[{"data":1,"prerenderedAt":1407},["ShallowReactive",2],{"blog-cat-maintenance-en":3},[4,233,726,948,1136],{"id":5,"title":6,"body":7,"category":210,"date":211,"description":212,"extension":213,"faq":214,"image":224,"meta":225,"navigation":226,"path":227,"readingTime":228,"seo":229,"stem":230,"updated":231,"video":231,"__hash__":232},"blog_en\u002Fen\u002Fblog\u002Fwebsite-backup-guide.md","How Do You Back Up a Website Properly? What, Where, and How Often",{"type":8,"value":9,"toc":200},"minimark",[10,18,27,32,38,44,55,59,66,74,82,86,89,117,120,124,127,135,139,182,185,189,192],[11,12,13,17],"p",{},[14,15,16],"strong",{},"The short answer:"," a real backup passes three tests - it includes the database and not just files, it's stored off the site's own server, and it has been verified with a real restore at least occasionally. Frequency? Match the site's rate of change: a store backs up daily, a blog weekly, a static site after every update. Everything else - below.",[11,19,20,21,26],{},"\"We have backups\" is one of the sentences I trust least - not because people lie, but because most backups have never been tested. The difference between \"we have a backup\" and \"we have a backup that works\" always reveals itself at the worst possible moment: after ",[22,23,25],"a",{"href":24},"\u002Fen\u002Fblog\u002Fwordpress-site-hacked-what-to-do\u002F","a hack",", after an update that broke everything, or after one deletion that was a little too quick.",[28,29,31],"h2",{"id":30},"what-do-you-even-back-up-depends-on-the-site","What Do You Even Back Up? Depends on the Site",[11,33,34,37],{},[14,35,36],{},"A WordPress site is two things, not one."," The files - theme, plugins, images - and the database, where all the content, users and settings live. Backing up only the files is a common and bitter mistake: you'll get back a beautiful, empty site. Any serious backup solution captures both together, from the same moment in time.",[11,39,40,43],{},[14,41,42],{},"A store adds a third layer:"," orders, customers and inventory change hourly. A nightly backup of an active store means a restore day can lose a full day of orders - which is why busy stores back up more frequently, and why the restore test matters double.",[11,45,46,49,50,54],{},[14,47,48],{},"A static site"," (the kind I build) is the easiest: the whole site derives from source code. With the code in version control, backup is built into the way of working itself - another quiet advantage in ",[22,51,53],{"href":52},"\u002Fen\u002Fblog\u002Fwordpress-vs-custom-website\u002F","the platform choice",".",[28,56,58],{"id":57},"where-its-stored-and-the-mistake-that-turns-a-backup-into-decoration","Where It's Stored - and the Mistake That Turns a Backup Into Decoration",[60,61],"blog-figure",{"alt":62,"height":63,"src":64,"width":65},"The three backup rules: database included, off-server, restore-tested",630,"\u002Fimages\u002Fblog\u002Fwebsite-backup-guide\u002Fbackup-rules-en.webp",1200,[11,67,68,69,73],{},"The classic mistake: a backup stored on the same server the site runs on. It feels like a backup, but everything that takes the site down - a breach, a fault at ",[22,70,72],{"href":71},"\u002Fen\u002Fblog\u002Fchoosing-website-hosting\u002F","the hosting provider",", a suspended account - takes it down too. A real backup lives elsewhere: external cloud storage, the backup service's own storage, or at least a completely separate account.",[11,75,76,77,81],{},"And adopt the modest version of the famous 3-2-1 rule: two copies in two different places, one of them yours - a periodic copy downloaded to your machine or your own cloud. It's also ",[22,78,80],{"href":79},"\u002Fen\u002Fblog\u002Fwho-owns-your-website\u002F","an ownership matter",": a backup that exists only at a vendor is one more key held by someone else.",[28,83,85],{"id":84},"how-often-by-what-hurts-to-lose","How Often? By What Hurts to Lose",[11,87,88],{},"The right question isn't \"how often do we back up\" but \"how much work are we willing to lose\":",[90,91,92,99,105,111],"ul",{},[93,94,95,98],"li",{},[14,96,97],{},"An online store, or any site taking orders"," - daily at minimum. A lost day = lost orders and angry customers.",[93,100,101,104],{},[14,102,103],{},"A site with a blog or updated content"," - weekly, plus a manual backup before any big change.",[93,106,107,110],{},[14,108,109],{},"A brochure site that rarely changes"," - a backup after every update is enough, provided it actually happens.",[93,112,113,116],{},[14,114,115],{},"And before every core or plugin update"," - always, regardless of schedule. That's the net under the tightrope.",[11,118,119],{},"The backing up itself is a machine's job, not human memory's: scheduled automatic backups are the requirement, manual ones the supplement.",[28,121,123],{"id":122},"the-test-that-turns-hope-into-a-backup","The Test That Turns Hope Into a Backup",[11,125,126],{},"A backup that has never been restored is a guess. Every few months - or at least once a year - do a real restore: stand up a copy of the site from the backup in a test environment and confirm it boots, the content is there, and the forms work. Half an hour of testing, and \"we have backups\" finally becomes a fact.",[11,128,129,130,134],{},"If you hold ",[22,131,133],{"href":132},"\u002Fen\u002Fblog\u002Fwhat-does-website-maintenance-include\u002F","a maintenance contract"," - this is exactly the question to ask the vendor: when was my backup last restored, and what came out.",[28,136,138],{"id":137},"the-five-minute-checklist","The Five-Minute Checklist",[140,141,142,149,156,162,168,175],"ol",{},[93,143,144,145,148],{},"Is the backup ",[14,146,147],{},"automatic","? (Not \"I download files when I remember\")",[93,150,151,152,155],{},"Does it include ",[14,153,154],{},"the database","?",[93,157,158,159,155],{},"Is it stored ",[14,160,161],{},"off the site's server",[93,163,164,165,155],{},"Does the frequency match the site's ",[14,166,167],{},"rate of change",[93,169,170,171,174],{},"Has anyone ",[14,172,173],{},"ever restored from it",", in a controlled test?",[93,176,177,178,181],{},"Can you ",[14,179,180],{},"reach it"," without whoever built the site?",[11,183,184],{},"Six yeses - you're ahead of most of the market. Fewer - now you know exactly what to fix.",[28,186,188],{"id":187},"bottom-line","Bottom Line",[11,190,191],{},"A backup is insurance that costs almost nothing and pays out exactly when everything burns. The formula is short: automatic, database included, off-server, at the pace of change - and verified with a real restore.",[11,193,194,195,199],{},"Not sure where your backups stand, or is the answer \"we'd have to ask whoever built it\"? ",[22,196,198],{"href":197},"\u002Fen\u002Fcontact\u002F","Send me a message"," - we'll check together, and if something's missing we'll fix it before it's truly missing.",{"title":201,"searchDepth":202,"depth":202,"links":203},"",2,[204,205,206,207,208,209],{"id":30,"depth":202,"text":31},{"id":57,"depth":202,"text":58},{"id":84,"depth":202,"text":85},{"id":122,"depth":202,"text":123},{"id":137,"depth":202,"text":138},{"id":187,"depth":202,"text":188},"Maintenance","2026-10-13","A backup that actually saves you: what must be in it (not just files), where never to store it, how often by site type - and how to know it works at all.","md",[215,218,221],{"q":216,"a":217},"What should a website backup