Security updates and backups explained for owners

What this guide helps you check, even if you are not technical

You do not need to be a developer to know whether your website is reasonably safe. You need to understand five things: what gets updated, what the padlock in the browser means, whether your backups can actually be restored, how sites get infected, and who has the admin passwords. This guide explains each one in practical terms and ends with a short checklist you can run every month.

Many attacks on small business websites are not personal. Automated programs scan large numbers of sites looking for software with known weaknesses and for logins with weak passwords. A school, a clinic or a hardware shop gets hit not because someone chose it, but because its site was easy. Most of the protection described here is about not being easy.

Updates: what is being updated and why it cannot wait forever

A website is several layers of software stacked on top of each other, and each layer gets its own updates.

• Server software: the operating system and the PHP version your hosting runs. Your hosting company usually manages this, but it can affect your site when versions change.
• Content management system: if your site uses WordPress or a similar system, the core software gets regular releases.
• Themes and plugins: add-ons that control design and features, each written by a different developer on its own schedule.
• Custom code and frameworks: if your site was built in custom PHP, the framework and libraries it uses also receive security fixes.

When a security problem is found in any of these, a fix is released and the details often become public. From that moment, an unpatched site is a known target. That is why delaying updates for months is risky. The opposite mistake, updating everything without a backup, is also risky because an update can occasionally break a page. The safe habit is simple: back up, update, then check the pages that matter most, such as the home page, contact form and checkout.

SSL and the padlock: what it protects and what it does not

An SSL certificate (technically TLS) encrypts the connection between a visitor's browser and your website. It stops someone on the same Wi-Fi network from reading what a visitor types into your enquiry form or login page. Sites with a valid certificate load over https and show a padlock or similar icon; browsers mark pages without one as 'Not secure', which puts visitors off.

Two practical points matter for owners. First, certificates have a fixed validity and must be renewed. Many hosts renew free certificates automatically, but automatic renewal can fail quietly after a hosting or DNS change, so someone should check the expiry date. Second, the padlock only means the connection is encrypted. It does not mean the site is free of malware, that its software is up to date or that its passwords are strong. A hacked site can still show a padlock.

Backups that actually save you: where, how often, and the restore test

What a complete backup contains

A website backup has two parts: the files (code, theme, uploaded images and documents) and the database (pages, products, orders, enquiries, user accounts). A backup of only the files will restore the design but lose your content. Ask whoever handles your site to confirm both are included.

How often to back up

Match the frequency to how often the site changes. Losing a day of data matters very little to some sites and a great deal to others.

Where backups are stored

A backup kept only on the same server as the website disappears along with the website if that server fails or the hosting account is compromised. Keep at least one copy somewhere separate, such as cloud storage in your organisation's own account. A widely used rule of thumb is three copies, on two different kinds of storage, with one kept off-site.

The restore test

A backup that has never been restored is a hope, not a plan. Every few months, ask your provider to restore a recent backup to a test copy of the site and show you that it works: pages open, images appear, forms submit. It takes little time and tells you whether you could recover from a bad day.

Malware and hacked sites: how they get in and the clean-up order

Malware on a website is unwanted code that does something for the attacker: redirecting your visitors to scam sites, creating spam pages that Google indexes under your domain, stealing form data or sending spam email from your server. The usual ways in are outdated plugins or themes, pirated ("nulled") premium themes that come with hidden code, weak or reused admin passwords, and old accounts that were never removed.

If you suspect your site is infected, the order of the clean-up matters more than speed:

1. Do not delete the site or start editing files at random; you may destroy the evidence of how the attacker got in.
2. Change the passwords for the website admin, hosting control panel, database, FTP and the email account linked to them.
3. Identify a clean backup from before the infection and restore it, or have a professional remove the malicious code.
4. Update all software and remove plugins, themes and user accounts that are not needed.
5. Find and close the entry point, otherwise the infection usually returns.
6. If Google has flagged the site, follow the security issues process in Google Search Console to request a review.

Google's Search Central documentation explains how hacked sites are flagged and how to ask for a review once the site is clean.

Admin passwords and access: the cheapest security you can buy

Many website problems start with access, not code. A shared admin password that six people know, an agency login that was never removed, or a domain account tied to a former employee's personal email can all cause more damage than an outdated plugin.

• Give each person their own login with only the permissions they need; an editor who updates notices does not need full administrator rights.
• Remove logins for staff who have left and for agencies you no longer work with, on the same day the relationship ends.
• Use long, unique passwords stored in a password manager, and switch on two-step verification where the system offers it.
• Treat the hosting control panel and the domain registrar account as seriously as the website login, because whoever controls them controls the site.
• Keep a short, private record of which accounts exist, who holds them and which email address recovers each one.

A monthly website security checklist for owners

This takes about fifteen minutes and needs no technical skill. If you have a maintenance provider, ask them to confirm each item in their monthly report instead.

1. Open the site on your phone and a computer and check that the home page, main service pages and contact page load correctly over https.
2. Submit the enquiry form yourself and confirm the email or WhatsApp notification arrives.
3. Check the date of the latest backup and where it is stored.
4. Ask when a backup was last test-restored; if the answer is "never", schedule one.
5. Look at the list of admin users and remove anyone who should not be there.
6. Confirm whether updates were applied this month and whether anything was postponed, and why.
7. Note the expiry dates of the domain and SSL certificate and make sure someone owns each renewal.
8. Search Google for your site using site:yourdomain.com and look for pages you did not create.

Where MATROP fits, and when you can manage this yourself

If your team can follow the checklist above, apply updates carefully and verify backups, you may not need outside help for a simple site. Many organisations find the routine slips once the person who understood it moves on, and that is where a maintenance arrangement helps.

MATROP's website maintenance service covers core, theme and plugin updates, security patches and basic hardening, malware protection, scheduled backups with restore support, uptime monitoring on the higher plan and a monthly report of work done with recommendations. Backup frequency depends on the plan, from monthly to daily where needed. If you are comparing maintenance contracts, our guide to what a website AMC should include covers the clauses to check. If your concern is the security of business software rather than a website, such as an ERP or portal, see our security checklist for custom software buyers.

Questions people ask

Does my hosting company's backup mean my website is covered?

Not necessarily. Check how often the host backs up, how long copies are kept, whether they sit on a separate server and whether you can restore without paying, and keep at least one copy of your own outside that hosting account.

How long should we keep old website backups?

Long enough to go back to a point before a problem started. Infections and accidental deletions are sometimes noticed weeks later, so keep several older copies rather than only the most recent one.

Is a free SSL certificate less secure than a paid one?

For a typical business website, the encryption is the same. Paid certificates differ mainly in how thoroughly the organisation is verified, the warranty and the support offered, not in the strength of the connection.

Should we switch on automatic updates for our website?

Automatic updates for small security releases are usually sensible. For larger updates on pages that bring in enquiries or orders, take a backup first and check the key pages straight after, because an update can occasionally break a layout or form.