A backup that has never been tested in a restoration drill is an assumption rather than an actual disaster recovery plan.
Create a recovery plan, not just a backup file
Decide which data needs backing up, how frequently it changes, where copies will be stored, and who can restore them. Keep at least one copy separate from the live hosting account where practical. Set expectations for how much recent data can be lost and how quickly essential pages or services must return.
Update with a safe process
Keep the core platform, themes, libraries, and plugins current, but understand the effect of changes before applying them to a critical site. For complex websites, test updates on a staging copy and keep a rollback plan. Remove components that are no longer used and review administrative accounts periodically.
Test restoration and document ownership
A backup is only useful if it can be restored. Periodically restore a copy in a safe environment and verify that the site and its data work. Document who is responsible for updates, incidents, domain renewal, and hosting access.
Security action plan
- Enable multi-factor authentication for privileged accounts and use unique passwords.
- Remove unused accounts and grant only the permissions each person needs.
- Patch dependencies and remove components that are no longer maintained.
- Keep separate backups and periodically test restoring them.
- Decide who receives incident reports and how access can be revoked quickly.
Respond to suspicious activity
Secure affected accounts, rotate exposed credentials, preserve relevant logs, and follow the affected provider's recovery guidance. Avoid sharing sensitive incident details publicly while investigating.