include?","On WordPress: the files (theme, plugins, media) AND the database - the content, orders and users live in the database, and a files-only backup leaves you without the site's heart. A static site needs its source code; a store also needs orders and inventory.",{"q":219,"a":220},"Where should a website backup be stored?","Off the site's own server. A backup sitting on the same hosting falls with it - a breach, a provider fault or an accidental deletion takes both the site and its backup. The right destination is external cloud storage or the backup service's own, plus a periodic copy in your hands.",{"q":222,"a":223},"How often should a website be backed up?","By its rate of change: a store or any site taking orders - daily at minimum, because every lost day is lost orders. A content site updated weekly - weekly. A static brochure site - after every change. And above all: a backup never tested with a real restore is a hope, not a backup.","\u002Fimages\u002Fblog\u002Fwebsite-backup-guide\u002Fog-en.jpg",{},true,"\u002Fen\u002Fblog\u002Fwebsite-backup-guide",6,{"title":6,"description":212},"en\u002Fblog\u002Fwebsite-backup-guide",null,"JqbnIAiNaWFNX3Dvy5s5ZzpG1OfT1ts-gedx19iyt00",{"id":234,"title":235,"body":236,"category":210,"date":704,"description":705,"extension":213,"faq":706,"image":719,"meta":720,"navigation":226,"path":721,"readingTime":722,"seo":723,"stem":724,"updated":231,"video":231,"__hash__":725},"blog_en\u002Fen\u002Fblog\u002Fwebsite-not-secure-warning.md","Why Does the Browser Say My Website Is \"Not Secure\"? Five Causes, Five Fixes",{"type":8,"value":237,"toc":685},[238,243,246,250,258,261,281,284,293,296,300,303,329,338,342,346,351,363,367,376,392,396,411,415,418,436,440,446,450,539,543,557,565,569,600,608,612,618,624,628,631,635,638,664,667,669,672],[11,239,240,242],{},[14,241,16],{}," the browser says \"Not secure\" when the connection to the site isn't encrypted, meaning the page loads over HTTP instead of HTTPS, or when the security certificate that should encrypt it is broken: missing, expired, issued for a different name, or the page is encrypted but part of its content isn't. It doesn't mean you were hacked. All five cases are fixed in the hosting control panel, almost always for free, usually in under an hour. And from October 2026 it's more urgent: Chrome 154, rolling out to your customers this month, no longer settles for a grey label but asks the visitor whether they really want to go in.",[11,244,245],{},"The story usually starts on WhatsApp. A customer sends a screenshot of your site with a grey triangle next to the address and asks whether it's OK to leave their details. From now on you'll know exactly what to answer: what's broken, why, and what to do.",[28,247,249],{"id":248},"what-not-secure-means-and-what-it-doesnt","What \"Not Secure\" Means, and What It Doesn't",[11,251,252,253,257],{},"A site is \"secure\" in the browser's eyes when it meets two conditions: the connection to it is encrypted (that's the S in HTTPS), and a valid security certificate confirms that the server answering really belongs to the domain you typed. When either one fails, the browser flags it. That's all. It didn't check whether the site was hacked, whether it has malware, or whether the business owner is trustworthy. A perfectly clean site can be \"Not secure\", and a ",[22,254,256],{"href":255},"\u002Fblog\u002Fwordpress-site-hacked-what-to-do\u002F","hacked site"," can show a flawless padlock.",[11,259,260],{},"Two states look very different and are worth telling apart:",[90,262,263,275],{},[93,264,265,268,269,54],{},[14,266,267],{},"A grey \"Not secure\" label next to the address."," The page loads, just without encryption. Chrome has labelled every HTTP page this way ",[22,270,274],{"href":271,"rel":272},"https:\u002F\u002Fsecurity.googleblog.com\u002F2018\u002F02\u002Fa-secure-web-is-here-to-stay.html",[273],"nofollow","since version 68 in July 2018",[93,276,277,280],{},[14,278,279],{},"A full-page red screen: \"Your connection is not private\"."," The browser tried to encrypt, and something in the certificate didn't work out. Here the visitor has to click \"Advanced\" and proceed at their own risk, and most visitors don't.",[11,282,283],{},"About the icons: Chrome no longer shows a padlock for a healthy site but a small settings icon, and only Safari and Firefox kept the padlock. In Safari on iPhone, where most WhatsApp screenshots come from, there's no triangle: it simply says \"Not Secure\" in the address bar, and a certificate error shows a \"connection is not private\" page similar to Chrome's.",[11,285,286,287,292],{},"And October 2026 added a third state. ",[22,288,291],{"href":289,"rel":290},"https:\u002F\u002Fblog.google\u002Fsecurity\u002Fhttps-by-defau\u002F",[273],"Google announced"," that from version 154, which ships this month and rolls out to users over the following weeks, Chrome turns on \"Always use secure connections\" for public sites by default: before the first visit to a site without HTTPS, the visitor gets a dialog asking them to confirm they want to continue. It's already installed on my machine. An HTTP site in 2026 isn't \"slightly less trustworthy\", it's a site the browser puts a gate in front of.",[11,294,295],{},"And to the customer's question from WhatsApp, \"is it OK to leave my details?\": in a form on a page marked \"Not secure\", no. The details travel exposed. Phone or WhatsApp for now, the form after the fix.",[28,297,299],{"id":298},"the-one-minute-check-what-exactly-is-broken","The One-Minute Check: What Exactly Is Broken",[11,301,302],{},"Locate before you fix. Four steps:",[140,304,305,311,317,323],{},[93,306,307,310],{},[14,308,309],{},"Click the icon next to the address."," Chrome opens a small panel that says precisely: \"Connection is not encrypted\", \"Certificate has expired\", \"Certificate is not valid for this name\" or \"This page includes insecure content\". Most of the work ends here.",[93,312,313,316],{},[14,314,315],{},"Type the address by hand with https:\u002F\u002F at the start."," If it's suddenly secure, you have a certificate, nobody is just sending visitors to it.",[93,318,319,322],{},[14,320,321],{},"Try with www and without."," If only one of the two versions is secure, the certificate is registered for one name only.",[93,324,325,328],{},[14,326,327],{},"Open an inner page, not just the homepage."," If only a specific page is \"Not secure\", it contains mixed content, usually an image or video pasted in with an http address.",[11,330,331,332,337],{},"For a second opinion: ",[22,333,336],{"href":334,"rel":335},"https:\u002F\u002Fwww.ssllabs.com\u002Fssltest\u002F",[273],"the Qualys SSL test"," shows everything the browser knows about the certificate, including the expiry date and which names it covers. Look especially at the \"Chain issues\" line: if it says Incomplete, an intermediate certificate is missing from the installation, which explains why the site is fine in Chrome on a computer and red on an iPhone or in Firefox. Fix it by reinstalling the certificate with the full chain file (fullchain); most control panels do this on their own.",[60,339],{"alt":340,"height":63,"src":341,"width":65},"The five causes of the Not secure warning: no certificate, expired certificate, name mismatch, mixed content, no redirect","\u002Fimages\u002Fblog\u002Fwebsite-not-secure-warning\u002Ffive-causes-en.webp",[28,343,345],{"id":344},"the-five-causes-and-what-to-do-about-each","The