Business website care. Updates, backups and protection against attacks
Website care means regular updates, backups, uptime monitoring and protection against attacks. A website does not break by itself, but everything around it changes every week. New plugin versions come out, certificates expire and bots scan the internet for known vulnerabilities. Leave a site alone for a year and it will usually have several outdated components, and any one of them can be a way in.
Below is a list of what to do, how often, and how to tell that your website needs ongoing care.
What can go wrong with a company website?
A business owner usually hears about a problem from a customer who cannot send the contact form. The most common situations are fairly mundane.
- The site goes down. A server failure, a full disk or an error after an update.
- The certificate or domain expires. The browser warns visitors away from the site, and customers leave.
- A break-in through an outdated plugin. Strange links or redirects appear on the site.
- The contact form starts sending spam. The mail server ends up on blacklists and the company's emails stop reaching customers.
- Configuration files leak. Files containing database passwords become publicly accessible because of a server misconfiguration.
Most attacks are automated. Bots check thousands of sites at once for the same weak spots, such as the WordPress login page or .env files and the .git directory. You do not have to be an important target to be attacked.
What should you do, and how often?
| Task | How often | Why |
|---|---|---|
| Backup of files and database | daily for sites with forms or a shop, weekly for a simple site | so that after a failure you can go back to the version from before the problem |
| System and plugin updates | weekly, security patches straight away | most break-ins exploit known vulnerabilities that have already been patched |
| Uptime monitoring | continuous, with alerts | so you hear about an outage before your customers do |
| Certificate and domain check | monthly, with a reminder before expiry | an expired certificate shuts the site off for most visitors |
| Form test | monthly and after every update | so that enquiries actually arrive |
| Review of accounts and permissions | quarterly | so that former employees and agencies no longer have access |
Where should backups be kept?
A backup stored on the same server as the website disappears along with it. A safe backup is kept somewhere other than the website, is made automatically and is checked every so often with a test restore. Good practice is to keep several backups from different days, because a break-in is sometimes only spotted a week later, and by then yesterday's backup is infected too.
Updates without the fear
Website owners are wary of updates because something once stopped working after one. The answer is not to stop updating. It is a backup before every change, updates at a quiet time and a quick test of the key features, such as the form, the basket and the login.
A monthly checklist for website owners
If you look after your website yourself, go through this list once a month.
- Send an enquiry through the form and check that it arrived.
- Check the expiry dates of the certificate and the domain.
- See whether there are any pending system and plugin updates.
- Check the date of the last backup.
- Open the site on your phone and in a different browser.
- Review the list of accounts with access to the admin panel.
When should you hand your website over to ongoing care?
Ongoing care makes sense when the website collects enquiries, orders or customer data, when downtime costs you sales, or when nobody in the company has time for a monthly checklist. That is why we built Spoko Sites. It gives you round-the-clock uptime monitoring, a security grade from A to F, backups and updates, attack blocking shown on a map and alerts from CERT Polska, the Polish national CERT. The owner sees the state of the website on one screen, without logging in to the server, and receives a summary once a month.
We also take on websites built by other companies. We start with an audit, so we know what we are taking over, and we install a lightweight agent on the server, with no need to rebuild the site. You will find the scope of care on our services page, and if you would like your website checked, get in touch.
Frequently asked questions
How often should a WordPress website be updated?
Security patches are best installed as soon as they are released, and other system and plugin updates once a week. Make a backup before every update, and afterwards check the form, the login and the most important subpages.
How often should you back up a website?
Every day for a website with forms, orders or customer data, and at least once a week for a simple brochure site. Backups should be kept off the website's server and go back several days, because a break-in is sometimes spotted late.
How can you tell that a website has been attacked?
Typical signs are strange links or redirects on the site, new accounts in the admin panel, browser warnings, a sudden drop in traffic from Google and company emails landing in spam. Monitoring with protection blocks most attempts before they reach the site and alerts you to the ones that need action.
Can a website built by another company be handed over for care?
Yes. Care starts with an audit that shows the state of the software, the server configuration and any known vulnerabilities. Only then is it clear what needs fixing straight away and what can simply be covered by ongoing monitoring.
Co-founder, art director. Designs visual identity systems for demanding clients, with the people who will use them in mind.