SSL, Security and Backup: Protecting a Website

When the browser writes "Not secure" in the address bar, the message the visitor sees is not technical but psychological: "do not trust this place." Even on an ordinary storefront site that asks for no card details, that label chases customers away. The worst part: the fix is free and takes half an hour.

Let us start with the "what is an SSL certificate" question, but not stop there: SSL is only the first pillar of site protection. The second pillar is backup, the third is login security. Together the three are a small site's "insurance package" — and all of it gets set up in one evening.

What is SSL: the simple explanation

An SSL certificate (TLS, by its technical name) encrypts the communication between the browser and the server: the form data a visitor types, the password, any exchange becomes unreadable in transit. Its visible result is the https and the lock icon in the address. The certificate is also the confirmation that "this site really belongs to this domain's owner"; the first barrier against man-in-the-middle attacks.

In 2026, SSL is not a "nice to have" topic: browsers show http sites with an open warning, Google has counted https as a ranking signal for years, and on pages carrying payments and forms, encryption is simply mandatory.

How SSL is attached: three routes

• From the hosting panel (the most common): on most modern providers, a free Let's Encrypt-based certificate attaches with one button and renews automatically.
• On builder platforms: in Wix/Tilda-type services SSL is included as standard; you do nothing.
• Paid certificates: the extended-warranty and organisation-validated variants; they are for banking and corporate requirements, not a need for an ordinary business site.

After attaching, one step remains: redirecting all http traffic to https. The check is simple: type the address with http; if it switches to https automatically, it is done. If it does not, look for the "Force HTTPS" setting in the hosting panel.

The second pillar: the backup strategy

The question must be posed not as "if the site breaks" but as "when": a plugin conflict, a failed update, an attack, even your own mistake. Backup is the answer to all of these scenarios, and it has three rules:

• Make it automatic: the "when I remember" backup does not exist; a daily (active site) or weekly (static site) schedule.
• Keep it in a separate place: a copy on the server itself is lost together with a server problem; a copy sent to cloud storage is the real insurance.
• Test the restore: a backup that will not open is not a backup. One test restore a year; a habit rarely heeded, but one that makes the difference.

The hosting's own backup + an independent plugin copy (on WordPress) is a double cushion; we already noted this in the starter kit.

The third pillar: login security

The romantic image of site break-ins (a hacker, code, the matrix) is boring in reality: a weak password being guessed, a known hole in an old plugin, a brute-force attack on the "admin" user. The defence is correspondingly boring and effective:

• Strong, unique passwords + a password manager; the notion of "a password I memorise separately for the site" does not exist in 2026.
• Two-factor authentication: on both the hosting account and the site admin.
• A login-attempt limit: blocking after five failures; it renders brute force meaningless.
• Update discipline: the core, the theme, the plugins; an old version is an open door.
• Minimal permission: for each user, the role they need; "everyone is admin" is not team convenience but risk-sharing.

When a problem happens: a short protocol

The site will not open or behaves suspiciously: first write to hosting support (many problems are server-side and they can see), and in parallel check the date of the last backup. On suspicion of a break-in: all passwords get changed, the clean version is restored from backup, and whatever is un-updated gets updated. Write this sequence down today, not on the day of the problem; in the moment of stress one needs to read, not think.

Sources and further reading

Where to verify the source

The technical standards are stable, the tool steps changeable; check the current instructions at official sources.

• Let's Encrypt — getting started: the free certificate's official source
• WordPress — Hardening guide: the platform security's official list

Continuing the topic

Protection is the foundation; these topics come on top:

• Choosing hosting in 2026
• WordPress setup and the first settings
• Speeding up a website
• Cybersecurity: the basics for business
• Other articles on this topic

This evening's list: check the https redirect, set up automatic backup, switch on two-factor authentication. Three boxes, one evening; years of restful sleep.