Five Causes, and What to Do About Each",[347,348,350],"h3",{"id":349},"_1-no-certificate-at-all","1. No certificate at all",[11,352,353,354,357,358,362],{},"The site has lived on HTTP since it was built, usually because whoever built it didn't bother, or because the hosting company once charged for a certificate and you decided to postpone. ",[14,355,356],{},"The fix:"," in the hosting control panel look for SSL, Let's Encrypt or \"security certificate\", enable it and tick \"auto-renew\". It's free and a one-time job at most hosts. A host that still charges for a basic certificate in 2026 is ",[22,359,361],{"href":360},"\u002Fblog\u002Fchoosing-website-hosting\u002F","a good reason to move hosting",". After enabling, go to cause 5, because a certificate without a redirect is half a job.",[347,364,366],{"id":365},"_2-the-certificate-expired","2. The certificate expired",[11,368,369,370,375],{},"There was a certificate, it worked for years, and one morning everyone sees a red screen. The classic reason: auto-renewal failed silently. Let's Encrypt renewal verifies that the domain still points at the server, and if you moved DNS, added Cloudflare or blocked something in the firewall in the meantime, verification fails and nobody notices. And you specifically won't get an email about it: ",[22,371,374],{"href":372,"rel":373},"https:\u002F\u002Fletsencrypt.org\u002F2025\u002F06\u002F26\u002Fexpiration-notification-service-has-ended",[273],"Let's Encrypt stopped sending expiry notifications in June 2025"," and relies on automation altogether.",[11,377,378,381,382,385,386,391],{},[14,379,380],{},"The immediate fix:"," renew from the hosting control panel. ",[14,383,384],{},"The real fix:"," understand why the automation failed, or you'll be back here in 90 days. And this is about to matter more: ",[22,387,390],{"href":388,"rel":389},"https:\u002F\u002Fcabforum.org\u002F2025\u002F04\u002F11\u002Fballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods\u002F",[273],"the CA\u002FBrowser Forum decided in April 2025"," to shorten the maximum certificate validity from 398 days to 200 days from March 2026, to 100 days from March 2027, and to 47 days from March 2029. Anyone renewing by hand once a year will find the year ends quickly.",[347,393,395],{"id":394},"_3-the-certificate-is-for-a-different-name","3. The certificate is for a different name",[11,397,398,399,403,404,407,408,410],{},"The browser encrypts, but also checks who the certificate belongs to. If it was issued for ",[400,401,402],"code",{},"www.example.com"," only and the visitor goes to ",[400,405,406],{},"example.com",", they get the red screen, and vice versa. Another common version: a new domain pointed at the hosting, and what answers is the hosting company's default certificate, in its own name. ",[14,409,356],{}," reissue the certificate so it covers both names (most panels do this automatically when you tick both), and redirect everything to one version. Google prefers a single address too. If issuing for www fails, check that a DNS record for www exists at all; without a record there's nothing to validate. And subdomains like shop or app need their own certificate or a wildcard, the main domain's certificate doesn't cover them.",[347,412,414],{"id":413},"_4-mixed-content-the-page-is-encrypted-part-of-the-content-isnt","4. Mixed content: the page is encrypted, part of the content isn't",[11,416,417],{},"This is the most confusing case, because \"we do have SSL\". The site really is on HTTPS, but an image in the slider, an embedded video, a font or a chat script is still linked with an address starting in http. Modern browsers try to upgrade such images and videos to https themselves; when the upgrade succeeds you see nothing, and when it fails the component is blocked and the page gets flagged. Scripts over http are always blocked. The classic symptom: a \"secure\" site with missing images or a widget that won't load. Another variant: a form on an encrypted page that submits to an http address, where Chrome warns the moment you click \"send\" that the information is being sent insecurely.",[11,419,420,423,424,427,428,431,432,435],{},[14,421,422],{},"The fix in WordPress:"," first check that the site address in General Settings starts with https. Then run a search and replace in the database (a plugin like Better Search Replace, or WP-CLI if you're comfortable), from ",[400,425,426],{},"http:\u002F\u002Fyourdomain"," to ",[400,429,430],{},"https:\u002F\u002Fyourdomain",", after a backup. Whatever remains is almost always an address pasted by hand into the theme or a widget, and you find it through the browser's developer console (F12, Console tab, look for \"Mixed Content\"). As a safety net you can add a ",[400,433,434],{},"Content-Security-Policy: upgrade-insecure-requests"," header, which tells the browser to upgrade every request on its own.",[347,437,439],{"id":438},"_5-there-is-a-certificate-but-no-redirect","5. There is a certificate, but no redirect",[11,441,442,443,445],{},"The quietest cause: HTTPS works fine, but anyone arriving from an old link, a business card or by typing the address lands on the HTTP version and stays there. Two versions of the same site, one encrypted and one not. ",[14,444,356],{}," a permanent 301 redirect from every http address to its https equivalent, at the server level or in the control panel (in most panels it's a switch called \"Force HTTPS\"). Once the redirect has worked for two weeks without trouble, you can add an HSTS header that tells the browser not to try HTTP at all. Just know what you're switching on: with HSTS, an expired certificate shows a red screen with no \"Advanced\" button, there is no way around it. It's an upgrade for a site whose auto-renewal works, and a trap for a site that renews by hand.",[28,447,449],{"id":448},"summary-table-what-you-see-the-cause-where-to-fix-it","Summary Table: What You See, the Cause, Where to Fix It",[451,452,453,469],"table",{},[454,455,456],"thead",{},[457,458,459,463,466],"tr",{},[460,461,462],"th",{},"What the visitor sees",[460,464,465],{},"Likely cause",[460,467,468],{},"Where to fix it",[470,471,472,484,495,506,517,528],"tbody",{},[457,473,474,478,481],{},[475,476,477],"td",{},"Grey \"Not secure\", page loads normally",[475,479,480],{},"No certificate, or no redirect to HTTPS",[475,482,483],{},"Hosting control panel: SSL + Force HTTPS",[457,485,486,489,492],{},[475,487,488],{},"Red \"connection is not private\", mentions expiry",[475,490,491],{},"Certificate expired",[475,493,494],{},"Renew in the control panel, then find out why automation failed",[457,496,497,500,503],{},[475,498,499],{},"Red screen only with www (or only without)",[475,501,502],{},"Certificate for one name only",[475,504,505],{},"Reissue for both names + redirect to one",[457,507,508,511,514],{},[475,509,510],{},"Padlock missing on a specific page, images missing",[475,512,513],{},"Mixed content",[475,515,516],{},"Search and replace http in content and settings",[457,518,519,522,525],{},[475,520,521],{},"Secure when typing https, not secure from a link",[475,523,524],{},"No redirect",[475,526,527],{},"301 redirect + HSTS",[457,529,530,533,536],{},[475,531,532],{},"A Wix or Shopify site shows the warning",[475,534,535],{},"Domain connection not completed",[475,537,538],{},"The builder's control