When things break: your recovery plan.
You know the threats now. This last lesson is the safety net: three checks anyone can run, the truth about backups, and exactly what to do when something breaks.
Only 27% of site owners have a breach recovery plan. Five minutes with this lesson puts you ahead of nearly three in four.
You know the threats. Now the safety net.
Hack costscustomers, rankings, data, money
#1 way inoutdated plugins, hit within hours
Fake emailsgo back yourself — never through the link
Your loginlong, unique, two-factor on
5-hour windowupdates can't be a monthly chore
Three checks. The backup truth. A recovery plan.
Three checks you can run today
Padlock, updates, backup — five minutes on any site, no expertise needed.
The truth about backups
Including the part nobody tells you about your host's "daily backups included."
What to do when something breaks
The 3-step response — plus a summary card with everything from this course.
The padlock. Ten seconds.
Look at your address bar. You want your web address to start with HTTPS and show a padlock — that means traffic between your visitors and your site is encrypted. No padlock, or a "Not secure" warning? That needs fixing today — it's the one check with a same-day fix.
Updates current?
Is your platform, your theme, and — above all — your plugins current? Last lesson's 5-hour window makes this the check that matters most. And if you don't know, that's the finding: "I don't know" is worth acting on. To look: log in to your site's admin — usually yoursite.com/wp-admin (WordPress), or the Updates / Apps section in Shopify, Wix, or Squarespace — and find its Updates page.
A backup you've tested.
The honest one. Almost every site has a backup — the question is whether it would come back. Backups fail silently: schedules stop, storage fills, files save without the database (the part of your site that stores form submissions and customer details — the files alone aren't the whole site). A backup you've never restored from isn't a backup — it's a hope. The test: does a restore actually work? Once a month, somewhere safe. Files and database, stored somewhere separate from your server.
Your host's backup is a baseline, not a plan.
Yes, your host keeps backups. But they often span only a few days, run on their schedule, and — critically — live on the same server as your site. If a hack ran quietly for three weeks, every recent backup already contains the hack. And a server failure takes the site and its backup down together.
One failure — or one quiet hack — takes down both.
Independent storage + depth in history + proof it restores.
The 4-step safe update.
on a staging copy — a full clone of your site
before touching the real site
to the live site
forms, pages, features all working
Skip the testing, and an update can silently break a form for weeks. Skip the backup, and there's no way back. Auto-updates skip both — which is why "set and forget" isn't the safe path it sounds like.
Your contact form stops receiving submissions after last night's auto-update. First move?
Restore from the most recent known-good backup, then test the update properly before re-applying
Correct. Speed first: get back online from a clean restore point, then run the safe 4-step update path so the break never reaches customers again.Leave it — forms break sometimes; visitors will email instead
Every silent day is lost leads. "It'll fix itself" is how small problems become weeks of missed business.Take the whole site offline until you find the cause
Taking the site down turns one broken form into a closed business. Restore first, investigate after.Re-run the same auto-update again and hope it completes properly
Repeating the untested change repeats the break. Test, back up, then apply.If something breaks — 3 steps.
from a recent backup if you have one — you're back in minutes
if you can't restore — disable whatever just changed
then solve the real problem — not duct tape
And through all of it: you don't have to do this alone. Forward the mess to whoever manages your site — if that's WebsiteCare.Direct, you email us the task, we handle it, and we email you when it's done. No jargon, no surprises. And if nobody manages your site right now? That's the first thing to fix — you just met the reason why.
The 5-minute security check.
Everything from this course, on one card. Get the printable card — print it or save it as a PDF, and stick it by the desk. And when anything feels off — send it to whoever manages your site. That's what they're for.
Visitors report weird downloads · Google warning · data oddities · recovery pain
Padlock (HTTPS) · Updates current · Backup tested by a real restore
Suspicious email? Don't use the email to respond — go back yourself.
Long, unique admin password · two-factor login ON
TEST → BACK UP → APPLY → VERIFY — never skip steps
RESTORE → ROLL BACK → FIX PROPERLY
websitecare.direct/learn · Keep Your Website Safe
One small assignment: run the three checks this week.
Padlock. Updates. Backup. Five minutes, real peace of mind — that's the assignment. Run the checks this week, and make it stick. Or make this the week you stop being the safety net yourself — monitoring, tested updates, tested backups, and a real human on call. From $49/month, month-to-month, no contract.