Backups
Website security basics for small businesses
The handful of protections that prevent almost every incident we see — and the recovery plan for when one still happens.
HTTPS everywhere
A certificate should be automatic and free with any competent host. Check that HTTP redirects to HTTPS, that there is no mixed content, and that renewal is automated — expired certificates are one of the most common self-inflicted outages.
Updates
Almost every compromised WordPress site we are asked to clean up was running an outdated plugin. Enable automatic security updates, apply major updates on a staging copy, and remove plugins and themes you no longer use rather than leaving them deactivated.
Backups you have actually tested
Backup baseline
- Daily automated backups of files and database
- Stored off the server, not just on it
- At least 14 days of retention, 30 for busier sites
- One-click restore you have tried at least once
- A restore test in the calendar every quarter
Access control
- Two-factor authentication on hosting, registrar and the site itself
- One account per person — never a shared "admin" login
- Editor rather than administrator for anyone who only writes content
- Remove access the day someone leaves or a project ends
- Keep the domain and hosting accounts in the business's own name
If something does go wrong
- 1
Take it offline if data is at risk
A maintenance page beats serving malware to customers.
- 2
Restore from a known-good backup
Restore, then patch — otherwise the same hole is reopened.
- 3
Rotate every credential
Hosting, database, admin users, API keys and any reused passwords.
- 4
Work out how they got in
Restoring without answering this guarantees a repeat.
Frequently asked questions
- Do I need an SSL certificate?
- Yes. Browsers warn visitors on pages without HTTPS, forms are unsafe without it, and it is included free with most reputable hosts.
- How often should a website be backed up?
- Daily for most business sites, and more often for shops. What matters more is that the backups are stored off the server and that you have tested a restore.
Protected by default
SSL, daily backups and two-factor included
Every Steady plan ships with certificates, off-server backups and account security built in.
Explore hosting