panel: domain verification and DNS",[28,540,542],{"id":541},"does-it-hurt-you-on-google","Does It Hurt You on Google?",[11,544,545,546,551,552,556],{},"Yes, but not the way people think. HTTPS has been ",[22,547,550],{"href":548,"rel":549},"https:\u002F\u002Fdevelopers.google.com\u002Fsearch\u002Fblog\u002F2014\u002F08\u002Fhttps-as-ranking-signal",[273],"a lightweight ranking signal since 2014",", and an HTTP site doesn't vanish from the results because of it. The real damage happens after the click: a visitor who meets Chrome's gate or a red screen goes back to the results, and your site got a visit that never happened. If the site ",[22,553,555],{"href":554},"\u002Fblog\u002Fwebsite-not-getting-leads\u002F","isn't producing leads anyway",", this is one of the first things to check.",[11,558,559,560,564],{},"There's another point most business owners don't think about: a contact form on an unencrypted page sends names, phone numbers and sometimes ID numbers in plain text across the network. ",[22,561,563],{"href":562},"\u002Fblog\u002Fprivacy-law-amendment-13-guide\u002F","Amendment 13 to Israel's Privacy Protection Law"," requires reasonable data security for a database, and an exposed form is not a good example of that. After moving to HTTPS, add a new property in Search Console for the https address, because Google treats it as a separate site, unless you set up a Domain property in advance that covers every version.",[28,566,568],{"id":567},"how-not-to-end-up-here-again","How Not to End Up Here Again",[90,570,571,577,583,589],{},[93,572,573,576],{},[14,574,575],{},"Auto-renewal on, and verified."," Not \"probably on\". Open the control panel and see the next renewal date.",[93,578,579,582],{},[14,580,581],{},"External monitoring."," Most uptime monitoring services, including the free tiers of some, can email you a few days before a certificate expires. A minute of setup, years of quiet.",[93,584,585,588],{},[14,586,587],{},"Every DNS or hosting change means re-checking."," Moved a domain, added Cloudflare, switched servers: that's the moment automatic renewals break.",[93,590,591,594,595,599],{},[14,592,593],{},"Know whose name the certificate and hosting are in."," If the only person who can fix it is \"the guy who built the site\" who doesn't answer, your problem is bigger than a certificate, and ",[22,596,598],{"href":597},"\u002Fblog\u002Fwho-owns-your-website\u002F","this checklist"," will help.",[11,601,602,603,607],{},"All of these are exactly the kind of thing ",[22,604,606],{"href":605},"\u002Fblog\u002Fwhat-does-website-maintenance-include\u002F","website maintenance"," is supposed to cover, and one of the reasons I insist on certificate monitoring for every site I'm responsible for.",[28,609,611],{"id":610},"two-traps-worth-knowing","Two Traps Worth Knowing",[11,613,614,617],{},[14,615,616],{},"Cloudflare in \"Flexible\" mode."," This mode encrypts between the visitor and Cloudflare, but not between Cloudflare and your server. The visitor sees a padlock, the data travels half the way exposed, and when you add an HTTPS redirect on the server you get an infinite redirect loop. Choose \"Full (strict)\" and install a real certificate on the server.",[11,619,620,623],{},[14,621,622],{},"The complaining page isn't yours."," Sometimes the warning comes from a builder, a booking system or a third-party landing page embedded in the site. If one fix after another doesn't help, check which domain the problematic content actually comes from.",[28,625,627],{"id":626},"no-control-panel-wix-shopify-and-hosted-builders","No Control Panel? Wix, Shopify and Hosted Builders",[11,629,630],{},"On Wix, Shopify, Elementor Cloud and the like there is no \"hosting control panel\", and the certificate is issued and renewed on its own. If such a site shows \"Not secure\", it's almost always an unfinished domain connection: the DNS records were pointed but the domain wasn't verified in the builder, or only one of the two versions (with www and without) was connected. Go into the builder's domain settings, complete the verification, and wait; sometimes it takes up to a day.",[28,632,634],{"id":633},"secure-for-you-red-for-the-customer","Secure for You, Red for the Customer",[11,636,637],{},"It happens, and it isn't always the site's fault:",[90,639,640,646,652,658],{},[93,641,642,645],{},[14,643,644],{},"The clock on the customer's device is wrong."," A certificate is checked against the device's date; a clock that slipped a year back makes every site \"not safe\". Common on old phones and computers with a dead backup battery.",[93,647,648,651],{},[14,649,650],{},"A very old device."," Android before 7.1 and a Windows that hasn't been updated in years don't know today's certificate authorities, and a perfectly valid certificate looks foreign to them. Nothing to fix on the site.",[93,653,654,657],{},[14,655,656],{},"Antivirus or an office network intercepting the encryption."," Some security software inserts its own certificate in the middle, and sometimes that fails. Test from a mobile network.",[93,659,660,663],{},[14,661,662],{},"A missing certificate chain."," The one case on this list that is yours: Chrome on a computer fills in a missing intermediate certificate by itself, iPhone and Firefox don't. The Qualys test from the first section will reveal it.",[11,665,666],{},"And after you've fixed it: the warning doesn't vanish for everyone at the same moment. Browsers remember pages, and CDNs remember versions. A hard refresh (Ctrl+Shift+R, or closing and reopening the browser on a phone) solves most cases, and anyone behind a CDN should purge its cache as well.",[28,668,188],{"id":187},[11,670,671],{},"\"Not secure\" is almost always one of five things, all fixable, most free, and none of them evidence of a hack. The check takes a minute, the fix usually under an hour, and prevention is an auto-renew switch and a monitoring service. And in the Chrome version reaching your customers this month, this is no longer cosmetic.",[11,673,674,675,679,680,684],{},"Site red and you can't find the switch? That's exactly the kind of problem ",[22,676,678],{"href":677},"\u002Fwebsite-rescue\u002F","website rescue"," exists for. ",[22,681,683],{"href":682},"\u002Fcontact\u002F","Write to me"," and we'll get the padlock back today.",{"title":201,"searchDepth":202,"depth":202,"links":686},[687,688,689,697,698,699,700,701,702,703],{"id":248,"depth":202,"text":249},{"id":298,"depth":202,"text":299},{"id":344,"depth":202,"text":345,"children":690},[691,693,694,695,696],{"id":349,"depth":692,"text":350},3,{"id":365,"depth":692,"text":366},{"id":394,"depth":692,"text":395},{"id":413,"depth":692,"text":414},{"id":438,"depth":692,"text":439},{"id":448,"depth":202,"text":449},{"id":541,"depth":202,"text":542},{"id":567,"depth":202,"text":568},{"id":610,"depth":202,"text":611},{"id":626,"depth":202,"text":627},{"id":633,"depth":202,"text":634},{"id":187,"depth":202,"text":188},"2026-10-08","\"Not secure\" doesn't mean you were hacked. A one-minute check that shows what's broken, five causes from expired certificate to mixed content, and each fix.",[707,710,713,716],{"q":708,"a":709},"Does \"Not secure\" mean my website was hacked?","No. The warning is about the connection between the visitor and the site, not about the site's content: it appears when the page loads without encryption (HTTP instead of HTTPS) or when