How To Bring Your Website Back From Disaster

Do you have a disaster contingency? What will you do when your site breaks beyond repair, or if your site traffic is being redirected to a malicious site? Creating a backup strategy for your site can really save your bacon. In this webinar, you will learn how to create and implement a successful backup strategy. You will learn how to bring your site back from disaster.

---

How To Back Up And Recover Your WordPress Website After Disaster

This webinar walks course creators and membership site owners through building a real WordPress backup and disaster recovery plan. Michael Moore from iThemes covers the seven steps to backup peace of mind, walks through the anatomy of a WordPress site and database, and demos setting up BackupBuddy, Stash Live, and iThemes Security so you can recover from a hack, an accidental deletion, or a server failure without losing sales, student progress, or trust.

What You’ll Learn

• Why a backup plan protects your sales, your students’ progress, and your time, not just your files
• The seven steps to a backup strategy that actually gives you peace of mind
• Which parts of a WordPress site, files versus database, actually need to be backed up
• How to decide how often to back up your site based on your tolerance for lost data
• How to set up BackupBuddy, Stash Live, and iThemes Security in a few minutes

Key Takeaways

• Back up your database at least once an hour on any site that takes payments or tracks student progress
• Store your backups off-site, never on the same server as your live site
• Scan every backup for malware before you trust it to restore from
• Practice restoring your site before disaster strikes, not during it
• Turn on the default settings in BackupBuddy and iThemes Security today. You can fine-tune later

Frequently Asked Questions

Full Webinar Transcript

Why Website Backups Matter For Course Creators

Chris Badgett: When your website is the business, you need more than an insurance plan. You need systems, processes, and knowledge in place so that when things do go wrong, you can get everything backing up and running again quickly and without a lot of problems. There are plenty of reasons your website could go down, and we will get into most of them today. Michael, where do we start?

Michael Moore: That is exactly why I am so fond of this community. My dad is this community. He is a small business owner, a personal development instructor, and he knows nothing about any of this. It is stressful and it is intimidating. What I want to do today is make it simple. This stuff is not as complicated as it feels, and it should not cause you anxiety. Coming back from disaster sounds negative, but it is actually a positive framing. If something goes wrong, you can fix it. It is not a big deal. We are going to set you up for success.

Every site benefits from backups, but it matters even more for you, because this is your business, your store, your livelihood. If your site goes down, the length of time it takes you to recover is money. It is lost sales.

Common Reasons Your WordPress Site Can Go Down

Michael Moore: Here are some reasons you should back up your site. Your site can get hacked, and a good backup is a quick way to get back up and running. Automatic updates are safer too. If you are worried an update might break your site, a solid backup means you can just roll back. It is not a big deal.

Accidental deletion is another one. BackupBuddy exists because of human error. We accidentally deleted a whole bunch of stuff on our own server and thought, it would have been great to have something to roll back from. That pain caused us to solve the problem so other people do not have to face the same pain.

Data corruption is the third big one. Say a customer is buying something, your server has a resource issue, and the purchase does not finish writing to the database cleanly. The table gets corrupted and the server can no longer read it. If you have a database backup, that is not a big deal either. You roll it back and you are good. All of this is nerve wracking, but if you have a plan in place, it should not cause you anxiety, because you already have the problem solved before it happens.

The Real Cost Of Lost Data And Your Seven Steps To Peace Of Mind

Michael Moore: The real cost of losing your data is a record of sales, student progress, customer trust, and time. Data is actually a terrible word for it, because what you are really losing is livelihood. As someone who takes online courses myself, I like seeing my progress. You did not lose my data, you lost my progress, you lost what was important to me, you lost my trust, and you lost my time.

I do not even own my own business, and I know time is the most valuable thing there is. If you do not have a good backup plan, you are going to spend more time getting your site back online, and the longer the site is down, the more sales you are going to lose. A good backup strategy creates peace of mind, and it comes down to seven steps. Choose a backup method. Decide what you want to back up and what you can leave out. Decide how often you need to back up. Schedule and automate your backups. Choose an off-site location to store them. Scan your backups for malware. Practice restoring. We will go into each of these in more detail.

Should You Let Your Web Host Handle Your Backups

Michael Moore: A question we get asked a lot is whether you can just let your host handle backups. It depends. Ask your host whether you are able to download the backup yourself, whether you would need their assistance to restore, and whether the backup is stored somewhere other than the server itself. If the server goes down and the backup goes down with it, you cannot use it to restore your site somewhere new. The longer your site is down, the more costly it is. If a site goes down and you can download the backup and restore quickly, people might not even notice it went down in the first place.

Manual Backups Versus A WordPress Backup Plugin

Michael Moore: You can back up your site manually. It is free and you are in full control. You use an FTP client or cPanel to download your files, and phpMyAdmin to back up your database. The restore and migration process is more advanced this way. The WordPress.org support documentation has instructions for backing up your site manually if you want to go that route.

The other option is a WordPress backup plugin. In most cases it is paid, but it automates your file backups and your database backups, and it usually has an easy restore method built in. Think of a WordPress plugin as a backup in a box. You get everything you need to back up your site in one product, and you do not have to worry about the rest.

What The Core WordPress Install Files Store

Michael Moore: Now you have to decide what to back up. The main structure of a WordPress site is your plugins, your themes, your media like images and videos, your WordPress core files, your uploads, and your database.

