Prevention matters. So does a plan for the day prevention fails. A good backup plan is not a vague hope that “the host has something.” It is a short checklist you can follow while stressed.
What a usable backup plan includes
- Backups that are actually restore-tested
- A way to notice the breach early
- Access details for hosting, DNS, and admin accounts
- A restore path that does not put malware back online
- Who to call if you are stuck
Write it down. Keep it somewhere outside the site.
1. Backups you can trust
Aim for:
- Automatic backups (daily is a solid default for most sites)
- Off-site copies (not only on the same server)
- Retention long enough to go back before the infection started
- A restore test at least once, so you know the process works
Host backups help. A separate backup plugin or host snapshot strategy is better. Do not assume the newest backup is clean if the site has been compromised for weeks.
2. Detect the problem early
You want to know before Google Safe Browsing or your customers tell you.
Useful signals:
- Malware / file-change alerts from a security plugin
- Sudden admin users, odd plugins, or unexplained redirects
- Host security notices
- Google Search Console security issues
- Weird spikes in 404s, logins, or outbound spam
Security Ninja can scan for suspicious files, track events, and alert you when something changes. Pair that with scheduled scans so you are not relying on memory.
3. Keep access details ready
When things break, you need:
- Hosting panel login
- FTP/SFTP or SSH if available
- DNS registrar access
- WordPress admin credentials (in a password manager)
- Backup location and restore instructions
If wp-admin is locked, hosting or SFTP is often how you get back in.
4. Recovery steps (keep this short)
When you confirm a compromise:
- Put the site in maintenance / take it offline if visitors are at risk
- Notify the host and ask what they can see in logs or snapshots
- Identify when it started from logs, file dates, or the first odd admin/plugin
- Restore a clean backup from before that point
- Update everything, remove unused plugins/themes, rotate passwords, enable 2FA
- Scan again after restore so you do not relaunch with leftovers
- Close the hole (vulnerable plugin, weak login, old core, etc.)
Restoring alone is not enough if the original entry point is still open.
5. Decide in advance when to hire help
Restore-from-backup is often enough for a simple site. Hire help when:
- You are locked out of wp-admin and hosting is unclear
- Malware keeps returning after restores
- Customer data may be involved
- The site is revenue-critical and downtime is expensive
We offer fixed-price cleanup and security review if you want someone who does this regularly.
6. Customers, SEO, and legal basics
- Tell your team what is down and what passwords to rotate
- Use a maintenance page instead of serving infected pages
- Check whether customer data was exposed
- If GDPR or similar rules apply, know your notification duties before you need them (often measured in hours, not weeks)
A one-page plan beats a perfect document
You do not need a binder. You need:
- Where backups live
- How to restore them
- Who has hosting access
- Which security alerts you watch
- When you escalate to a specialist
Do that once, then keep backups running. Most “we got hacked and lost everything” stories are really “we had no clean restore point.”
