5. **Platform decay (Doctorow).** Squarespace acquires Google Domains; Shopify sunsets checkout.liquid; WP Engine vs Automattic. Platforms are M&A and policy inventory.\n6. **Content decay + link rot.** Ahrefs 14B-page study: **96.55% of pages get zero Google traffic**. Zittrain: 50% of Supreme Court citation URLs suffer reference rot.\n\n## What the survivors do differently\n\nDaring Fireball (since 2002), Berkshire Hathaway (since 1997, 198 KB pages), Craigslist, Pinboard, GOV.UK Design System, Stack Overflow — see [[longevity-named-examples-2026]] for the catalogue. Common pattern: **content separated from presentation, minimal dependencies, URL stability as a design principle, boring architecture as a feature.**\n\n## Honest caveats\n\n- The recycled \"average website lifespan = 2y7mo\" stat is unverified at primary source (HubSpot citation could not be located).\n- No primary surveyed dataset of Canadian SMB rebuild cycles exists.\n- The 10-year cost model (Scenario A: rebuild every 3 years ~$115k-$185k vs Scenario B: foundation-first ~$235k-$260k) is **directionally correct but ignores SEO opportunity cost** of 3× 523-day recovery curves in Scenario A.\n- Some rebuilds are legitimately driven by business pivots, capability ceiling growth, or compliance forcing functions — not all rebuilding is decay-driven.","rationale_body":"This brief is the longevity counter-argument to the agency \"rebuild every 3 years\" default. Pairs with brief 4 (Owning Your Stack) on platform lock-in and brief 10 (Page Builders) on the specific architectural debt page builders impose.","metadata":null,"links":{"outgoing":[{"slug":"orbit-media-website-lifespan-2y4mo-vs-6y4mo","title":"Orbit Media: average website lifespan across Inc 5000 is 2y4mo; under continuous care, 6y4mo","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"patchstack-2024-vuln-disclosure-4166-96pct-plugins","title":"Patchstack 2024: 4,166 new vulnerabilities, 96% in plugins, 4% in themes, only 7 in core","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"patchstack-1614-plugins-removed-2024","title":"Patchstack 2024: 1,614 plugins and themes removed from .org repo for unpatched security issues","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"wordfence-2024-attack-volume-54b-requests","title":"Wordfence 2024: 54 billion malicious requests blocked, ~325-350k sites infected on any given day","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"sucuri-2023-39pct-cms-outdated-at-infection","title":"Sucuri 2023: 39.1% of CMS apps outdated at point of infection (down from 50.58% in 2022)","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"verizon-dbir-2025-88pct-smb-ransomware","title":"Verizon DBIR 2025: 88% of SMB breaches involved ransomware vs 39% of enterprise; median ransom $115k","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"web-almanac-2024-page-weight-per-cms","title":"Web Almanac 2024: median desktop page weight — WordPress 2,252 KB, Wix 2,560, Squarespace 3,323; 90th pct crosses 8 MB","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"zittrain-reference-rot-supreme-court-2014","title":"Zittrain et al. (Harvard Law 2014): 50% of URLs in U.S. Supreme Court opinions suffer reference rot","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"usablenet-2025-5000-ada-lawsuits-46pct-repeat","title":"UsableNet 2025: 5,000+ digital accessibility lawsuits filed; 46% of federal cases involve repeat defendants","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"accessibility-95pct-fail-wcag-40pct-pro-se-ai","title":"Accessibility: 95% of sites fail basic WCAG; 40% of new federal ADA filings are pro se (AI-assisted)","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"ftc-accessibe-1m-settlement-jan-2025","title":"FTC (Jan 3, 2025): accessiBe ordered to pay $1M for deceptive claims its AI overlay could make sites WCAG-compliant","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"eu-accessibility-act-enforcement-june-2025","title":"European Accessibility Act enforcement began June 28, 2025 — penalties up to €100k (Germany), 4-5% revenue (France/Italy)","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"divi-4-to-5-one-way-migration-feb-2026","title":"Divi 5 official release Feb 26, 2026; Divi 4 → 5 is one-way migration; rollback gets harder over time","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"drupal-7-eol-january-2025-291k-sites","title":"Drupal 7 EOL January 5, 2025 — ~291,386 sites still on D7 in Sept 2024; migration is effectively a rebuild","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"longevity-named-examples-2026","title":"Long-lived sites worth studying: Daring Fireball, Berkshire