Ananta Code Academy
 Continue to Day 28
MODULE 04 · ADVANCED & CAPSTONE

Security & Backups

A site that isn't backed up isn't really finished. Today you'll lock down the most common attack points and set up backups that would actually save you on a bad day.

Day 27 of 30 Intermediate ~16 min
01 · OVERVIEW

Why WordPress Sites Get Targeted

WordPress powers a huge share of the web, which makes it a common target for automated attacks — not because it's inherently insecure, but because outdated plugins, weak passwords, and unpatched core files are everywhere at scale.

Most attacks aren't a person manually targeting your site. They're bots scanning thousands of sites for the same handful of known weaknesses.

02 · THE MAIN ATTACK SURFACES

Where Sites Actually Get Compromised

Most WordPress security incidents trace back to one of a small number of entry points.

SURFACE THE RISK
Login page

Weak passwords and no rate limiting make brute-force login attempts easy.
Outdated plugins

Unpatched plugins are the single most common way sites get breached.
File permissions

Overly permissive file access lets malicious scripts write to your server.
No backups

Not a way in, but the reason a successful attack can become permanent data loss.
03 · THE 3-2-1 BACKUP RULE

A Backup Strategy That Actually Holds Up

A single backup sitting on the same server as your live site isn't really a backup — if the server goes down, so does the copy. The 3-2-1 rule fixes that.

backup-strategy.txt 
// The 3-2-1 backup rule
3 copies   // the live site plus two backups
2 formats  // e.g. server storage and cloud storage
1 offsite  // at least one copy stored away from the server
04 · LOCKING DOWN A SITE

A Basic Hardening Checklist

  • Update everything — WordPress core, your theme, and every plugin, right away.
  • Enforce strong passwords and enable two-factor authentication for every Administrator account.
  • Install a security plugin that adds login rate limiting and a firewall layer.
  • Remove unused plugins and themes entirely, rather than just deactivating them.
  • Set up automated backups that run on a schedule and store copies offsite.
    • 05 · MANUAL VS AUTOMATED BACKUPS

    Why Automation Matters Here

    MANUAL BACKUPS Rely on remembering to do it — the backup you forgot to take is the one you needed.
    AUTOMATED BACKUPS Run on a set schedule without depending on memory, with old copies pruned automatically.
    06 · COMMON MISTAKES

    Where Beginners Go Wrong

    CHECK YOUR SETUP FOR THESE
    NEVER TESTING A RESTORE A backup you've never restored from is unverified — you won't know it works until it's too late.
    "ADMIN" AS A USERNAME Using the default admin username makes brute-force attacks meaningfully easier.
    IGNORING UPDATE NOTICES Postponing plugin and core updates leaves known vulnerabilities open longer than necessary.
    07 · BREAKDOWN

    Breaking Down What You Just Learned

    1

    Most attacks are automatedBots scan for known, unpatched weaknesses rather than targeting you personally.

    2

    Updates close the biggest gapsOutdated plugins are the most common way sites get breached.

    3

    3-2-1 makes backups reliableThree copies, two formats, one offsite.

    4

    Automate what you can't rememberScheduled backups don't depend on anyone remembering to run them.

    5

    Test your restoresAn untested backup is only a hope, not a guarantee.

    08 · TRY IT

    Try It Yourself

    EXERCISE

    Install a backup plugin, run one manual backup, then actually restore it to a staging copy of your site to confirm it works before you need it for real.

    09 · TODAY'S PRACTICE

    Harden and Back Up Your Capstone Site

    HANDS-ON EXERCISE

    Getting your site ready to survive a bad day

    By the end of today, your capstone site should be updated, hardened, and backed up on a schedule you don't have to think about.

    1. Update WordPress core, your theme, and every plugin.
    2. Enable two-factor authentication on your Administrator account.
    3. Install a security plugin and enable its login protection.
    4. Set up automated backups with at least one offsite storage location.
    5. Restore a backup to a staging site to confirm it actually works.
    10 · RECAP

    Recap

    UPDATES

    The single biggest thing that keeps known vulnerabilities closed.

    3-2-1 RULE

    Three copies, two formats, one stored offsite.

    TWO-FACTOR AUTH

    A second layer of protection for every Administrator login.

    TESTED RESTORES

    A backup only counts once you've confirmed it actually restores.

    11 · SUMMARY

    Key Takeaways

    • Most WordPress attacks are automated bots exploiting known, unpatched weaknesses.
    • Keeping core, themes, and plugins updated closes the majority of those weaknesses.
    • Follow the 3-2-1 rule: three copies of your data, two formats, one stored offsite.
    • Automate backups on a schedule rather than relying on remembering to run them manually.
    • Always test a restore — an unverified backup isn't a real safety net.
    Course Overview