there is a problem with the security certificate. A hacked site looks different - redirects to strange sites, pages you never wrote, Google's red \"deceptive site\" warning.",{"q":711,"a":712},"How much does an SSL certificate cost?","Usually nothing. Almost every hosting company issues a free Let's Encrypt certificate with one click from the control panel, and it encrypts exactly like a paid one. Paid certificates differ in insurance warranty and organisation identity validation, not in encryption strength.",{"q":714,"a":715},"How often does a security certificate need renewing?","Let's Encrypt certificates are valid for 90 days and renew automatically. Commercial certificates were issued for 13 months until recently, but since March 2026 the maximum validity dropped to 200 days, in March 2027 it drops to 100 days, and in March 2029 to 47 days. The conclusion: manual renewal is not a plan, only automatic renewal is.",{"q":717,"a":718},"The site is secure, but on one page the browser still complains. Why?","Almost always mixed content: the page itself is on HTTPS, but an image, video or script inside it is still linked with an http address. The browser tries to upgrade them, and when that fails it blocks them and flags the page. The fix is replacing the old addresses with https in the content and settings.","\u002Fimages\u002Fblog\u002Fwebsite-not-secure-warning\u002Fog-en.jpg",{},"\u002Fen\u002Fblog\u002Fwebsite-not-secure-warning",8,{"title":235,"description":705},"en\u002Fblog\u002Fwebsite-not-secure-warning","yXeo2Yx_9IovRW-o6Y1q9jsJ79NQbsgDiSI8eTREFBU",{"id":727,"title":728,"body":729,"category":210,"date":929,"description":930,"extension":213,"faq":931,"image":941,"meta":942,"navigation":226,"path":943,"readingTime":944,"seo":945,"stem":946,"updated":231,"video":231,"__hash__":947},"blog_en\u002Fen\u002Fblog\u002Fwhat-does-website-maintenance-include.md","What Does Website Maintenance Include, and Do You Really Need It?",{"type":8,"value":730,"toc":921},[731,736,739,743,747,753,759,768,774,785,789,792,798,806,809,813,825,828,832,835,861,868,872,875,906,909,911,914],[11,732,733,735],{},[14,734,16],{}," website maintenance is five things - updates, backups, security, monitoring and routine checks. A WordPress site needs all of them on an ongoing basis; a static site needs almost none of them. Everything else is detail, and the detail is exactly what this guide covers.",[11,737,738],{},"\"The site is live - so we're done, right?\" That's the question at the end of every project, and the honest answer is: depends which site you built. Some sites you really can forget about for months; others, without a hand on the wheel, turn slow, hacked or simply broken within half a year - exactly when your most important customer tries to leave their details.",[28,740,742],{"id":741},"what-ongoing-maintenance-actually-covers","What Ongoing Maintenance Actually Covers",[60,744],{"alt":745,"height":63,"src":746,"width":65},"The five maintenance components: updates, backups, security, monitoring, checks","\u002Fimages\u002Fblog\u002Fwhat-does-website-maintenance-include\u002Fmaintenance-checklist-en.webp",[11,748,749,752],{},[14,750,751],{},"Updates."," Core, theme and plugins receive security and compatibility updates constantly. The non-obvious part: you don't blindly auto-update everything - a major update can break the design or another plugin. Real maintenance is orderly updating, with a backup before and a check after.",[11,754,755,758],{},[14,756,757],{},"Backups - that someone has tested."," The difference between \"we have backups\" and \"we restored from backup successfully\" always reveals itself at the worst moment. A healthy backup is automatic, stored off the site's own server, and tested with a real restore at least occasionally.",[11,760,761,764,765,54],{},[14,762,763],{},"Security."," Malware scans, limiting login attempts, and removing old users who shouldn't be there anymore. For most businesses the breach doesn't come from a hacker who chose them - it comes from a bot scanning thousands of sites and finding an outdated plugin. ",[22,766,767],{"href":24},"What to do if it already happened - here",[11,769,770,773],{},[14,771,772],{},"Monitoring."," Someone (or something) that knows the site is down before customers find out. Automatic uptime checks and a security-certificate check - both are cheap to free, and both save you the pleasant call that starts with \"did you know your site's been down for two days?\".",[11,775,776,779,780,784],{},[14,777,778],{},"Routine checks."," Once a month: fill in the form and confirm the email arrived, walk the main pages on a phone, run a speed check. A form that sends to nowhere is ",[22,781,783],{"href":782},"\u002Fen\u002Fblog\u002Fwebsite-not-getting-leads\u002F","the quietest leak there is"," - nothing looks broken, there are just no enquiries.",[28,786,788],{"id":787},"wordpress-vs-a-static-site-the-maintenance-gap","WordPress vs a Static Site: The Maintenance Gap",[11,790,791],{},"The biggest difference in the cost of owning a website isn't in the build - it's here.",[11,793,794,797],{},[14,795,796],{},"WordPress"," is a living system: core, theme and dozens of plugins updating constantly, plus a database that needs backing up. That's not criticism - it's the price of flexibility and independent editing, and it's worth it for whoever uses them. But WordPress without maintenance isn't \"a site standing still\" - it's a site aging backwards.",[11,799,800,802,803,54],{},[14,801,48],{}," (like the ones I build in Nuxt) is pre-rendered files: no database to breach, no plugins going stale, almost nothing to maintain. It's one of the least-discussed considerations in choosing a platform, and I covered it in ",[22,804,805],{"href":52},"the WordPress vs custom guide",[11,807,808],{},"In other words: the maintenance question is decided on the day you pick a platform, not on the day you get a service-contract offer.",[28,810,812],{"id":811},"what-happens-without-maintenance","What Happens Without Maintenance",[11,814,815,816,819,820,824],{},"No drama on day one - quiet erosion. An outdated plugin becomes a back door and ",[22,817,818],{"href":24},"the site gets hacked"," without anyone noticing. Postponed updates pile up until one big update breaks everything at once. ",[22,821,823],{"href":822},"\u002Fen\u002Fblog\u002Fwordpress-site-slow\u002F","The site slows down"," gradually and Google quietly demotes it. And the form stops sending emails after a change at the mail provider, with nobody knowing how many enquiries were lost.",[11,826,827],{},"What all of these share: they don't look like a fault. They look like \"business is a bit slow this month\".",[28,829,831],{"id":830},"how-to-evaluate-a-maintenance-offer","How to Evaluate a Maintenance Offer",[11,833,834],{},"No numbers - just what to ask so offers can be compared seriously:",[140,836,837,843,849,855],{},[93,838,839,842],{},[14,840,841],{},"What exactly is included?"," \"Maintenance\" without detail is not a commitment. Updates? Backups? How many fix hours?",[93,844,845,848],{},[14,846,847],{},"What happens when the site goes down on a Saturday night?"," A defined response time is worth more than a long task list.",[93,850,851,854],{},[14,852,853],{},"Where are backups stored, and when was the last real restore?"," A mumbled answer here says everything.",[93,856,857,860],{},[14,858,859],{},"What's