Web Security and Backups

The basics, done properly

An SSL certificate so traffic is encrypted, and browsers stop warning visitors away. Software kept current, because most successful attacks use a vulnerability that was patched months earlier. Strong administrator passwords with multi factor authentication. Removal of anything unused, since every plugin and theme you are not using is still a way in.

Security headers

Rarely discussed and genuinely effective. A content security policy controls what is permitted to run on your pages. Other headers stop your site being framed by someone else, block content type guessing, and control what information leaves with each request.

We configure these as standard, and we test them rather than assuming.

Backups that have been tested

A backup you have never restored is a hope, not a plan. Ours run automatically, are stored away from the site itself, and are tested by actually restoring them.

That last point matters more than frequency. A daily backup that fails on restore is worth less than a weekly one that works.

Monitoring

Knowing quickly is most of the battle. We monitor uptime and watch for unexpected changes, so a problem is caught while it is small.

If the worst happens

We have recovered sites that were defaced, infected with redirect malware, blacklisted by Google, or simply deleted. Recovery is nearly always possible. How long it takes, and how much you lose, depends almost entirely on the backups that existed beforehand.