A website nobody maintains stops being an asset
Most sites are not attacked because someone targeted them. They are attacked because an old plugin was left open and a script found it.
For anyone whose site has been live for over a year and who cannot remember the last time anything was updated on it.
A website is usually treated as a project. It gets built, it gets launched, everybody is pleased, and then nothing happens to it for three years. The problem is that a website is not a brochure sitting in a drawer. It is software, running on a server, connected to the internet, made of parts that other people keep changing.
How it actually goes wrong
Almost nobody is targeted. What happens is that a vulnerability is published in a plugin used by a few hundred thousand sites. Within days there are automated scripts crawling the internet looking for that plugin at that version. They are not interested in your business. They are looking for a place to host spam pages, or a mailer, or a redirect.
The owner usually finds out weeks later, and rarely from the site itself. A customer mentions the site is behaving oddly, or search results start showing pages in another language that nobody wrote. By then the spam pages are indexed and cleaning up is a much bigger job than the update would have been.
This is not hypothetical for me. A site I was involved with had ninety two thousand spam pages indexed before anyone noticed. Everything I do about maintenance now comes from that.
The five things that actually need doing
- 1
Updates, after a backup
Core, plugins and themes, on a schedule. The backup comes first, so an update that breaks something is a five minute problem rather than an evening.
- 2
Backups that live somewhere else
A backup on the same server as the site is not a backup. If the server is compromised or the host account is lost, both copies go together.
- 3
A restore that has been tested
This is the one everybody skips. A backup nobody has ever restored is a hope, not a plan. Test it once and you know.
- 4
Uptime monitoring
So that you learn the site is down from a notification, and not from a customer who tried to buy something two hours ago.
- 5
Somebody actually looking
Page counts, new admin users, the sitemap, the search results. Automated tools miss things a person notices in two minutes.
What this costs against what it saves
Maintenance is unglamorous and it is easy to cut, because when it is working nothing happens. That is the point of it. Cleaning a hacked site, getting spam pages deindexed and recovering the search rankings afterwards costs multiples of what the maintenance would have cost, and it takes months rather than hours.
One thing worth saying plainly, because plenty of people in this industry will not say it. No website can honestly be described as hack proof, and anyone who tells you theirs is either does not understand the problem or is hoping you do not. What maintenance does is close the doors that are actually open, and make sure that if something does get through, you find out quickly and can go back to a clean copy.
Written by Waqas Mehmood, who builds and maintains the sites described here. Lahore, Pakistan. If something in this is wrong or out of date, tell me and it gets corrected rather than quietly left up.