not included?"," Upgrades, design, content - get it in writing so neither side is surprised.",[11,862,863,864,54],{},"These questions belong to the wider set worth asking ",[22,865,867],{"href":866},"\u002Fen\u002Fblog\u002Fhow-to-choose-a-web-developer\u002F","before signing with any professional",[28,869,871],{"id":870},"what-you-can-do-yourself","What You Can Do Yourself",[11,873,874],{},"Even without a contract, four habits any business owner can adopt:",[140,876,877,884,891,897],{},[93,878,879,880,883],{},"Verify once that ",[14,881,882],{},"automatic backups"," exist - and that you can reach them without whoever built the site.",[93,885,886,887,890],{},"Enable ",[14,888,889],{},"auto-updates"," for minor security releases.",[93,892,893,896],{},[14,894,895],{},"Fill in your own form"," on the first of every month. Two minutes, saves enquiries.",[93,898,899,900,905],{},"Run the site through ",[22,901,904],{"href":902,"rel":903},"https:\u002F\u002Fpagespeed.web.dev",[273],"PageSpeed Insights"," monthly and watch the trend, not just the score.",[11,907,908],{},"And when do you need a professional after all? When there's WordPress with many plugins, when there's a store, or when the site is your main lead channel - then betting on \"it'll be fine\" is simply too expensive.",[28,910,188],{"id":187},[11,912,913],{},"Website maintenance isn't a scary tax and isn't a product every site must buy - it's a function of the platform you chose and how much the business leans on the site. A small static site manages almost alone; a business WordPress site without maintenance is a question of when, not if.",[11,915,916,917,920],{},"Not sure what your site needs? ",[22,918,919],{"href":197},"Send it to me"," - I'll tell you honestly whether you need monthly maintenance, a one-off checkup, or nothing.",{"title":201,"searchDepth":202,"depth":202,"links":922},[923,924,925,926,927,928],{"id":741,"depth":202,"text":742},{"id":787,"depth":202,"text":788},{"id":811,"depth":202,"text":812},{"id":830,"depth":202,"text":831},{"id":870,"depth":202,"text":871},{"id":187,"depth":202,"text":188},"2026-10-05","Updates, backups, security and monitoring - what monthly website maintenance really covers, why WordPress needs more than a static site, and what to DIY.",[932,935,938],{"q":933,"a":934},"What does website maintenance include?","Ongoing maintenance covers system and plugin updates, automatic backups that are actually tested, uptime and security monitoring, checking forms and contact flows, and tracking speed. The scope depends on the platform: a WordPress site needs real monthly care, a static site needs almost none.",{"q":936,"a":937},"Does every website need a maintenance contract?","No. A static site with no CMS can live for months untouched. A WordPress site or an online store without maintenance is a matter of time until a fault - a postponed update is the most common way to end up with a hacked or slow site.",{"q":939,"a":940},"What can you do yourself without a professional?","Verify automatic backups exist and are actually stored, enable auto-updates for minor security releases, fill in your own contact form once a month, and run the site through PageSpeed. Core updates and fault handling are better left to someone who can restore a site when something breaks.","\u002Fimages\u002Fblog\u002Fwhat-does-website-maintenance-include\u002Fog-en.jpg",{},"\u002Fen\u002Fblog\u002Fwhat-does-website-maintenance-include",7,{"title":728,"description":930},"en\u002Fblog\u002Fwhat-does-website-maintenance-include","5uY9kDNp7IDK8p2kC06YbIIAgK6fg8vgvqs_fVeOjt0",{"id":949,"title":950,"body":951,"category":210,"date":1128,"description":1129,"extension":213,"faq":231,"image":1130,"meta":1131,"navigation":226,"path":1132,"readingTime":228,"seo":1133,"stem":1134,"updated":929,"video":231,"__hash__":1135},"blog_en\u002Fen\u002Fblog\u002Fwho-owns-your-website.md","Who Actually Holds Your Website? The Domain, Hosting and Access Checklist",{"type":8,"value":952,"toc":1120},[953,956,963,967,977,983,989,995,1001,1005,1009,1026,1029,1035,1039,1045,1051,1057,1061,1091,1095,1098,1106,1110,1113],[11,954,955],{},"There's a kind of fault that doesn't look like a fault until it becomes a disaster: the site works perfectly, and then one day something needs changing - and it turns out you have access to nothing. The domain is registered to the guy who built the site six years ago. The hosting is on the credit card of someone who left. The admin password - \"I think the designer has it.\"",[11,957,958,959,962],{},"This isn't rare. It's one of the first things that surfaces in every ",[22,960,961],{"href":677},"site rescue",", and it's usually what eats the first week. Here's how to check it isn't your situation, and what to do if it is.",[28,964,966],{"id":965},"the-checklist-five-things-that-must-be-in-your-name","The Checklist: Five Things That Must Be in Your Name",[11,968,969,972,973,976],{},[14,970,971],{},"1. The domain."," The most important asset - it's the address every customer knows. Check who's listed as owner and administrative contact, and which registrar manages it. If you don't know, a free WHOIS lookup will show you at least the registrar. ",[14,974,975],{},"The email attached to the registrar account must be yours"," - it's the one that receives renewal notices.",[11,978,979,982],{},[14,980,981],{},"2. The hosting account."," Who pays, and who can log in. Hosting registered under the developer's account looks convenient until they stop paying - or stop answering - and the site disappears without notice.",[11,984,985,988],{},[14,986,987],{},"3. The admin system."," An administrator user in WordPress (or whatever you have) in your name, with a password you know and two-factor authentication tied to your phone. Not the developer's, not the designer's.",[11,990,991,994],{},[14,992,993],{},"4. The code and the backups."," Where backups are kept and how to restore them without the developer. On a custom site - where the code lives (a Git repository? a folder?) and whether you have access. A backup that sits only on someone else's computer isn't your backup.",[11,996,997,1000],{},[14,998,999],{},"5. The surrounding accounts."," Google Search Console, Google Analytics, the Google Business Profile, Tag Manager, the ad account, the mailing platform. Each needs at least one owner who is you - not merely an \"editor\".",[28,1002,1004],{"id":1003},"the-ten-minute-check","The Ten-Minute Check",[60,1006],{"alt":1007,"height":63,"src":1008,"width":65},"A WHOIS lookup - what you must know","\u002Fimages\u002Fblog\u002Fwho-owns-your-website\u002Fwhois-en.webp",[140,1010,1011,1014,1017,1020,1023],{},[93,1012,1013],{},"Look up the domain in a WHOIS service. The registrar and the expiry date should be known to you.",[93,1015,1016],{},"Try logging in to the registrar account. If you don't know how - that's your answer.",[93,1018,1019],{},"Try logging in to the hosting. Same.",[93,1021,1022],{},"Log in to the admin system with a user that's yours, and confirm it's an administrator, not an editor.",[93,1024,1025],{},"Open Search Console and the Google Business Profile, and confirm you're listed as owner.",[11,1027,1028],{},"Every step that fails is a point of dependency. Write it down.",[1030,1031,1032],"blockquote",{},[11,1033,1034],{},"A site you pay for but can't log in to isn't yours. It's rented - on terms nobody agreed