Most of the website emergencies we deal with in December are not caused by December. They are problems that were always going to happen, and the festive season simply picks the moment when nobody is watching. A domain tries to auto-renew on a card that expired in October. An update breaks the contact form on the day the office closes. A customer orders on 20 December and expects delivery on the 23rd because the checkout never said otherwise.
The short version: before you close, confirm every renewal that falls between now and the end of January, tell Google and your customers your real hours, set honest delivery dates if you sell online, finish your updates a week before you leave, and make sure someone can get into the website if it breaks on 28 December. The rest of this checklist explains each step and why it matters this year in particular.
Why This December Needs a Plan
The 2026 festive calendar breaks December into short weeks. Day of Reconciliation falls on Wednesday 16 December, Christmas Day on Friday 25 December and New Year’s Day on Friday 1 January 2027. Day of Goodwill lands on Saturday 26 December, and because the Public Holidays Act only moves a holiday that falls on a Sunday, there is no extra Monday off. Many businesses will be half-open across three broken weeks, which is exactly when ownership of the website gets vague.
Two technical dates also land inside that window. WordPress 7.2 is scheduled for release on 8 December 2026, about a week before many businesses close. PHP 8.2, which many WordPress websites still run on, reaches the end of its security support on 31 December 2026. We have written separately about what end-of-life software really means for your website. The short version for December is that neither date should be met for the first time while the office is empty.
Then there is the threat side. In its November 2025 festive warning, SABRIC flagged AI-assisted scams, payment-link fraud and courier impersonation as the big risks around Black Friday and Christmas, and noted that digital banking fraud made up 65.3% of all reported financial crime incidents in 2024. Internationally, Semperis’ 2025 holiday ransomware research found that 52% of the organisations it surveyed had been targeted on a holiday or weekend, and 78% cut their security staffing by at least half over those periods. That survey did not include South Africa, but the logic travels: attackers prefer the days when nobody is checking.
1. Renewals: Domain, Hosting, SSL and the Card on File
Start with a list of every recurring web payment due between now and 31 January: domain, hosting, email, premium plugins and themes, and any SaaS tools your website depends on. Then check the card each one bills against. Expired cards are the single most boring cause of a December outage, and the most avoidable.
Your .co.za domain moves faster than you think
The .co.za registry is run by ZARC (the ZA Registry Consortium), and its published policies are strict about timing. Auto-renew is the registry default, but whether a renewal actually goes through depends on your account with your registrar or reseller being paid up. Once a domain expires, it sits in a pending-suspension phase for five days, after which it is removed from the zone file and both the website and email stop resolving. A further five-day pending-deletion phase follows, then a 20-day closed redemption phase in which the domain can only be recovered by paying a redemption fee on top of the renewal. In practical terms, your website and email go dark about five days after expiry, recovery gets more expensive after about ten, and the domain is gone after about thirty.
Thirty days sounds generous until you remember that the expiry could land on 22 December and the person who notices might only be back on 11 January. Log in to your registrar now, confirm the renewal date and confirm the card.
SSL certificates are renewing more often
Since 15 March 2026, the maximum lifetime of a public TLS certificate has been 200 days, under the industry schedule adopted by the CA/Browser Forum. It drops to 100 days from 15 March 2027 and to 47 days from 15 March 2029. If your certificate renews automatically through your host (AutoSSL or Let’s Encrypt), this changes nothing. If anyone in your business still renews a certificate by hand, it now comes around roughly twice a year. A one-year certificate bought before March 2026 may still be running and could expire over the holidays, and its replacement will last at most 200 days. A manual renewal that falls due while the office is closed is a padlock warning waiting to happen. Check the expiry date in your browser before you leave.
2. Decide Who Gets the Call When It Breaks
The question to answer before you close is not whether anything will go wrong. It is who can fix it, and whether they can get in. Write a one-page access sheet and store it somewhere two people can reach: registrar login, hosting control panel, WordPress administrator, DNS, email administration and your payment gateway dashboard.
Then check the detail that catches many businesses: two-factor authentication. If the only device that receives the login code belongs to the staff member who is on leave in Mozambique until mid-January, nobody else can get in. Add a second authorised person, or move codes to an authenticator app that more than one trusted person can access. This is the same asset-ownership problem we unpack in your web developer disappeared, and December is when it tends to surface.
