Backups and security basics for your website

Small business websites are attacked all the time, not because someone picked you, but because software scans the whole internet for weak spots. A few habits keep most of that away: updates, strong logins, backups you can restore and a plan for the day something goes wrong. This lesson gives you the basics in plain words, a ten-minute checklist and a step-by-step plan for the case that your site is ever hacked.

Why small websites get hacked

Attackers do not sit and choose small businesses one by one. They use automated tools that try thousands of sites a day, looking for old software, weak passwords and open doors. Your size does not protect you, and a site that is easy to enter is useful to them for many reasons.

• To send spam or run scams from your domain.
• To host fake pages that steal other people's passwords.
• To redirect your visitors to other websites.
• To fill your site with hidden links that sell their products.
• To steal customer details from forms and orders.

Not every disaster is an attack. Sites also fail because of a bad update, a deleted file, a host problem or a mistake. Backups protect you from all of them.

Backups: your safety net

A backup is a full copy of your website that you can restore when something breaks. It is the single most useful thing you can have, because it turns a disaster into an inconvenience.

What a backup should include

Two parts matter. The files are your pages, images, themes, plugins and settings. The database holds the content that changes: posts, pages, products, orders and form entries. A backup that holds only one of them cannot rebuild your site. If your email lives on the same account, check whether it is included, and keep a list of your DNS records as well.

How often to back up

Match the rhythm of your site. A store or a booking site that takes orders every day needs a backup every day, or even more often. A brochure site that rarely changes can be backed up weekly. Always make a backup right before a big change, such as an update, a redesign or a move.

Where to keep your backups

A copy stored only on the same server as your site is a weak backup, because anything that hurts the server hurts the copy. Follow the 3-2-1 rule: three copies of your data, on two different kinds of storage, with one copy somewhere else, away from your host.

How long to keep them

Keep at least a month of backups. Some problems, like hidden malware, are discovered weeks after they start, and you may need a copy from before it began.

Test the restore

A backup you have never restored is a hope, not a backup. Ask how a restore works, who does it and how long it takes, and try it once on a test copy if you can. A simple test has three steps: restore the backup to a copy of the site, open the copy and check that the pages, images and forms work, then note how long it took. That number tells you how long you would be offline in a real emergency.

Who makes the backups

Some hosts back up your site automatically, some charge extra and some do not offer it. A plugin or a studio can also do it. Whoever does it, write down who is responsible and where the copies are, and confirm that the job really runs.

Security basics every site owner should know

1. Keep everything updated

Updates fix weaknesses that attackers already know about. That covers your website software, your themes, your plugins and any apps. On platforms such as WordPress, most known weaknesses are in plugins and themes rather than in the core software. Update on a schedule, and make a backup first.

2. Use strong, unique passwords

Never reuse a password. When one site is breached, attackers try the same login everywhere else. A password manager creates and remembers a different strong password for each account, so you only need to remember one.

3. Turn on two-step verification

Two-step verification asks for a code from your phone in addition to your password. Turn it on for your hosting, your domain account, your website's admin area and your email. It stops most account takeovers.

4. Limit who has access

Give each person their own login, with only the permissions they need. Remove people who no longer work with you, including freelancers and former employees. Do not share one admin login.

5. Remove what you do not use

Old plugins, unused themes, test sites and abandoned user accounts are open doors. Delete them, and do not just switch them off.

6. Use https and protect your forms

A secure connection protects data on the way. Spam protection on your forms keeps bots from flooding you and from abusing your contact page. The lesson on SSL covers the first, and your builder can add the second.

7. Add a firewall and malware scanning

Your host or a security service can block known attacks and scan your files for malware. Ask whether it is included, and who looks at the results.

8. Never install pirated software

Free copies of paid themes and plugins, sometimes called nulled, often carry hidden malware. Buy from the official source or use a free version from a trusted one.

9. Protect your domain account

Turn on the registrar lock and two-step verification, and keep the contact email current. If someone takes over your domain, they take over your website and your email.

10. Let a payment provider handle card data

Never store card numbers on your own site. A payment provider handles them under strict security rules, and you keep only the order details.

11. Beware of phishing

Many break-ins start with a message that tricks a person into giving up a password. Be careful with messages that rush you, ask for a login or claim that your site is hacked or your domain is expiring. Go to the real website yourself, without clicking the link.

What a good password looks like

Length matters more than tricks. A long passphrase, made of several unrelated words, is easier to remember and harder to guess than a short mix of symbols. Do not use your business name, a birthday, a pet or a phone number. Let a password manager create and store the rest, and protect the manager itself with a strong passphrase and two-step verification.

Habits to teach your team

Technology helps, and habits matter just as much. Anyone who works on your website or your email should follow the same few rules.

• Never send a password by email or text message. Share logins through the password manager.
• Log in to important accounts only on devices that are updated and protected with a screen lock.
• Be careful on public wireless networks, and avoid logging in to admin areas from them.
• Report anything odd right away: an unexpected login alert, a strange email, a page that looks different.
• When in doubt, do not click. Ask first.

A ten-minute security check

1. Log in to your hosting account, using two-step verification.
2. Check whether any updates are waiting, and apply them after a backup.
3. Delete unused plugins, themes and user accounts.
4. Confirm that your last backup ran recently, and download a copy.
5. Open your site and check that it loads over https with no warnings.
6. Check the expiry date of your domain and that auto-renew is on.
7. Make sure the email that receives security alerts is one you read.
8. Send a test message through your contact form and confirm that it arrives.
9. Look in Google Search Console, if you use it, for any security issue notices.
10. Write down who to call if the site goes down: your host, your studio and your domain registrar.

Signs your site may have been hacked

• Your site redirects to another website, or shows pages you did not make.
• Google results for your site show strange titles or products you do not sell.
• A browser shows a red warning page when people visit your site.
• Your host suspends the account or sends a security notice.
• New admin users or unknown files appear.
• The site becomes very slow or goes down for no clear reason.
• Customers tell you they received spam from your email address.

What to do if your site is hacked

1. Stay calm, and do not delete everything. Evidence helps with the cleanup.
2. Tell your host or studio. Many can scan the site and clean it.
3. Take the site offline, or put it into maintenance mode, if it is harming visitors.
4. Change every password: hosting, website admin, database, file access and email. Do it from a device that you know is clean.
5. Restore a clean backup, made before the problem started, or clean the site with the help of a specialist.
6. Update everything, and remove unknown users, plugins and files.
7. Find out how it happened, so the same door is closed for good.
8. Ask Google to review the site if it was flagged. Google Search Console has a security issues report with a review request.
9. Think about your customers. If personal data may have been exposed, remember that every state has a data breach notification law, and the rules vary. Talk to a lawyer or your insurer.

Who is responsible for what

Security is shared. The host looks after the server, the network and the building. You, or the studio that looks after your site, look after the website software, the plugins, the passwords and the content. A problem often happens in the gap between the two, so ask in writing who does what: who updates, who backs up, who watches for problems and who answers when something breaks.

Backups, security and your website

At Good Sites Only, hosting is included with every site, and the Care maintenance plan, a monthly service you can add, covers backups, updates and security. If you prefer to look after your own site, use the checklist above as a start. When you are ready, you can start your site.

Questions people ask