to.",[28,1036,1038],{"id":1037},"what-to-do-when-something-isnt-in-your-name","What to Do When Something Isn't in Your Name",[11,1040,1041,1044],{},[14,1042,1043],{},"The developer is available and perfectly fine."," Most cases. Ask for an orderly transfer: the domain to a registrar account of yours, the hosting to your account, a new administrator user, and a list of access credentials. A decent developer does this without drama - usually they don't want to be responsible for your assets either.",[11,1046,1047,1050],{},[14,1048,1049],{},"The developer isn't answering."," First make sure the domain isn't about to expire - that's the urgent part. Then: registrars have procedures for transferring ownership given proof of belonging (invoices, correspondence, a site displaying your business details). It takes time, but it's possible. For hosting, it's usually easier to move the site to a new account than to recover the old one.",[11,1052,1053,1056],{},[14,1054,1055],{},"The domain has expired."," Most registrars give a short grace period for renewal, then a window where it can still be rescued at a higher cost. After that it's released to the market, and domains of active businesses get grabbed fast. If this has happened - it's today, not next week.",[28,1058,1060],{"id":1059},"the-habits-that-prevent-all-of-this","The Habits That Prevent All of This",[90,1062,1063,1069,1075,1081],{},[93,1064,1065,1068],{},[14,1066,1067],{},"Auto-renewal on the domain",", on your card, plus a calendar reminder a month before expiry regardless.",[93,1070,1071,1074],{},[14,1072,1073],{},"A dedicated email for technical accounts"," (admin@ your business, say) - not the personal address of whoever works for you right now.",[93,1076,1077,1080],{},[14,1078,1079],{},"One access document",", in a password manager, listing every account and its owner. Updated when someone joins or leaves.",[93,1082,1083,1086,1087,1090],{},[14,1084,1085],{},"On every new project"," - an ownership clause in the quote, before anything starts. ",[22,1088,1089],{"href":866},"It's one of the questions worth asking"," anyone building something for you.",[28,1092,1094],{"id":1093},"the-asset-that-hurts-most-to-lose-the-domain","The Asset That Hurts Most to Lose: The Domain",[11,1096,1097],{},"Of the checklist's five items, the domain is the one with no substitute: a website can be rebuilt, hosting can be swapped in an hour - but a domain registered in someone else's name that walks away with them takes the address every customer knows, the business's email, and the standing accumulated with Google.",[11,1099,1100,1101,1105],{},"If you're just starting a business, or considering a new address - I wrote a full guide on ",[22,1102,1104],{"href":1103},"\u002Fen\u002Fblog\u002Fchoosing-a-domain-for-your-business\u002F","choosing a domain right: co.il or com, picking the name, and whose name goes on the registration",". And if your existing domain is registered to someone else - that's the first item to fix, before everything else.",[28,1107,1109],{"id":1108},"the-bottom-line","The Bottom Line",[11,1111,1112],{},"Every disaster in this category is slow and quiet: years of \"it works, why touch it\" and then one week of panic. Ten minutes of checking today saves that week.",[11,1114,1115,1116,1119],{},"Not sure what's registered to whom? ",[22,1117,1118],{"href":197},"Send me the URL"," - I'll check what's publicly visible, tell you what's worth transferring, and if needed do the transfer properly.",{"title":201,"searchDepth":202,"depth":202,"links":1121},[1122,1123,1124,1125,1126,1127],{"id":965,"depth":202,"text":966},{"id":1003,"depth":202,"text":1004},{"id":1037,"depth":202,"text":1038},{"id":1059,"depth":202,"text":1060},{"id":1093,"depth":202,"text":1094},{"id":1108,"depth":202,"text":1109},"2026-08-30","Domain in the developer's name? Passwords with someone who no longer answers? The checklist that proves your site is really yours - and what to do if it isn't.","\u002Fimages\u002Fblog\u002Fwho-owns-your-website\u002Fog-en.jpg",{},"\u002Fen\u002Fblog\u002Fwho-owns-your-website",{"title":950,"description":1129},"en\u002Fblog\u002Fwho-owns-your-website","qfY84d6kALNsZSkio9HEqGWjA9pHW8OYJgeIttBuSkc",{"id":1137,"title":1138,"body":1139,"category":210,"date":1399,"description":1400,"extension":213,"faq":231,"image":1401,"meta":1402,"navigation":226,"path":1403,"readingTime":944,"seo":1404,"stem":1405,"updated":929,"video":231,"__hash__":1406},"blog_en\u002Fen\u002Fblog\u002Fwordpress-site-hacked-what-to-do.md","WordPress Site Hacked? The Order of Operations for the First Hour",{"type":8,"value":1140,"toc":1382},[1141,1144,1147,1151,1157,1163,1169,1173,1177,1180,1184,1187,1191,1195,1198,1202,1213,1217,1220,1224,1227,1231,1242,1247,1251,1254,1280,1283,1287,1308,1316,1320,1323,1358,1361,1365,1371,1373,1376],[11,1142,1143],{},"It usually surfaces in the evening, and the symptom sounds roughly like this: \"our site is redirecting to some gambling site in Japanese.\" Or \"Google says our site is dangerous.\" Or, the quieter and more dangerous version: \"the site looks fine, but something odd is showing in the search results.\"",[11,1145,1146],{},"So before anything else: this happens to a lot of sites, it's almost never personal, and in most cases it's fixable. But the order of operations matters, because some of the instinctive reactions actively make the cleanup harder.",[28,1148,1150],{"id":1149},"three-things-not-to-do","Three Things Not to Do",[11,1152,1153,1156],{},[14,1154,1155],{},"Don't delete the site."," The temptation is understandable - wipe it and start clean. But you've also deleted the evidence: which file changed and when, and how exactly they got in. Without that you'll close the current hole and keep the same hole for next time.",[11,1158,1159,1162],{},[14,1160,1161],{},"Don't restore a backup and go back to business."," A restore returns you to the point where the weakness still exists. If you haven't updated and haven't closed the way in, you'll be breached again - sometimes within days.",[11,1164,1165,1168],{},[14,1166,1167],{},"Don't assume it's only cosmetic."," A hack you can see is the less dangerous kind. The version worth worrying about is the one you can't: code that injects links only for visitors arriving from Google, or a new admin user sitting quietly.",[28,1170,1172],{"id":1171},"the-order-of-operations","The Order of Operations",[347,1174,1176],{"id":1175},"_1-put-the-site-in-maintenance-mode-dont-take-it-down","1. Put the Site in Maintenance Mode, Don't Take It Down",[11,1178,1179],{},"Maintenance mode stops the damage to visitors while leaving you access to work. Taking it fully offline hurts your traffic, your standing with Google, and your own ability to inspect what's happening.",[347,1181,1183],{"id":1182},"_2-change-passwords-all-of-them-not-just-the-sites","2. Change Passwords - All of Them, Not Just the Site's",[11,1185,1186],{},"WordPress admins, the database user, the hosting account, FTP\u002FSSH, and the email address the password reset is wired to. Plenty of breaches actually start at the email account or an infected local machine, not at the site.",[347,1188,1190],{"id":1189},"_3-check-who-the-users-are","3. Check Who the Users Are",[60,1192],{"alt":1193,"height":63,"src":1194,"width":65},"The users list - the most common tell","\u002Fimages\u002Fblog\u002Fwordpress-site-hacked-what-to-do\u002Funknown-admin-en.webp",[11,1196,1197],{},"In