A small business website is normally built once, checked, and then left. The assumption is reasonable: it is a set of pages, the pages have not changed, so the site should keep doing what it did. What actually happens is that everything underneath it keeps moving - the software it runs on, the security certificate, the payment plan, the registration of the domain itself - and each of those has its own expiry.
The failures are abrupt rather than gradual. A certificate lapses and every visitor is shown a warning telling them the site is unsafe, which is worse than the site being down because it looks deliberate. A plugin goes unpatched long enough to be exploited and the site starts serving somebody else's content. A payment fails on a card that expired and hosting stops. In each case the business finds out from a customer, which means it was already visible for some time before anyone knew.
The domain is the most damaging of these and the least noticed. It is renewed annually, often through an account created by whoever built the site, and it is the one asset that is genuinely hard to recover once it has lapsed and been taken. Email usually depends on the same domain, so the failure is not just the website going dark; it is the business becoming unreachable at the address on every invoice, van and business card it has ever issued.
The practical response is an hour twice a year, in the calendar, treated like any other renewal. Log in and confirm the site loads over a secure connection without warnings. Apply the updates it is asking for. Check the domain's expiry date and that it is set to renew automatically to a card that is current. Confirm the contact address on the registration is one somebody reads, since every warning before an expiry is sent there.
The other half is knowing who holds what. In many small businesses, the domain is registered to a former web designer, the hosting is under a personal account, and nobody has the login to either. That arrangement works perfectly until the day it is needed, and it is worth resolving while relations are good and the person still answers the phone - the business should own the domain and the hosting account in its own name, whoever built or maintains the site.