No backups, no updates? A simple maintenance plan that keeps your business website safe

Your website was built a while ago. The developer, or the relative who made it, has moved on, nobody has logged in for months, and you are not sure who holds the passwords. The site still loads, so it feels fine. But nothing is being updated, and if something went wrong today, you do not know whether a backup exists or where it is.

Websites rarely fail all at once. They drift: an old plugin develops a security hole, the domain renewal reminder goes to an email address nobody checks, the contact form stops sending and nobody notices. A simple maintenance plan catches these problems while they are still small.

What happens when nobody looks after a site

• Outdated software, especially old WordPress plugins and themes, is a common way in for attackers.
• A hosting problem, a mistaken deletion or a failed update wipes content, and there is no copy to restore.
• The domain or the security certificate expires, and visitors see a warning or nothing at all.
• Forms and order emails stop working silently, and enquiries are lost for weeks.

First, take back control

Before any technical work, make sure the business owns its own website:

1. Find where the domain is registered, and get that login in the business's name, with an email address someone reads.
2. Get the hosting account login and the website's admin login.
3. Put the domain and hosting renewal dates in a shared calendar, with reminders well in advance.
4. Store all logins in a password manager, not in one person's memory or a notebook.
5. Turn on two-step verification wherever it is offered.
6. Remove old admin accounts for people who no longer work with you.

A routine that fits a small business

Every week, a few minutes:

• Open the site on a phone and check the main pages load.
• Send a test enquiry or order and confirm it arrives.

Every month:

• Take a fresh backup, then update the core software, theme and plugins. Where possible, test updates on a staging copy first.
• Remove plugins and themes you no longer use.
• Check that uptime monitoring is running and that its alerts reach someone who will act.

Every few months:

• Restore a backup to a test location to prove it actually works.
• Review who has admin access.
• Check page speed on mobile and fix anything that has slowed down.

Backups you can actually rely on

A backup only counts if you can restore it. Each backup should include both the website files and the database, run automatically on a schedule that matches how often your content changes, and keep several older versions. Keep at least one copy somewhere other than your hosting server, because a backup stored on the same server can be lost along with it. Your host's own backups are useful, but do not rely on them alone.

Your part and the developer's part

You or a staff member can handle the weekly checks, the renewal calendar and the password manager. A developer should handle updates on any site that takes orders or payments, restore tests, security hardening, and fixing conflicts when an update breaks something. Ongoing care like this is part of my website development service. If your site has already been attacked, start with recovering a hacked WordPress site instead.

Mistakes worth avoiding

• Updating everything at once without taking a backup first.
• Assuming the hosting company keeps backups you can restore whenever you need them.
• Domain auto-renewal linked to an expired card.
• One person holding every password, with nothing written down.

The smallest useful first step

This week, find out where your domain is registered and when it expires, and download one complete backup of the website to a place the business controls. Those two actions alone remove the worst risks. If you would like a proper maintenance plan set up, contact me.