Security & BackupsComparison
WordPress security
Separate useful free controls, paid threat-update timing and hands-on response services. Choose against your responsibilities and documented requirements.
5 min readRead
Security & Backups
Protect your website with practical guides to backups, restore tests, malware, firewalls and access controls. Plan recovery before something goes wrong.
Security & BackupsTutorial
A backup you can actually restore
Build a matching database and file backup, restore it in a separate environment and check the parts a successful download cannot prove.
6 min readRead
Security & BackupsBuying guide
NordVPN for website owners
Use NordVPN for connection privacy while managing a website. Learn how to set it up, choose the right features and keep account security separate.
7 min readRead
Recommended partner plans
US reference · Observed 2026-10-07
| Provider / plan | Initial amount or listed rate | Initial term | Renewal reference | View plan |
|---|---|---|---|---|
 Personal · 1 site, current annual promotion | US$49.50Exact annual amount published | 12-month term | — | Visit website Affiliate link. |
Compare plans
Initial terms differ. Check the billing basis, tax and included features before choosing.
Prepare for problems before they happen
Security & BackupsComparison
Hosting backups vs UpdraftPlus
Compare who controls the copy, retention, export and restoration. Start with the recovery process you need before adding a paid licence.
5 min readRead
Security & BackupsComparison
Wordfence vs Sucuri
Compare endpoint and cloud firewalls, hands-on cleanup scope and who will respond to an incident before buying WordPress security.
5 min readRead
More on Security & Backups
Security & BackupsExplainer
Can saved website content run unwanted code? Understand stored XSS prevention
Saved content is still untrusted when rendered. Separate plain text, rich HTML, links and other output contexts, then review every place the stored value is displayed.
6 min readRead
Security & BackupsTutorial
Prevent SQL injection
Use parameterized queries for data values and deliberate allowlists for query structure. Review the actual database boundary rather than relying on a plugin label or scanner result.
6 min readRead
Security & BackupsTutorial
A website security alert asks you to log in
Review a security warning through an independently known account route. Compare the actual activity and protect access without treating an authenticated sender as proof of a safe request.
6 min readRead
Security & BackupsExplainer
A valid-looking form is rejected
A form can look valid while its request protection is stale or mismatched. Trace the current session, token, origin and actual server result without disabling CSRF defenses.
6 min readRead
Security & BackupsTutorial
A third-party script changed
An integrity hash approves specific script bytes. Plan the version, CORS support and hash update together so an intended supplier update does not silently break your website.
6 min readRead
Security & BackupsTutorial
Remove a connected app’s access without deleting your account
Separate a connected app’s data permission, sign-in link and existing session. Revoke the intended access and check what happens to data already copied.
6 min readRead
Security & BackupsExplainer
CORS is not account security
CORS controls browser response sharing, not ownership of account data. Authenticate callers and check each object and action at the server, including nonbrowser requests.
6 min readRead
Security & BackupsTutorial
A private download link expired
A signed download URL is temporary access, not the file’s public address. Recheck entitlement, issue a fresh scoped link and keep cached or saved copies in the threat model.
6 min readRead
Security & BackupsTutorial
A password manager fills the wrong website account
When a password manager selects the wrong login, compare the destination, saved username, account context and competing autofill sources before editing or deleting anything.
6 min readRead