Website Backups and Security Basics for Small Sites
Most small websites are not hacked by someone who targeted them personally. They are found by automated tools that scan the internet for known weaknesses: an old plugin, a reused password, an admin page with no protection. The good news is that a short, regular routine blocks most of those attacks, and good backups mean that even a bad day is recoverable.
Start with backups
A backup is only useful if it is recent, stored somewhere safe, and you know how to restore it. A widely used rule of thumb is 3-2-1:
- Keep three copies of your data (the live site plus two backups).
- Store them on two different types of storage or services.
- Keep one copy off-site, away from your hosting account.
For a website, that might mean your host's automatic daily backups, plus a weekly download to your computer or to a separate cloud storage account. The off-site copy matters because if your hosting account is compromised, closed or suspended, backups stored inside it can disappear with it.
What to back up
- Files: the site's code, themes, plugins and uploaded media.
- Databases: posts, pages, orders, comments and settings often live here, not in the files.
- Configuration: server settings, redirect rules and environment details.
- DNS records: a saved copy makes recovering from a provider problem much faster.
- Email, if you rely on your host's mailboxes.
How often to back up
Match the schedule to how often the site changes. A brochure site that changes a few times a year can be backed up after each edit plus monthly. A blog that publishes weekly should be backed up at least weekly. A store or membership site that takes orders or sign-ups every day needs daily database backups at minimum, because losing a day of orders is a real cost. Keep several older copies too, not just the latest one, since a problem such as hidden malware may go unnoticed for weeks.
Test a restore
Many people discover their backups are incomplete only when they need them. Once or twice a year, restore a backup to a test location or a local copy of the site and make sure it works. Write down the steps while you do it; under stress, a checklist helps.
Keep software updated
Outdated software is the most common way small sites are compromised. For WordPress and similar systems:
- Update the core software, themes and plugins promptly, especially security releases.
- Remove plugins and themes you no longer use; deactivated code can still be exploited if it is present.
- Choose plugins that are actively maintained and widely used, and avoid "nulled" (pirated) premium plugins, which often contain malware.
- Check your host's language version (such as PHP) and upgrade when old versions reach end of life.
If automatic updates are available for minor and security releases, turn them on, and take a backup before major updates.
Protect your logins
- Use a password manager and a long, unique password for every account: hosting, registrar, site admin, email and DNS provider.
- Turn on two-factor authentication everywhere it is offered, starting with the registrar and the hosting account. Losing control of either can mean losing the whole site.
- Do not share one admin login among several people. Give each person their own account with only the permissions they need, and remove accounts when people leave.
- Avoid obvious usernames like "admin".
Reduce what attackers can reach
- Use HTTPS everywhere; see SSL certificates explained.
- Limit login attempts or put the admin area behind an additional check.
- Use SFTP or SSH instead of plain FTP to transfer files.
- Set file permissions so the web server can only write where it needs to.
- Consider a web application firewall or a CDN with security features; some are available on free plans.
Watch for trouble
Set up uptime monitoring so you hear about outages quickly; several services offer free plans that check your site every few minutes. Add your site to Google Search Console, which can alert you if Google detects malware or hacked content. Keep an eye on unexpected new admin users, changed files and sudden spikes in outgoing email.
If your site is hacked
- Stay calm and do not delete everything in a panic.
- Change passwords for hosting, the site admin, database and email, from a clean device.
- Contact your host; they may be able to identify the entry point and help clean up.
- Restore from a known clean backup if you have one, then update everything before going back online.
- Find and fix the cause, such as an outdated plugin, or the attack will likely repeat.
- If Google flagged the site, request a review in Search Console after cleanup.
A simple monthly routine
- Check that automatic backups ran, and download a copy off-site.
- Apply updates and remove anything unused.
- Review user accounts.
- Glance at uptime reports and Search Console messages.
- Confirm domain and hosting renewals are scheduled and the payment card is current.
The short version
Back up files and databases with at least one copy off your hosting account, and test a restore. Keep software updated, use unique passwords with two-factor authentication, and monitor for problems. These habits take a few minutes a month and prevent most of the disasters small site owners run into. If you are planning a move, our migration checklist builds on the same backup habits.