Create an ownership record now
Record the domain registrar, DNS provider, hosting platform, content-management system, developer repository, analytics, form service and payment or booking integrations. For each one, identify the legal owner, administrator, renewal method and emergency contact.
Know what must be backed up
A WordPress site normally needs both files and the database. Other platforms may store content, media and configuration in different services. Static sites should have source files and deployment configuration under business-controlled access. Export content from hosted platforms where the provider supports it.
Keep independent recovery copies
A host's snapshot is useful, but an outage or compromised hosting account can affect it. Keep at least one recovery copy outside the live hosting account or under separate protected credentials. Choose retention long enough to reach a clean version from before an unnoticed problem.
Define the incident sequence
- Confirm the symptoms from another network or monitoring source.
- Preserve logs and current state where compromise is suspected.
- Identify whether the issue is domain, DNS, hosting, application, certificate or external service.
- Contain unauthorised access before restoring vulnerable code unchanged.
- Restore the appropriate files, database and configuration.
- Test pages, forms, transactions, analytics and email.
- Change compromised credentials and document the cause and prevention work.
Set recovery priorities
Decide whether a temporary status page, telephone number or alternative checkout route is needed while full service is restored. A brochure site and an online shop have different recovery needs, so define acceptable downtime before the incident.
Test a restore safely
Restore to a staging or alternate location rather than overwriting the live site without evidence. Confirm that content, media, users and configuration are complete. For WordPress, official guidance notes that both files and database are needed for a full recovery.
Prepare customer and regulatory communication
An outage is not always a personal-data breach, but unauthorised access or loss may require assessment. Decide who makes that decision and where specialist legal or data-protection advice will be obtained. Keep communication factual and avoid claiming resolution before testing is complete.
Authoritative resources
See the WordPress backup documentation for files and database requirements, and the NCSC small organisations guide for account, device and recovery fundamentals.
Need help applying this to your business?
Vengera can assess the current setup, explain the priorities and scope any practical improvements.