WordPress backups and updates: protecting your website every day

A WordPress website is not a static document: it is software, made up of the WordPress core, a theme and plugins, all constantly evolving. Every update fixes bugs and security vulnerabilities. Not updating leaves the door open; updating carelessly risks an outage. The solution comes down to two words: back up and maintain.

Why are updates essential?

• Security: the vast majority of WordPress hacks exploit known vulnerabilities in plugins or themes that have not been updated. Malicious bots constantly scan the web looking for these vulnerable versions.
• Compatibility: hosting providers upgrade PHP and their servers; a website that is too old eventually stops working.
• Performance and features: each version brings improvements.

1. Automatic, off-site backups

A good backup follows three rules:

• Complete: it includes the files (theme, plugins, images, documents) and the database (pages, posts, orders, customers).
• Off-site: it is stored somewhere other than the website's server (cloud storage, remote server). If the server goes down or is hacked, the backup remains intact.
• Regular: the frequency depends on the website's activity. For a showcase website, a weekly database backup may be enough; for an online store, a daily database backup is a must, while files can be backed up weekly.

Plugins such as UpdraftPlus can automate these backups to Google Drive, an SFTP server or other storage. Remember to keep several versions: a single backup may contain a problem that went unnoticed.

Above all, a backup is only worth something if it can be restored. An occasional restore test avoids nasty surprises.

2. Controlled updates

1. Back up the website just before the work.
2. Read the release notes for major updates (new version of the theme, WooCommerce…).
3. For important websites, test first on a staging copy.
4. Update WordPress, the theme and plugins.
5. Check the key pages: home page, forms, basket and checkout for a store.
6. If there is a problem, restore or fix it immediately.

3. Website monitoring

• Uptime: a monitoring service checks every few minutes that the website responds and sends an alert if it goes down.
• Security: monitoring of login attempts, modified files and plugins reported as vulnerable.
• HTTPS certificate and domain name: if they expire, the website becomes inaccessible or displays a security warning.

Security best practices

• Strong, unique passwords and two-factor authentication for administrators.
• A limited number of administrator accounts.
• Removal of unused plugins and themes.
• Only reputable, maintained plugins, never pirated “nulled” versions.
• A recent PHP version with your hosting provider.

Outsourcing your website maintenance

Off-site backups, controlled updates, monitoring and SEO follow-up: we offer maintenance contracts so you can focus on your business, with a dedicated contact who knows your website and steps in quickly when needed.

Frequently asked questions

Franck GuigoutFounder of GUIGOUT SAS, a web agency in Bourg-en-Bresse, France. Over twenty years of building WordPress and WooCommerce websites and of search engine optimisation for businesses in France and abroad.