A backup is only useful if it can be restored. Protect copies from ordinary account compromise and document how to recover files, databases, and configuration. ## Step-by-step instructions 1. Identify site files, databases, uploads, and configuration that must be preserved. 2. Choose a regular backup schedule based on how often data changes. 3. Store a separate copy with access controls. 4. Encrypt sensitive backup files and protect credentials. 5. Restore a copy in a safe test environment. 6. Record recovery steps and repeat the restore test periodically. ## Final checks - Test the result in a realistic situation before relying on it. - Keep a note of any settings or decisions that need future review. - Recheck the process when your tools, hosting, or requirements change.
Security action plan
- Enable multi-factor authentication for privileged accounts and use unique passwords.
- Remove unused accounts and grant only the permissions each person needs.
- Patch dependencies and remove components that are no longer maintained.
- Keep separate backups and periodically test restoring them.
- Decide who receives incident reports and how access can be revoked quickly.
Respond to suspicious activity
Secure affected accounts, rotate exposed credentials, preserve relevant logs, and follow the affected provider's recovery guidance. Avoid sharing sensitive incident details publicly while investigating.