Website Backups, Security and SSL - The Protections Every Host Plan Needs
How to check hosting backups, use HTTPS certificates, secure logins and patch software so a small business site can recover from mistakes and attacks.
Every website needs three protections regardless of price: backups you can restore yourself, HTTPS with a certificate that renews automatically, and a routine for updates and strong logins. Most small site compromises come from outdated plugins, weak or reused passwords and missing backups, not from exotic attacks. This guide explains what to look for in a hosting plan, how to test it and a simple monthly routine that keeps the basics covered.
Backups: your safety net
What a good backup setup looks like
- Frequency. Daily for most sites, more often for a store that takes orders all day.
- Retention. Multiple restore points, such as 14 to 30 days, because some problems are discovered late.
- Scope. Both files and databases. A files-only backup of a WordPress site is missing the content.
- Location. At least one copy off the server that hosts the site, ideally with a different provider.
- Self-service restore. You can restore without waiting on a support ticket.
The 3-2-1 idea
Keep three copies of important data, on two different kinds of storage, with one copy offsite. For a small site, that might be the live site, the host's backups and a weekly copy in your own cloud storage.
Test the restore
A backup you have never restored is an assumption. At least twice a year, restore to a staging copy and check that pages, images and forms work. Note how long it takes, because that is your realistic recovery time.
Common backup mistakes
- Relying on a host's backups that are only for their own disaster recovery and may not be available to you.
- Storing the only copy in the same hosting account that might be compromised.
- Forgetting to back up before updates.
- Not backing up email if it lives on the hosting account.
SSL/TLS and HTTPS
HTTPS encrypts the connection between a visitor's browser and your site. Browsers warn visitors when sites do not use it, and it is expected on any site with forms or logins. The certificate is the digital document that proves your domain's identity. The technology is called TLS, although "SSL" remains the common term.
- Free certificates from automated certificate authorities are sufficient for the vast majority of small business sites, and many hosts install and renew them automatically.
- Paid certificates may offer warranties, organization validation or support. They rarely change how the padlock appears in modern browsers.
- Renewal. Certificates have limited lifetimes, and the maximum lifetime is being shortened over time by industry rules, so automated renewal is essential. Confirm that it is on, and monitor expiry.
- Redirects. Redirect all HTTP URLs to HTTPS and update internal links to avoid mixed-content warnings.
Account and login security
- Use a password manager to create long unique passwords for hosting, domain registrar, email and the website admin.
- Turn on two-factor authentication for all of them. This is one of the most effective protections available to a small business.
- Limit administrator accounts to the people who need them, and remove accounts when someone leaves.
- Protect the domain registrar account especially carefully. Whoever controls your domain controls your email and website addresses.
- Beware of phishing emails that imitate your host or registrar and ask you to log in or pay an urgent invoice. Go to the provider's site by typing its address yourself.
Software updates
Outdated software is a leading way sites are compromised. Keep the CMS core, themes, plugins and server software such as PHP up to date. On managed plans the provider may handle some of this. On other plans it is your job.
A safe routine:
- Back up.
- Update on a staging copy if you have one, or at a quiet time if not.
- Test key pages, forms and checkout.
- Remove plugins and themes you no longer use, since inactive code can still be a risk.
Hosting-level protections
| Protection | What it does | Notes |
|---|---|---|
| Web application firewall | Blocks common attack patterns | Helpful, not a substitute for updates |
| Malware scanning | Detects known malicious files | Ask whether cleanup is included |
| Rate limiting | Slows brute-force login attempts | Often a plugin or host feature |
| DDoS mitigation | Absorbs floods of traffic | Level of protection varies |
| Account isolation | Keeps other customers from reaching your files | More robust on VPS and cloud |
| Security headers | Browser-side protections | Configurable on most hosts |
Worked example: a monthly security routine
Illustrative time estimates.
| Task | Frequency | Time |
|---|---|---|
| Check uptime and certificate expiry reports | Weekly | 5 minutes |
| Apply updates after a backup | Weekly or biweekly | 20 minutes |
| Review user accounts and remove old ones | Monthly | 10 minutes |
| Download an offsite backup | Monthly | 10 minutes |
| Test a restore on staging | Twice a year | 1 hour |
Roughly an hour a month plus two hours a year. If you do not want to do this, a managed plan or a maintenance service makes sense. Compare the cost using the hosting cost estimator, and see Managed WordPress vs DIY Hosting.
If your site is hacked
- Do not panic and do not delete everything.
- Contact your host's support, who may be able to isolate the account and help identify the cause.
- Change passwords for hosting, the site admin, the database and email, using a trusted device.
- Restore from a clean backup taken before the compromise, then update everything.
- Find and close the entry point, such as an outdated plugin, before bringing the site back.
- If customer data may have been exposed, check the state breach notification laws that apply and consider legal advice. The Federal Trade Commission offers guidance for businesses on data breach response.
Mistakes to avoid
- Skipping two-factor authentication because it is inconvenient.
- Using the same password across hosting and email.
- Keeping abandoned plugins installed.
- Assuming the padlock icon means a site is trustworthy rather than merely encrypted.
Frequently asked questions
Do I need to pay for an SSL certificate?
Usually not. Free certificates from automated authorities are widely supported. Pay only if you need a specific feature or warranty.
How often should I back up my website?
Daily for most active sites, and more often for stores. Keep several restore points and at least one offsite copy.
Is my site safe if my host says it is secure?
Hosting security reduces risk at the server level, but your passwords, plugins and updates remain your responsibility on most plans.
What should I do first if I get a suspicious email from my host?
Do not click links. Go to the provider's website directly and log in from there, or contact support through a known channel.
Sources and further reading
- CISA - cybersecurity guidance, including multi-factor authentication.
- Federal Trade Commission - data security and breach response guidance for businesses.
- Let's Encrypt - how automated free certificates work.
