Key takeaways
- Back up both files and the database, keep copies off the server, and test a restore, because an untested backup is only a hope.
- Use long unique passwords, two-step login and the least access needed, and update software and plugins promptly.
- Follow the 3-2-1 idea: three copies, two kinds of storage, one copy somewhere else.
- If hacked, change every password, restore a clean backup from before the infection and find how they got in.
Quick answer: how do you protect a website and its data?
Do five things. Use strong, unique passwords with two-step login on your hosting and site admin. Keep your website platform, theme and plugins updated, and delete what you do not use. Take automatic backups of both files and database. Store a copy away from your hosting. Test a restore.
These steps stop most attacks and, when something still goes wrong, turn a disaster into an inconvenience. Backups are the part most people skip, so we will cover them in detail first.
What does a website backup actually contain?
Most websites have two parts, and you need both.
- Files: the site's code, theme, plugins and uploaded images and documents. On a typical host, they live in the public_html folder or a folder for your domain.
- The database: the content that is stored in tables, such as pages, posts, orders, users and settings. WordPress and many other systems store most of the site's content here.
A backup of files without the database restores the look of the site but not its content. A database without files misses your images and theme. If you also use email on your hosting, mailboxes are a third item that needs separate backing up.
Also keep a copy of important configuration: the wp-config.php file on WordPress, your DNS records and a list of installed plugins and versions.
How do you back up a website from cPanel?
Most shared hosts use cPanel. Log in to your hosting control panel and follow these steps.
Download a full backup
- Open Backup (or Backup Wizard) under Files.
- Choose Back Up, then Full Backup.
- Select Home Directory and, if offered, enter your email for the notification. Some hosts disable this option, in which case use the partial method below.
- Click Generate Backup. Wait for the email or refresh the page.
- Download the archive file when it is ready and save it to your computer.
Download partial backups (files and database separately)
- In Backup, under Partial Backups, click Home Directory to download your files as a compressed archive.
- Under Download a MySQL Database Backup, click the name of each database.
- Save both files together in a dated folder, such as 2026-10-31-site-backup.
If you prefer to do it by hand
- In File Manager, open public_html, select all, click Compress, choose Zip and download the zip file.
- In phpMyAdmin, choose your site's database, click Export, leave Quick and SQL selected and click Export to download the .sql file.
Many hosts also run their own scheduled backups through tools such as JetBackup, visible in cPanel. Use them, but treat them as a bonus. They normally live on the same company's systems, so keep your own copy too.
A full cPanel backup archive often cannot be restored by you directly on shared hosting. Ask your host's support to restore it, or use the file and database parts separately.
How do you back up a WordPress website with a plugin?
If you use WordPress, a backup plugin makes the process automatic.
- In the dashboard, open Plugins, Add New, and search for a well-reviewed backup plugin such as UpdraftPlus. Install and activate it.
- Open its settings and choose a schedule for files and for the database. For a busy site, daily database backups and weekly file backups are a common pattern.
- Choose remote storage, such as Google Drive, Dropbox or another cloud destination, and authorise the connection. This is the step that gets copies off your server.
- Choose how many backups to keep, so storage does not fill up. Keeping several older copies matters because you may not notice a problem immediately.
- Run Backup Now and confirm the files appear in your cloud storage.
Duplicator and All-in-One WP Migration are also popular and are especially useful for moving a whole site. Whichever plugin you use, check each month that new backups appear and that the storage account has space.
How often should you back up and where should you store backups?
The right frequency depends on how much you can afford to lose.
- Brochure site that rarely changes: weekly, and always before any update or change.
- Blog or news site: daily for the database, weekly for files.
- Shop, booking or membership site: daily at minimum, and often more frequently for the database, because each order or booking is new data you cannot recreate.
Always take a manual backup before updating plugins, changing themes or editing code.
For storage, use the 3-2-1 idea:
- 3 copies of your data: the live site plus two backups.
- 2 different kinds of storage, for example the hosting account and a cloud drive, or a cloud drive and an external hard drive.
- 1 copy somewhere else, away from your hosting company.
A backup kept only on the same server as the website disappears with the website if the server fails, is hacked or your account is suspended. Good places include Google Drive, Dropbox, OneDrive or an external drive at home or the office. Protect the storage account with a strong password and two-step login, since backups contain your data.
If your internet connection is slow or costly, schedule large downloads on a stable connection and make sure your plugin compresses files.
How do you test that a backup really works?
A backup you have never restored is a guess. Test at least twice a year, and after major changes.
- Download a recent backup from your storage, not from the live site.
- Open the zip and check that it contains the site files and a database file of reasonable size. A zero-size or tiny file means the backup failed.
- Restore it somewhere safe, not over your live site. Create a subdomain such as test.yourdomain.com, or use a local tool such as LocalWP or XAMPP on your computer.
- Upload the files, create an empty database, import the .sql file with phpMyAdmin and update the database details in the configuration file (wp-config.php on WordPress).
- Open the test copy and check pages, images, forms and the admin login.
- Note how long it took and write the steps down.
That written procedure is your recovery plan. Keep it with your login details so anyone you trust can follow it in an emergency.
How do you secure your logins, access and software?