the WordPress users list - is there an administrator you don't recognise? Created on an odd date? That's the most common tell. Delete them, then also check users who look familiar but changed role.",[347,1199,1201],{"id":1200},"_4-identify-whats-infected","4. Identify What's Infected",[11,1203,1204,1205,1208,1209,1212],{},"Fastest route: compare against a clean source. WordPress core and plugins from the official repository can be downloaded again - any core file that differs is immediately suspect. What needs a human eye is ",[400,1206,1207],{},"wp-config.php",", the ",[400,1210,1211],{},"uploads"," folder (which should contain no PHP files at all), and the theme files.",[347,1214,1216],{"id":1215},"_5-clean-or-replace","5. Clean - or Replace",[11,1218,1219],{},"For core and plugin code: delete and reinstall from an official release. That's faster and safer than cleaning by hand. The theme and the content need judging on their merits. And any plugin no longer in use, or pulled from the repository, gets deleted entirely rather than just deactivated. A deactivated plugin still sits on the server.",[347,1221,1223],{"id":1222},"_6-update-everything-then-close-the-door","6. Update Everything, Then Close the Door",[11,1225,1226],{},"Core, theme and plugins to their latest versions. Then: two-factor authentication for admins, login attempt limits, and correct file permissions.",[347,1228,1230],{"id":1229},"_7-check-what-google-thinks","7. Check What Google Thinks",[11,1232,1233,1234,1237,1238,54],{},"Search Console has a \"Security issues\" report. If the site was flagged, submit a review request after cleaning. It's also worth running a ",[400,1235,1236],{},"site:"," search to see whether pages you never created have appeared - that's the quickest way to spot injected spam. I explained how to read that in ",[22,1239,1241],{"href":1240},"\u002Fen\u002Fblog\u002Fwebsite-not-showing-in-google\u002F","the Google indexing guide",[1030,1243,1244],{},[11,1245,1246],{},"A clean site that isn't updated isn't a secure site - it's a site that hasn't been breached again yet.",[28,1248,1250],{"id":1249},"why-it-happened","Why It Happened",[11,1252,1253],{},"Almost always one of four:",[140,1255,1256,1262,1268,1274],{},[93,1257,1258,1261],{},[14,1259,1260],{},"A plugin or theme that wasn't updated."," The overwhelming majority. A vulnerability gets published, and automated scans find sites that didn't update - not because anyone picked you, but because they scanned everyone.",[93,1263,1264,1267],{},[14,1265,1266],{},"An abandoned plugin"," that no longer receives security updates at all.",[93,1269,1270,1273],{},[14,1271,1272],{},"A weak or reused password"," that also exists somewhere else.",[93,1275,1276,1279],{},[14,1277,1278],{},"Poorly isolated shared hosting",", where one infected site infects its neighbours.",[11,1281,1282],{},"Note what isn't on that list: \"WordPress isn't secure.\" WordPress runs a substantial share of the internet and receives security updates at a good pace. What gets breached is almost always what surrounds it, and what wasn't updated.",[28,1284,1286],{"id":1285},"keeping-it-from-recurring","Keeping It From Recurring",[90,1288,1289,1292,1299,1302,1305],{},[93,1290,1291],{},"Regular updates, on a fixed rhythm. Not \"when someone remembers\".",[93,1293,1294,1295,1298],{},"Automatic backups stored ",[14,1296,1297],{},"off"," the server - a backup on the same server gets infected along with it.",[93,1300,1301],{},"Fewer plugins. Every plugin is another door.",[93,1303,1304],{},"Two-factor authentication for anyone with admin rights.",[93,1306,1307],{},"Simple monitoring that alerts when a core file changes.",[11,1309,1310,1311,1315],{},"That's exactly what goes into ",[22,1312,1314],{"href":1313},"\u002Fen\u002Fservices\u002Fwebsite-fixes\u002F","fixes and ongoing maintenance",", and it's the difference between a site that falls over once a year and one that doesn't.",[28,1317,1319],{"id":1318},"the-fifteen-monthly-minutes-that-save-this-whole-article","The Fifteen Monthly Minutes That Save This Whole Article",[11,1321,1322],{},"If you maintain the site yourself - here's the minimal monthly routine. Set a reminder; it genuinely takes a quarter of an hour:",[140,1324,1325,1331,1337,1343,1352],{},[93,1326,1327,1330],{},[14,1328,1329],{},"Updates"," (5 min): core, theme, plugins. Backup first, then update.",[93,1332,1333,1336],{},[14,1334,1335],{},"Backup check"," (3 min): not just that the backup ran - that it opens. An untested backup is hope, not a backup.",[93,1338,1339,1342],{},[14,1340,1341],{},"User list"," (2 min): any administrator you don't recognise? A role that changed?",[93,1344,1345,1348,1349,1351],{},[14,1346,1347],{},"Quick scan"," (3 min): a ",[400,1350,1236],{}," search on Google for pages you never created, and a glance at the Security report in Search Console.",[93,1353,1354,1357],{},[14,1355,1356],{},"Delete what's unused"," (2 min): a plugin that's been deactivated for two months isn't coming back - delete it. Every plugin is a door.",[11,1359,1360],{},"This doesn't replace professional maintenance for a business site that earns money - but it's the difference between a site somebody watches and a site quietly waiting for the next automated scan.",[28,1362,1364],{"id":1363},"and-the-way-to-never-meet-this-article-again","And the Way to Never Meet This Article Again",[11,1366,1367,1368,54],{},"Everything above - updates, tested backups, scans, monitoring - is exactly what ongoing website maintenance means, and it's the difference between \"I once read a guide about hacks\" and living one. I broke down the whole field - what's really included, the gap between WordPress and a static site, and what you can do yourself - in ",[22,1369,1370],{"href":132},"the full maintenance guide",[28,1372,1109],{"id":1108},[11,1374,1375],{},"A breach isn't the end of the world, but it is a wake-up call: it says something in the maintenance routine wasn't working. The cleanup is the short part. What decides whether it happens again is what you do in the week after.",[11,1377,1378,1379,1381],{},"Site hacked right now, or you're not sure? ",[22,1380,198],{"href":197}," - I'll go through it, tell you what's infected and what's clean, and clean and harden it end to end if needed.",{"title":201,"searchDepth":202,"depth":202,"links":1383},[1384,1385,1394,1395,1396,1397,1398],{"id":1149,"depth":202,"text":1150},{"id":1171,"depth":202,"text":1172,"children":1386},[1387,1388,1389,1390,1391,1392,1393],{"id":1175,"depth":692,"text":1176},{"id":1182,"depth":692,"text":1183},{"id":1189,"depth":692,"text":1190},{"id":1200,"depth":692,"text":1201},{"id":1215,"depth":692,"text":1216},{"id":1222,"depth":692,"text":1223},{"id":1229,"depth":692,"text":1230},{"id":1249,"depth":202,"text":1250},{"id":1285,"depth":202,"text":1286},{"id":1318,"depth":202,"text":1319},{"id":1363,"depth":202,"text":1364},{"id":1108,"depth":202,"text":1109},"2026-08-12","A hacked WordPress site: what to do in the first hour, how to clean it without deleting the site, what to check in Google, and why it happened.","\u002Fimages\u002Fblog\u002Fwordpress-site-hacked-what-to-do\u002Fog-en.jpg",{},"\u002Fen\u002Fblog\u002Fwordpress-site-hacked-what-to-do",{"title":1138,"description":1400},"en\u002Fblog\u002Fwordpress-site-hacked-what-to-do","1dMOJgtu0eFYwdZVLiJxXd9aZOtEWk7CTxNrHr6B6MQ",1792660232600]