This isn't entirely the same domain, but I used to work on a lot of sites for the Dept for Education and the major problem is that people have awesome ideas for "engagement" and spend months or even years gathering support for funding. But that funding will only be for a specific time period. It seems obvious to anyone working in tech that a site needs ongoing support, but it's not obvious to funding panels who sign off the 18 month funding plan.

From a webhosting perspective, few people ever notice when their site has been attacked.

To a degree, this is by intention of those doing the attacking. They would rather have the site up and running, while the spam, code injection and backdoor can sit there earning them money. It's not until the spam causes damage (or is visible enough) that someone calls someone who is in charge, who in turn might hire a web developer, who in turn calls the hosting company in order to figure out that a 5 year old WordPress site that someone else put together has not been updated. Then it can take even longer until the new web developers has negotiated a price to fix the situation.

According to the blog below, the problem isn't that no-one considers them valuable it's that there is no-one actually responsible for their operation and control.

http://shkspr.mobi/blog/2014/03/2000-nhs-security-vulnerabil...

The problem with that is that you are then putting the onus on your users to act as your net-sec team. Basically, if your user base is unskilled to begin with (old or economically disadvantaged) and the sites that are targeted to them break, they typically don't know how to let someone know.

There are many useful projects which run for a fixed term and which have an associated Web site.

The problem is that there isn't a formal plan for decommissioning the Web site - perhaps turning it into static HTML with an 'archived' banner at the top.

I don't know, there is a place for the low-value occasional use site.