Hathaway, Craigslist, Pinboard, GOV.UK, Stack Overflow, Wikipedia","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"govuk-design-system-2x-faster-half-code","title":"GDS: GOV.UK Design System pages download 2x faster than non-system pages with half the code","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"decay-vs-compound-matrix","title":"Reference framework: which website dimensions decay vs compound over 10 years (12-dimension matrix)","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"ten-year-cost-model-rebuild-vs-foundation","title":"Reference framework: 10-year cost model — rebuild-every-3-years vs foundation-first (Canadian SMB, CAD)","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"rule-build-for-10-year-horizon","title":"RULE: Design every Candid client site for a 10-year operational horizon. Rebuild is a choice, not a forced move.","kind":"rule","scope":"business","link_type":"relates-to"},{"slug":"rule-url-design-as-permanence-design","title":"RULE: Treat URL/slug design as a 10-year decision. Never let a slug change without a 301 redirect.","kind":"rule","scope":"business","link_type":"relates-to"},{"slug":"rule-reduce-plugin-count-as-security-discipline","title":"RULE: Plugin count is the WordPress security surface. Audit quarterly; one-in, one-out rule.","kind":"rule","scope":"business","link_type":"relates-to"},{"slug":"rule-accessibility-is-architecture-not-overlay","title":"RULE: Accessibility is architecture, not an overlay. Never sell or install an accessibility overlay widget.","kind":"rule","scope":"business","link_type":"relates-to"},{"slug":"research-brief-owning-your-stack","title":"Research brief: Owning your stack — why agency-managed platforms cost more than they save (piece 4 of 15)","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"research-brief-marketing-sites-that-do-something","title":"Research brief: What makes a marketing site do something (piece on brochure vs platform)","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"research-brief-kb-backed-website-methodology","title":"Research brief: The knowledge-base-backed website (piece 3 of 15)","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"doctorow-enshittification-pattern","title":"Doctorow: \"enshittification\" — the three-phase decay pattern of platforms (Word of the Year 2023 + 2024)","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"ahrefs-14b-pages-96-55pct-no-traffic","title":"Ahrefs (14B-page study): 96.55% of pages get zero Google traffic — supersedes older 90.63% figure","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"hubspot-vaughan-historical-optimization-106pct","title":"HubSpot (Pamela Vaughan): historical-optimization refresh of old posts lifts organic traffic by avg 106%","kind":"reference","scope":"business","link_type":"relates-to"}],"incoming":[{"slug":"research-brief-page-speed-moat","title":"Research brief: Page Speed as a Moat — why CWV separates the agencies from the freelancers (piece 9 of 15)","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"research-brief-case-against-page-builders","title":"Research brief: The Case Against Page Builders (piece 10 of 15)","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"research-brief-public-data-private-moat","title":"Research brief: Public data as a private moat — building proprietary intelligence from government open data (piece 11 of 15)","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"research-brief-dataset-is-the-product","title":"Research brief: The Dataset is the Product — when a service business should own its data (piece 12 of 15)","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"research-brief-research-before-pages","title":"Research brief: Research Before Pages — methodology for KB-backed websites (piece 14 of 15)","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"foundation-roadmap-15-pieces-closure","title":"CANDID REFERENCE: how the 15-brief foundation roadmap connects — the throughline from strategic frame to editorial layer","kind":"reference","scope":"business","link_type":"depends-on"},{"slug":"research-brief-confidence-sources-dated-claims","title":"Research brief: Confidence Levels, Sources, and Dated Claims — why every statement on a credible site should be verifiable (piece 15 of 15)","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"research-brief-2026-build-standards","title":"Research brief: Candid Creative 2026 Build-Standards — web stack decision framework for SMB marketing sites & lightweight apps (piece 16)","kind":"reference","scope":"business","link_type":"relates-to"}]},"created_at":"2026-05-22T19:58:12.776Z","updated_at":"2026-05-22T19:58:12.776Z"}