Most hacked small sites are not targeted individually. Automated attacks try weak passwords and known software flaws.
- Use long, unique passwords for your hosting, domain account, site admin, email and database. Use a password manager so you do not reuse them.
- Turn on two-step login for hosting, domain, email and the site admin. An authenticator app is stronger than text messages.
- Do not use admin as a username. Create a different administrator account and delete or demote the default one.
- Limit login attempts with a security plugin or host setting, and consider changing the login page address.
- Give least access. Make staff Editors, not Administrators, give each person their own account, and remove access when people leave.
- Update everything promptly: the platform, themes, plugins and PHP version. Turn on automatic minor updates where available, and take a backup before major ones.
- Delete unused themes and plugins, not just deactivate them.
- Never use pirated or nulled themes and plugins. They are a leading way for backdoors to enter a site, and they get no security updates.
- Use SFTP, not plain FTP, and delete old FTP accounts.
- Use HTTPS with an SSL certificate so data between visitors and your site is encrypted.
- Add a security layer, such as a reputable security plugin with firewall and scanning, or Cloudflare's free firewall features.
- Secure your own devices. A virus on the laptop you use for admin can steal your passwords, so keep it updated and scanned.
On WordPress, you can also turn off the built-in file editor by adding define('DISALLOW_FILE_EDIT', true); to wp-config.php, if you are comfortable doing this or have a developer do it.
How do you know if your website has been hacked?
Signs include:
- Your site redirects to strange pages, especially on phones.
- Pages or links you did not create, often in other languages or about medicines or gambling.
- Browser or Google warnings such as Deceptive site ahead.
- Unknown administrator users, or you cannot log in.
- Your hosting is suspended, or you receive abuse emails or notices of unusual resource use.
- Your own emails are bouncing or going to spam.
- Files changed recently that you or your developer did not edit.
Check how Google sees your site by searching site:yourdomain.com and looking for unfamiliar titles. Also check the Security issues section in Google Search Console. Some hacks show different content to search engines than to you, so a site that looks normal is not proof it is clean.
What to do right now if your website is hacked
- Stay calm and do not delete everything. You will need to learn how they got in.
- Take a copy of the hacked site and database as it is now, for investigation, then put the site in maintenance mode or temporarily offline if visitors are at risk.
- Contact your host. Tell them, and ask whether they have logs, malware scans or clean backups.
- Change every password, from a clean device: hosting, cPanel, FTP, database, site admin and the email accounts attached to them. Remove unknown users and FTP accounts.
- Restore a clean backup taken before the infection, or have a developer clean the site. Do not restore a backup that might already contain the malware.
- Update everything immediately after, and remove unused or pirated plugins and themes.
- Find the cause. Outdated plugin, weak password, infected computer or insecure FTP are common. Without fixing it, the hacker returns.
- Check for leftovers: unknown admin users, strange files, scheduled tasks and unfamiliar code.
- Clear warnings. If Google flagged your site, fix the problem and request a review in Search Console.
- Tell people if their data was exposed, such as customer details, and consider Nigeria's data protection rules if you hold personal data.
If your files and database were never backed up, cleaning is still often possible but harder and slower. This is the best argument for setting up your backups today. Get a developer involved when the site earns money, holds customer data or has been hacked more than once.
Frequently asked questions
How often should I back up my website?
As often as the site changes, and whenever you are about to change it. A brochure site might need weekly backups. A shop, booking site or one with daily content needs daily database backups at least. Always take a manual backup before updates, and keep several older copies.
Do small websites get hacked?
Yes. Most attacks are automated and scan the internet for weak passwords and outdated software, not for famous names. A small business site often has weaker protection, so it is an easy target. Hackers may use it to send spam, host fake pages or redirect your visitors.
Is a free SSL certificate enough to keep my site secure?
No. SSL gives you HTTPS, which encrypts traffic between the visitor and the site and removes browser warnings. It does not stop attackers who guess a weak password or exploit an outdated plugin. You still need updates, strong logins, limited access and tested backups.
Is the backup from my hosting company enough?
It is a useful safety net, but not enough alone. Host backups may be kept for a short time, may not be easy to restore and normally sit with the same company as your site. Keep your own copy elsewhere as well, and confirm how to request a restore.
What is the 3-2-1 backup rule?
Keep three copies of your data, on two different types of storage, with one copy kept somewhere else, away from the original. For a website, that might be the live site, a cloud-drive backup and a download on an external drive. It protects you from server failure, theft, mistakes and hacks.
Can I back up my website for free?
Yes. cPanel's Backup tool and phpMyAdmin export are free, and free versions of plugins like UpdraftPlus can send backups to a cloud drive. The cost is your time and discipline. Paid services add automation, monitoring and easier restores, which suit sites that make money.
How do I know my backup is not corrupted?
Check the file sizes, open the archive and, most reliably, restore it on a test subdomain or a local computer and confirm the pages, images and login work. Do this at least twice a year and after major changes. A backup you have restored successfully is one you can trust.
We repair laptops and build websites and business systems. Have a question this guide did not answer? Message us.
This guide is general advice. Every device and business is different, so if you are unsure, ask a technician before you act.
