Security and Backups
Part of the GoodHost Knowledge Centre.
Nobody is targeting your website personally. That is the hardest thing to accept after a hack, and it is also the encouraging part, because almost everything that goes wrong is automated, opportunistic and preventable with fairly dull maintenance. Bots scan the entire internet looking for known holes, and they walk through whichever ones have been left open.
Website security in Australia is mostly the same problem it is everywhere, with one local wrinkle. You are quite likely running WordPress with a handful of plugins, and quite likely the only person who ever touches the site. Updates, backups and access control therefore land on you, or they land on nobody at all.
These guides cover the practical half of that: what certificates do and do not protect, what makes a backup worth having, and what to do in the first hour when something has clearly gone wrong. The security checklist is the one to print and work through. Restoring from a backup is worth reading before you need it rather than during, and the certificate explainer settles the question of whether you should ever pay for one.
What is a small business website really at risk from?
Automated scanning, overwhelmingly. Outdated plugins and themes with published vulnerabilities, weak or reused administrator passwords, and forgotten installs nobody has logged into for two years. Deliberate attacks on small Australian firms do happen, but the everyday risk is a bot finding a known hole and injecting spam or malware.
Who is responsible for security, you or your host?
The split runs roughly along the line between platform and application. Your host secures the server, the network and the software it provides. GoodHost cPanel plans run CloudLinux account isolation, Imunify360 and daily malware scanning. None of that will patch a plugin you have not updated or a password you reused.
What makes a backup actually worth having?
Three things. It runs often enough that losing everything since the last one is survivable. It is stored somewhere separate from the site itself. And you have restored from it at least once, so you know it works. GoodHost cPanel plans include daily backups with JetBackup emergency restores.
What is included at each plan level, and how the malware scanning and restore tools work in practice, is set out on the security page. If you are weighing a host on this rather than on price, ask what is scanned, how far back the backups reach and who restores them at 6pm on a Friday. The Knowledge Centre covers hosting, domains, WordPress and email alongside this section.