Website security and backups for non-techies

You don't need to be a tech person to keep a small website reasonably safe. You need a few good habits and a plan for when something goes wrong.

This lesson covers the basics in plain words: locking down your logins, keeping software updated, making backups, and knowing what to do on a bad day. By the end, you'll have a short routine you can stick to.

No site is perfectly secure. The goal is to make yours a hard target and easy to fix.

The short version

• Protect every account tied to your site with a unique password and two-factor login.
• Keep your site's software updated, and remove anything you don't use.
• Make regular backups, store a copy somewhere else, and test that you can actually restore one.

Step 1: Lock down your logins

Most website trouble for small sites doesn't start with a genius hacker. It often starts with a weak or reused password, or someone tricked into handing one over.

The accounts that matter

Make a list of every account connected to your site. Usually that's:

• Your domain registrar, where you rent your domain name
• Your host or site builder
• Your email account, especially the one you use to reset other passwords
• Your email list service
• Any payment or storefront account

Your email account is the master key. If someone gets into it, they can often reset the passwords on everything else. Protect it first.

Passwords and two-factor

Your first website covers password managers and two-factor in more detail. Here's the quick version:

• Use a password manager, an app that creates and remembers strong passwords, so every account has a different one.
• Turn on two-factor authentication, often called 2FA. That means logging in needs your password plus a second check, like a code from an app on your phone.
• Save your backup codes somewhere safe, in case you lose your phone.

Watch for tricks

Phishing is when someone sends a fake email or text pretending to be a company you use, hoping you'll click a link and type in your password.

Common signs:

• It says your account will be shut down unless you act right now.
• The sender's address is a little off.
• The link goes somewhere that isn't the company's real website.

The safe habit: don't click login links in surprise emails. Open your browser and go to the site yourself.

Step 2: Keep things updated

Updates are new versions of software that fix problems, including security holes. Skipping them is like leaving a broken lock on your door because changing it is annoying.

If you use a site builder

Good news: the company handles most updates for you. Your job is mostly to keep your logins safe and keep an eye on any add-ons or connected apps you've turned on.

If you use WordPress or another self-hosted tool

You're in charge of updates. There are usually three kinds:

• The core software itself
• Your theme, which controls the design
• Your plugins, the add-ons that add features

A simple routine:

1. Make a backup first. Always. (More on this below.)
2. Run the updates from your site's dashboard.
3. Check your site afterward. Click around. Make sure pages and forms still work.

Many tools can update automatically. That's often a good idea for small sites, as long as you also have automatic backups.

Remove what you don't use

Every plugin, theme or connected app is one more thing that can break or be attacked. If you're not using it, delete it. Don't just switch it off.

The same goes for old user accounts. If someone helped you build your site and doesn't need access anymore, remove their login.

Step 3: Make backups

A backup is a copy of your website that you can use to put things back if something goes wrong. That could be a hack, a bad update, or you accidentally deleting the page that mattered most.

A backup you've never tested is a hope, not a backup.

What to back up

• Your site's files, like images, themes and settings
• Your site's database, which on many platforms is where your posts and pages are stored
• Your email list, exported from your email service
• Your product files and the original documents you made them from

On a site builder, you may not get a full backup button. Check what export options they offer, and keep your own copies of your writing and images.

How often

Back up often enough that losing everything since the last backup would be annoying, not a disaster. For a site you update weekly, a weekly backup makes sense. If your host or tool can do it automatically, let it.

Where to keep them

Don't keep your only backup on the same server as your website. If the server has a problem, you lose both.

Keep at least one copy somewhere else, like a cloud storage account or a drive at home. Many backup tools can send copies to cloud storage automatically.

Test a restore

Once in a while, make sure you can actually use a backup. Many hosts and backup tools let you restore to a test copy of your site, sometimes called a staging site. Try it. If you can't figure out how, ask your host's support team to walk you through it while nothing is on fire.

Step 4: Have a plan for a bad day

Things go wrong sometimes. A plan keeps a bad day from becoming a bad month.

Write this down somewhere you can find it even if your site is down, like a note on your phone or a printed page:

1. Who to contact. Your host's or builder's support page and how to reach them.
2. Where your backups are and how to restore one.
3. Which accounts to secure first. Usually email, then hosting, then the registrar.
4. How to reach your email list, in case you need to let people know something.

If you think you've been hacked:

• Change your passwords, starting with email and hosting.
• Contact your host's support. They deal with this regularly.
• Restore a clean backup from before the problem started.
• Then update everything and remove anything you don't recognize.

A simple security routine

Put these on your calendar.

Monthly:

• Run updates, if you're self-hosted, after a backup.
• Check that your automatic backups are actually happening.
• Export your email list and save a copy.

Every few months:

• Test restoring a backup.
• Review who has access to your accounts and remove anyone who doesn't need it.
• Delete plugins, themes or apps you're not using.

Do this next

• List every account tied to your website.
• Turn on two-factor for your main email first, then the rest of the list.
• Remove any plugins, apps or old user accounts you don't need.
• Set up automatic backups, with at least one copy stored somewhere other than your host.
• Export your email list and save a copy.
• Write your bad-day plan and keep it somewhere outside your website.
• Put a monthly security check on your calendar.

Lock the doors, keep a spare key somewhere else, and know who to call.