Website backup and security: the minimum your business needs

Almost every company thinks its website has a backup. Few know where it is, how old it is, or whether it works. The question only comes up on the worst day: the site disappears, opens a strange page, or the host suspends the account, and someone asks, “can we put it back the way it was yesterday?”

Backup and security don't show up on screen. That's why they get left out of the budget and out of the contract. In this guide I use 2026 data to show the minimum your company's website needs and the questions to ask whoever runs it.

Why website risk went up in 2026

The typical business website runs on WordPress, with an off-the-shelf theme and a stack of plugins. Each plugin is software from another vendor, with its own vulnerabilities and its own patch schedule.

Patchstack's State of WordPress Security in 2026 report, updated in February 2026, has the numbers for 2025:

• 11,334 new vulnerabilities were found in the WordPress ecosystem, 42% more than in 2024;
• 91% were in plugins and 9% in themes; WordPress core had only 6, all low risk;
• 46% had no fix at the moment the vulnerability was disclosed;
• for the most exploited vulnerabilities, the median time between disclosure and mass attacks was 5 hours.

Read that last number again. Between a vulnerability going public and bots starting to probe thousands of sites, hours go by, not weeks. Updating “when there's time” no longer protects you.

And hosting doesn't catch everything. In Patchstack's own test with well-known hosting companies, only 26% of attacks on these vulnerabilities were blocked by the server. The rest reached the site.

What a real backup is

A backup isn't “the host keeps a copy.” It's a routine you can check. CISA, the US government's cybersecurity agency, sums up the minimum for small businesses with the 3-2-1 rule in its Back Up Business Data guide:

• 3 copies of important files;
• 2 different types of storage, like a drive and the cloud;
• 1 copy offsite, away from the business.

For a website, that becomes three practical rules:

1. Automatic backups. CISA calls for a routine that runs “automatically and regularly.” A backup that depends on someone remembering doesn't exist.
2. One copy outside your hosting. If the account is suspended, hacked, or canceled for nonpayment, a backup stored in the same place disappears with it.
3. Several days of history. CISA recommends being able to restore data from at least seven days back. A break-in is almost never noticed the same day; if the backup only keeps last night, you restore a site that's already infected.

The test almost nobody runs

The most overlooked step is testing. CISA advises testing restores to make sure the team can recover data both in full and in part, and putting those tests on the calendar.

In practice, a backup that has never been restored is a gamble. The file may be corrupted, incomplete, or missing the database. You only find out when you need it, which is the worst time.

The test is simple: load the copy in a separate environment, open the site, and check pages, forms, and images. Once a quarter already changes the game.

Minimum security for a business website

Backup is what saves you afterward. Security is what prevents the problem. For a business website, this is the minimum:

• Update on a fixed schedule. Platform, plugins, and theme updated every week, tested on a copy before going live. With attacks starting hours after disclosure, frequency matters more than effort.
• Keep plugins to a minimum. Every plugin you remove is one less door. If 91% of vulnerabilities are in plugins, cutting what you don't use is the cheapest fix there is.
• Avoid abandoned plugins. A plugin with no update in over a year won't get a fix when a vulnerability shows up.
• Strong passwords and two-factor authentication. On the site's admin panel, the hosting, the domain, and email. A leaked hosting password is worth more to an attacker than any plugin flaw.
• One login per person. No shared admin password in the team chat. Anyone who leaves the company loses access the same day.
• Accounts in the company's name. Domain, hosting, and admin panel registered to the company's tax ID and email, not the freelancer's. If that's already a problem, I laid out the steps in how to recover your website's domain and hosting.
• SSL certificate with auto-renewal. And someone who checks that the renewal actually ran.

None of this requires expensive tools. It takes a routine and someone responsible for it.

Custom code changes the math

Much of the risk comes from how the site is built. A WordPress site with 30 plugins has 30 different vendors to keep track of. A custom-coded site, with no exposed admin panel and no third-party plugins, has far fewer pieces to update.

Backups get simpler too. The code lives in a repository with the history of every version, so going back to yesterday takes one command. What needs copying is the data: forms, contacts, and uploaded files.

That's the case with the custom-coded sites we build and host on our own server, like amandanutri.com.br, a nutritionist's site with 100% online consultations and booking via WhatsApp, and conversaovisual.com.br, a course sales page that scored 99 out of 100 on Google Lighthouse in October 2026.

That doesn't mean every WordPress site should be thrown out. It means that when you compare quotes, the cost of keeping the site secure has to be part of the math. I broke down that cost in how much website maintenance costs per month.

Questions to ask whoever runs your site

Send these questions in writing to your agency, freelancer, or host. The answers tell you more than any proposal.

1. When was the site last backed up?
2. Where are the copies kept? Is any of them outside the hosting?
3. How many days back can I restore?
4. When was the last restore test, and what was checked?
5. How often are the platform and plugins updated?
6. How many plugins does the site have, and has any gone more than a year without an update?
7. Are the domain, hosting, and admin panel in my company's name?
8. Who tells me if the site goes down, and how fast?

If half the answers come back as “I think so,” the site is unprotected. And if the worst has already happened, start with the playbook on what to do when your website gets hacked.

How we do it at the Studio

At the Studio, backup and security come up before the site goes live, not after the first scare. You get a fixed price after discovery, and the deadline written into the contract. The code, files, and accounts, including domain and hosting, stay in the client's name. We have our in-house dev team, and we use Claude Code and Figma for design and build.

The custom-coded sites we build run on our own server with SEO and GEO from day one. And every system we deliver ships with an AI agent that runs daily, flags bugs, suggests improvements, and checks that the data makes sense.

If you can't answer the eight questions above about your site, that's exactly what our maintenance and ongoing evolution service is for.