A client's site was hit with malware one week after launch. Here's what I learned.

Yesterday was one of those days. One of my client's websites was hit with malware, and it wiped out almost everything: over 200 product photos gone, and every page deleted except three.

I won't lie. I cried when I saw it. We had just launched the site the week before, and a lot of care went into every one of those pages and photos.

How we got it back

Thankfully, we caught it fast. I contacted the hosting provider right away. They removed the malware and restored the site and its database from a backup taken before the attack. Within a short time, the photos and pages were back where they belonged.

It could have been so much worse. Without that backup, we would have been rebuilding the site from scratch: re-uploading every photo, re-writing every page, and hoping nothing was missed.

Let this be your sign

A lot of people think of a website as “set it and forget it.” Launch it, and it just keeps running. The internet doesn't really work that way. Automated bots scan websites around the clock looking for weak spots, and new sites get found just as fast as old ones. Here are the three things I tell every client.

1. Back up your website

A backup is the difference between a bad afternoon and starting over. A good backup plan:

• Runs automatically, daily for sites that change often, and at least weekly for everyone else.
• Includes everything: your files, your photos, and your database, where your pages, products, and settings live.
• Is stored somewhere else. Don't rely only on backups that sit on the same server as your site. If the server has a problem, so do the backups.
• Has actually been tested. A backup you've never restored is a backup you're hoping works.

2. Set up proper security

• Use strong, unique passwords for your website, hosting, and domain accounts, and turn on two-step verification wherever it's offered.
• Keep everything updated. Outdated plugins and themes are one of the most common ways attackers get in.
• Remove what you don't use. Old plugins, extra themes, and former employees' logins are all doors left unlocked.
• Give people only the access they need. Not everyone who writes a blog post needs full admin rights.
• Add a security tool that scans for malware and alerts you when something changes.

3. Block unnecessary traffic

Not every visitor to your website is a person. Much of the traffic hitting small business sites comes from bots probing login pages and looking for vulnerabilities. You can cut a lot of that off before it reaches your site:

• Use a firewall (often called a WAF) that filters out known bad traffic before it gets to your website.
• Limit login attempts so bots can't guess passwords over and over.
• Block regions you don't serve if your customers are all local. There's no reason for your admin login to accept visitors from the other side of the world.

Protect what you've built

You'd lock up your shop at night and insure your equipment. Your website deserves the same care. It's a real business asset, and it took real time and money to build.

If you're not sure whether your site is backed up or protected, let's find out. I'm happy to take a look and help you put the right safeguards in place, before you ever need them.