Confirm your support arrangement as well. If your website is maintained by an agency or freelancer, ask for their festive operating dates and their emergency process now, not on 24 December. If nobody maintains it, decide who in the business owns it for the holidays and write that name down.
Check how the website sends email
One deadline falls squarely in the shutdown. Microsoft’s current timeline disables Basic authentication for SMTP AUTH by default for existing Microsoft 365 tenants at the end of December 2026. If your website sends contact form or order emails by logging in to a Microsoft 365 mailbox with a stored username and password, those emails may stop going out while the office is closed. Ask whoever manages the website how it sends mail, and move it to OAuth sign-in or a transactional email service before you leave.
Update early, then freeze
Apply plugin, theme and core updates at least a week before you close, test the important paths (contact form, checkout, booking form) and then stop making changes. A rushed update on the last afternoon is one of the most common ways a business leaves for the holidays with a broken form and does not find out until January. Confirm that a recent backup exists, that it is stored off the server, and that someone has actually restored from it at least once. A backup nobody has tested is a hope, not a plan.
WordPress 7.2 deserves a specific decision. If it releases on schedule on 8 December, either test it on staging and update with time to spare, or hold the major version until January while still applying security releases. Both are reasonable. Updating on 15 December and leaving the next day is not.
3. Tell Google and Your Customers Your Real Hours
Your Google Business Profile is often the first place customers check your hours, and Google’s rules are specific. Special hours are for holidays and short closures of up to six consecutive days, and Google recommends confirming holiday hours even when they match your normal hours. If you will be closed for seven or more days in a row, Google’s guidance is to mark the business as temporarily closed instead, with one trade-off: its documentation notes that for broad searches, temporarily closed businesses can rank after open ones. So be honest about what closed means. If someone will still answer the phone or respond to enquiries during the break, set special hours on the affected days. If the business genuinely shuts for three weeks, follow Google’s rule, and put a reminder in the diary to switch the profile back the day you reopen.
On the website itself, add a short notice with your closing date, reopening date and what a customer should do in the meantime. Update the contact form’s auto-reply so people know when to expect an answer, and set an away message on WhatsApp Business if that is how customers reach you. A visitor who knows you reopen on 11 January will often wait. A visitor who hears nothing assumes you have gone out of business.
Out-of-office replies are a security decision
Auto-replies feel harmless, but they confirm that an address is live and they tell strangers who is away, for how long and who to contact instead. Security guidance from Kaspersky, Proofpoint and university IT teams points the same way: set a separate, shorter reply for external senders, point people to a shared mailbox rather than naming a colleague, and leave out where you are and what you are doing. That information is exactly what a fake supplier invoice or a banking-details change request needs to sound convincing. The email standard for automatic replies (RFC 3834) also recommends replying to the same sender no more than once every seven days, and built-in out-of-office features limit repeat replies to the same sender in a similar way, which a homemade forwarding rule may not.
4. Online Stores: Delivery Promises Carry Legal Weight
If you run an ecommerce website, December delivery messaging is not just customer service. Under section 46 of the Electronic Communications and Transactions Act, a supplier must execute an order within 30 days unless the parties agreed otherwise, and if it does not, the consumer may cancel with seven days’ written notice. The Consumer Protection Act adds that goods must be delivered on the agreed date or within a reasonable time, and that a consumer offered a different date can cancel without penalty. A delivery date stated at checkout is likely to be treated as the agreed date.
Couriers usually publish their festive cut-off dates closer to the season, so ask your courier directly for its 2026 dates, then put the last order date for pre-Christmas delivery on product pages, in the cart and at checkout, not only in a banner that mobile visitors scroll past. If you are closing fulfilment completely, say so plainly and decide whether to keep taking orders for January dispatch or to pause checkout. Our Black Friday WooCommerce guide covers the store features worth having in place before the peak; this is the other half of the same job.
Finally, tell customers how you will and will not contact them. SABRIC’s festive warnings specifically name courier impersonation and fake payment links. A one-line notice that you will never send a payment link by SMS or ask for a card number over WhatsApp protects your customers and your reputation at the same time.
5. Marketing: Pause, Trim or Keep Running
Paid campaigns do not know you are closed. Ads that send traffic to a business that will not answer for three weeks are usually wasted money, but switching everything off is not always right either, because people keep researching suppliers over the holidays and some will be ready to buy in January. The sensible middle ground is to reduce budgets, adjust ad schedules around your real availability, and make sure every landing page tells visitors when you will respond. An enquiry captured on 29 December and answered on 11 January is still a lead, provided the visitor was told what to expect.
