Your website, looked after

Care begins with the backup, because every other job depends on it. WordPress's own handbook says a small site should be backed up once a week and a busy one every day, with copies kept in different places². The US cyber agency CISA adds that one copy should live off-site and that backups should be test-restored on a schedule³. When fire hit an OVHcloud data centre in 2021, some customers lost their backups too, because the copies sat in the same building as the live server⁴.

Updates come next, and timing matters more than most owners think. When a security fix is published, the weakness it closes becomes public too, and in 2025 the typical gap before the first attack attempt was 5 hours, according to Patchstack, a company that sells protection against these flaws⁵. WordPress advises a backup before every update, so the site can be restored if something breaks⁶. A careful team backs up, tries the update on a staging copy, then opens the contact form, the booking page and the checkout to see that they still work.

Between updates, machines do the watching. A common uptime monitor checks a site every 5 minutes on its free plan and as often as every 15 seconds on paid plans⁷. Speed is measured against Google's targets, with the main content showing within 2.5 seconds for at least 75% of visits⁸. Security certificates need watching as well, because their maximum life is being cut from 398 days to 47 days by 2029, and Let's Encrypt, the most widely used free provider, stopped sending expiry reminder emails in June 2025⁹¹⁰.

When something does go wrong, the clock starts. Sucuri's published response times for cleaning a hacked site run from 30 hours on its basic plan down to 4 hours on its custom plans¹¹. Cleaning also means finding the way back in, since almost half of the hacked sites Sucuri repaired in 2023 had a hidden backdoor left by the attacker¹². A good care plan says in writing who answers, how fast and what happens next.