Backups, security updates and uptime monitoring, explained simply

If you've looked at website maintenance plans, you've seen these words: backups, security updates, uptime monitoring. They sound technical, and because nothing visible happens when they're done well, it's easy to wonder whether they matter.

They do. They're the website equivalent of locking the shop, keeping a spare key and having someone check the shutters at night. This post explains each one in plain language. For the bigger picture, see why your website needs maintenance after launch.

Backups: a spare copy of everything

A backup is a complete copy of your website, saved somewhere separate, so it can be restored if something goes wrong.

What can go wrong

• A change breaks the site, and nobody remembers exactly what it looked like before
• An update goes wrong, especially on WordPress sites with many plugins
• The website is hacked and pages are changed or deleted
• A hosting problem loses files
• Someone deletes a page by mistake

What good backups look like

• Regular: taken automatically on a schedule, not only when someone remembers
• Stored separately: not only on the same server as the website, so one problem can't take out both
• Kept for a while: several older copies, so you can go back to before a problem started
• Tested: someone has actually checked that a backup can be restored. An untested backup is a hope, not a plan.

Security updates: fixing weaknesses before they're used

Every piece of software has weaknesses that are discovered over time. When they're found, the makers release updates that fix them. Attackers know about these weaknesses too, and they use automated tools that scan the internet for websites that haven't been updated.

What needs updating

• The website software itself, such as WordPress or the framework it's built on
• Themes and plugins, which are a very common way in for attackers on WordPress sites
• The server and hosting software, usually handled by the hosting company
• The SSL certificate, which needs renewing. See HTTPS and SSL.

What happens without them

Out-of-date websites are a common target. A hacked small-business site might show spam links, redirect visitors to scam pages, send spam emails, or display a warning in Google that scares customers away. Fixing it afterwards takes far longer than keeping it updated.

Fewer moving parts, fewer risks

One reason we build with Next.js by default is that a fast custom site has far fewer plugins and moving parts to keep patched. That doesn't remove the need for updates, but it reduces the risk. See WordPress, Shopify or a custom website.

Uptime monitoring: knowing straight away if the site is down

“Uptime” simply means the time your website is up and working. Uptime monitoring is an automatic check that visits your website every few minutes, day and night, and sends an alert if it doesn't respond.

Why it matters

Without monitoring, a website can be down for days before anyone notices. Often the first person to find out is a customer who gives up and goes elsewhere. With monitoring, whoever looks after the site hears about a problem within minutes and can fix it quickly.

What can take a site down

• A hosting problem
• An expired domain or SSL certificate. See domain, hosting and SSL.
• A broken update
• An attack or a sudden flood of traffic

Passwords and access

Many problems start with access, not software. Use strong, different passwords for your hosting, domain and website accounts, and turn on two-factor authentication where it's offered. When someone who had access leaves, such as a former employee or designer, remove their access. Keep a short private record of who can log into what.

How often should each happen?

• Backups: automatically and regularly, with older copies kept for a period
• Security updates: whenever important updates are released, and checked regularly
• Uptime monitoring: continuously, every few minutes
• SSL: renewed automatically, with someone checking that it actually renewed

Doing it yourself

If you look after your own website, you can:

1. Turn on automatic backups with your hosting company, and check where they're stored
2. Keep a list of everything that needs updating, and check it every month
3. Sign up for a free uptime monitoring service that emails you if the site goes down
4. Put domain and SSL renewal dates in your calendar

It's not difficult, but it does need someone to do it reliably, month after month.

How our plans handle it

Every one of our maintenance plans, including Local Care, includes SSL, security updates, backups and website uptime monitoring, alongside hosting and keeping your Google listing details accurate. You can see how we build sites to be secure from the start on how we build.