The Checklist at a Glance
| Area | Do this before you close | Why it matters |
|---|---|---|
| Renewals | List every web renewal due before 31 January and check the card on each | An expired .co.za stops resolving about five days after expiry |
| SSL | Confirm the certificate renews automatically | Maximum certificate life is now 200 days, so manual renewals come around more often |
| Access | Two people can log in to registrar, hosting, WordPress, DNS and email | Two-factor codes on one absent person’s phone lock everyone else out |
| Updates | Update and test a week before closing, then freeze changes | Last-day updates are how forms break silently |
| Backups | Confirm a recent off-server backup that has been test-restored | An untested backup is not a recovery plan |
| Special hours for short closures; temporarily closed if shut for seven or more days | Customers check Google before your website | |
| Website | Add a closing notice and update form auto-replies | Silence reads as closed for good |
| Short external out-of-office with a shared mailbox, no whereabouts | Auto-replies feed social engineering | |
| Store | Show courier cut-off and dispatch dates at product, cart and checkout | ECTA and the CPA give customers rights if you miss the date |
| Ads | Reduce budgets and schedules to match real availability | Paid clicks to an unanswered business are wasted |
Summary
- Most December website failures are scheduled problems that land when nobody is watching: renewals, expired cards, rushed updates and missing access.
- A .co.za domain stops resolving about five days after expiry and attracts redemption fees soon after. Check renewal dates and cards now.
- Update early, test the paths that make money, back up off the server and freeze changes before you close. Decide in advance how to handle WordPress 7.2 and PHP 8.2’s end of security support.
- Use Google Business Profile special hours for holidays and closures of up to six days. If you will be fully closed for seven days or more, Google’s guidance is to mark the business temporarily closed, then switch it back when you reopen.
- Keep out-of-office replies short, generic and pointed at a shared mailbox.
- If you sell online, your stated delivery date carries legal weight under ECTA and the CPA. Publish realistic cut-offs where customers will see them.
None of this takes more than an afternoon, and it is far cheaper than discovering in January that the website has been down since Boxing Day.
Frequently Asked Questions
Should I mark my Google Business Profile as temporarily closed over December?
It depends on how long you are fully closed. Google’s guidance is to use special hours for holidays and closures of up to six consecutive days, and to mark the business temporarily closed if it will be closed for seven or more days in a row. Google notes that temporarily closed businesses can rank after open ones for broad searches, so if someone is still answering enquiries, special hours are the accurate choice. Either way, switch the profile back the day you reopen.
What happens if my .co.za domain expires over the holidays?
Under ZARC’s published policies, an expired .co.za domain is suspended after five days, which takes your website and email offline. It then moves through a pending-deletion phase and a 20-day closed redemption phase, during which it can only be recovered by paying a redemption fee on top of the renewal. Check your renewal date and the card on file with your registrar before you close.
Should I update WordPress before going on leave?
Yes, but at least a week before, not on the last day. Apply updates, test the contact form, checkout and any booking flows, confirm a working backup and then stop making changes. If a major release such as WordPress 7.2 arrives close to your closing date, either test it properly first or hold it until January while still applying security releases.
What should my out-of-office email say?
Keep the external version short: when you are back and a shared mailbox or general number for urgent matters. Avoid naming colleagues, travel plans or your whereabouts, because that detail helps scammers craft convincing fake invoices and requests. Use your mail system’s built-in out-of-office feature so the same sender is not answered repeatedly.
Do I have to deliver online orders placed in December within a certain time?
Under section 46 of the Electronic Communications and Transactions Act, the supplier must execute the order within 30 days unless the parties agreed otherwise, and the consumer may cancel with seven days’ written notice if that does not happen. The Consumer Protection Act also requires delivery on the agreed date or within a reasonable time. State realistic festive dispatch and delivery dates before the customer pays.
Hand Over the Year-End Checks
If you would rather hand the renewals, updates, backups and monitoring to someone whose job it is, our website maintenance plans cover exactly that, and you can get a quotation for anything that needs fixing before you close.
Prefer to talk it through first? Contact us and tell us what you are seeing.
Get a Quotation
