Level 3 · Advanced: essential plugins

3.4Security & backups

Goal: set up the WordPress security baseline and a tested automatic backup stored off the server.

Estimated time: 18 min · self-paced reading · If you only have 5 min: read “The essentials in 30s” + the diagram.

The essentials in 30 seconds

The absolute rule: automatic backups, stored off the server and tested — they save the site in the event of a hack, failure or mistake.
Baseline: no “admin” account, strong passwords, 2FA, up-to-date updates and a security plugin (Wordfence).
Updates and abandoned plugins are the first entry point: an up-to-date site is significantly safer.

Running mini-case — protecting Hassan's work

The workshop site contains photos, texts and soon a shop. Samir explains to Hassan that a failure or an attack can wipe everything in a few minutes. He sets up automatic backups with an external service, enables two-factor authentication and checks updates. He insists: a backup that has never been tested is not protection.

Sequel to case 3.3 — the site is fast; it must also be resilient.

1. The security baseline

WordPress is the most widely used CMS, and therefore the most targeted: bots testing passwords, vulnerabilities in outdated plugins, abused forms. A few measures block the vast majority of attacks: strong passwords, no account named “admin”, two-factor authentication (2FA), regular updates and a security plugin such as Wordfence.

Samir also checks the user list and deletes unnecessary accounts. He limits login attempts, monitors modified files and applies the principle of least privilege. Security is not a miracle product: it is regular hygiene.

2. Backing up and restoring

A complete backup contains the files and the database. It must be automatic, frequent and stored off the server (Google Drive, Dropbox, a dedicated service): a copy on the same server disappears with it. UpdraftPlus is the reference plugin for automating these copies.

The point people forget: test the restore. Samir runs a manual backup, then checks that he can restore it on a test environment. He documents the procedure so that Hassan or another provider can act in an emergency.

Common misinterpretation: “The host necessarily backs everything up.” No: host backups may be limited, short-lived or chargeable on restore. A backup you do not control and have never tested is not a guarantee.

Back up, store elsewhere, test the restore, document.

Text version of the diagram (SEO / screen readers / translation): 1) Automatic backup of files and database. 2) Off-server storage. 3) Restore test. 4) Documented procedure. In parallel: 2FA, updates, security plugin. Lesson: an untested backup is an assumption.

🔎 Concrete example — Protecting the workshop (Samir's case)

1. UpdraftPlus: daily backup, files + database.
2. Destination: Google Drive dedicated to the workshop.
3. Test: restore on a test site.
4. 2FA on all administrator accounts.
5. Wordfence: firewall + login limiting.
→ Written procedure handed to Hassan.

Result: a restorable site and a reassured client.

Lesson: the tested backup is the real insurance.

Section vocabulary

Backup

A complete copy of the files and the database, used to restore the site after an incident.

Simple example: a daily backup of the workshop.

What it is not: copying only the files and forgetting the database.

Reflex: files + database = complete backup.

UpdraftPlus

A popular backup plugin that automates copies and stores them off the server.

Simple example: backups sent to Google Drive.

What it is not: storing the copy on the same server.

Reflex: off-server = survives the failure.

Security plugin

Firewall and intrusion detection: Wordfence, Sucuri, Solid Security.

Simple example: Wordfence blocks repeated login attempts.

What it is not: believing a plugin replaces updates.

Reflex: security = several layers.

2FA

Two-factor authentication: a second factor beyond the password.

Simple example: a temporary code when an administrator logs in.

What it is not: sharing an admin account without 2FA.

Reflex: 2FA on all admins.

Attack surface

All exposed points: weak accounts, outdated plugins, forms.

Simple example: uninstalling unnecessary plugins reduces the surface.

What it is not: leaving inactive accounts with admin access.

Reflex: less exposure = less risk.

In practice — Setting up the security baseline

Install UpdraftPlus, schedule an automatic backup and store it off the server.
Run a manual backup and test the restore on a test site.
Check the accounts: no “admin”, strong passwords, 2FA enabled.
Install a security plugin and check that the core, theme and plugins are up to date.

A backed-up site hardened against most attacks: peace of mind through prevention.

Ready-to-use script — reassuring about security (30 s)

“Your site is backed up automatically every day, and the copy is kept off the server. If a problem occurs, we can restore it in a few minutes. I have also secured the logins and checked that everything is up to date.”

Do not promise invulnerability; promise a restore capability and security hygiene.

Copy-paste template — backup plan

FREQUENCY: _______________ (files + database)
OFF-SERVER DESTINATION: _______________
LAST RESTORE TEST: _______________
ADMIN ACCOUNTS (2FA): _______________
SECURITY PLUGIN: _______________
UPDATES: up to date / to do
WRITTEN PROCEDURE GIVEN TO THE CLIENT: yes / no

Brochure site

Daily backup with retention over several weeks.

Shop

More frequent backups: orders and customers change every day.

High-traffic site

Incremental backups and redundant storage.

Self-sufficient client

A simplified procedure and an alert if a backup fails.

Caution: Security and backups are the provider's responsibility: never promise invulnerability, always document the backups, their frequency and their location, and comply with the obligations to protect the personal data collected by the site (forms, customers, orders). A backup must be tested, and administrator access must remain named and limited.

✓ Best practices

Back up automatically off the server before anything else.
Test the restore at least once.
Enable 2FA and keep updates current.

✗ Common pitfalls

Storing the backup on the same server.
Never testing the restore.
Leaving “admin” or inactive accounts.

Key takeaways

Automatic off-server backup is the measure that saves everything.
An untested backup is not protection.
2FA, strong passwords and updates form the baseline.
Outdated plugins are the first entry point.

48h Challenge — apply tomorrow

Schedule an automatic off-server backup, run one manually and restore it on a test site. Enable 2FA on your administrator account. 30 minutes.

Section exit checklist

I set up an automatic off-server backup.
I know how to test a restore.
I apply the security baseline: 2FA, updates, least privilege.

Self-rating 1-5: can I restore the site?is my security baseline in place?

← Previous : Performance & cache (V3)Next : Contact forms (V3) →

Frequently asked questions

How often should I back up?

For a brochure site, a daily backup is a good balance. For a shop or a site that publishes a lot, several backups a day may be justified. The important thing is to keep several versions and test the restore.

Is a host backup enough?

Not necessarily: it may be limited, short-lived or chargeable on restore. Keep your own off-server backup, whose frequency and retention you control.

What should I do if the site is hacked?

Restore a clean backup, change all passwords, update and scan the files, then identify the vulnerability before putting the site back online. The procedure must be written in advance.

Check your understanding

What backup policy should Samir put in place for the workshop?

Additional resources (optional, to go further)

Doc

WordPress.org — Hardening WordPress

Level 3 examFresh, harder questions to test what you've learned