Looking at the WordPress install directory over FTP, the wp-admin and wp-includes folders hold the background files that make WordPress run. These two folders are not unique to your site. They are generic across every WordPress install. The rest of what you find in the directory is what makes that site your own.

Two other important files live in that same install directory. The `.htaccess` file is what a lot of plugins use to write rules the server follows, like forcing an SSL redirect from the HTTP version of your site to HTTPS, or blocking a banned user.

The other one is `wp-config.php`. This file holds your WordPress salts, which work like a security key, and your database credentials. It is unique to your site and it is one you absolutely want to back up.

What Lives Inside Your Wp-Content Folder

Michael Moore: Going further into `wp-content` is where the rest of what is unique to your site lives. You have your plugins folder and your theme folder. On this demo site there is also an upgrade folder, because iThemes Security has an auto-update feature enabled that uses it to update plugins automatically. Every plugin you have installed shows up here, and it lines up exactly with what you see on your Plugins page in wp-admin. The same is true for themes, and it matters even more if you are using a child theme or you have added custom code to your theme’s `functions.php` file.

You also have your uploads folder. If you accept form submissions or allow people to upload images, this is where that media gets stored, and it is also where a lot of plugins store their logs, including the iThemes Security file-based logs if you have that version enabled. `wp-admin` and `wp-includes` store the background files that make WordPress run. `wp-content` stores your plugins, your themes, and your uploads, which is where most of what makes your site uniquely yours actually lives.

What Your WordPress Database Actually Stores

Michael Moore: Now for your database. Every WordPress site has a unique table prefix. On this demo site I named the install “lifter,” so my options table shows up as `lifter_options`, and any LifterLMS setting change gets stored there. On a different test site I named “sync,” the same table shows up as `sync_options`.

The database is especially crucial for e-commerce and course sites that take payments, because this is where your student activity and your payment activity get recorded. This is the lifeblood of your business. The files on your server are what make your site look and behave the way it does. The database is your money and your students’ progress.

Inside the database you will also find LifterLMS quiz attempts, so anyone who takes a quiz has that recorded there. As someone who likes seeing my own progress in a course, that is exactly the kind of thing you do not want to lose. You will also find user postmeta with information like a student’s enrollment start date and their current enrollment status. This is information about your students that you cannot afford to lose. It is the brain of your business.

Where WordPress Pages And LifterLMS Courses Are Actually Stored

A viewer watching on YouTube asked where page content actually lives in the file structure.

Michael Moore: It lives in the database. On a typical non-WordPress website, a new page becomes a new HTML file. In WordPress, pages are rendered dynamically through PHP, so the page content itself is stored in the database. Images that appear on that page are a separate matter. Those are server files.

The same question applies to LifterLMS’s custom post types, like courses and lessons. The LifterLMS plugin’s own code lives in `wp-content/plugins` like any other plugin, but the courses and lessons you actually create with it are stored as posts in the database, the same as pages. Almost everything in WordPress, including pages, is considered a post under the hood, which is part of why this gets confusing. For backup purposes, the practical takeaway is that your content lives in the database and your media lives on the server, so a complete backup needs both.

Why The Database Is Part Of Your Hosting Package

Chris Badgett: Is the database something we are getting from our hosting, basically part of what we are paying for?

Michael Moore: Correct. Your host will give you the credentials and any specifics you need to access your database. WordPress is an application that sits on top of that database, and it needs the database to function. The server files are one layer, the database is another, and WordPress has to be able to talk to both. Take the database away and WordPress does not work. It is the brain. You would not be able to move your arm without your brain either.

How Often You Should Back Up Your Site

Michael Moore: The next thing to think about is how often you back up. How often does your content change, and how often do users interact with your site? If you run an LMS, that is probably pretty often. The number one question to ask yourself is how much tolerance you have for lost data. Can you lose a week’s worth and be okay? An hour’s worth? Somewhere in between? That answer tells you the frequency you actually need.

A good rule of thumb is to back up often enough to keep pace with how your site changes. If you run an e-commerce or course site with frequent sales, back up your database at least once an hour.

How Stash Live Backs Up Every Database Change Automatically

Michael Moore: If you are using Stash Live, you do not have to pick an interval at all. Any time a change is made to the database, it gets backed up automatically. If a student makes progress in one of your courses, that write to the database triggers an immediate, automatic send to your off-site Stash location. You do not have to think about it.

Chris Badgett: So instead of trying to guess an interval, hourly, daily, whatever, it is just: back it up whenever it changes.

Michael Moore: Exactly. Even with a course site, most of the interaction that matters, like a comment on a blog post or a quiz attempt, is a database write. Stash Live checks a few times a day for anything that changed since the last backup and sends just that. It also separates your backup out by plugins, themes, and other folders, so if one plugin update breaks your site, you can restore just that plugin instead of doing a full site restore. That is the difference between a minute and a half of downtime and a much longer one.

Database-Only Versus Full-Site Backups

Chris Badgett: A general question. Backup tools often give you the option to back up the database only, or the database and the files. What does that actually mean, and why would you choose one over the other?

Michael Moore: Do not cheap out on hosting and you will not have to worry about it as much. People will charge two hundred dollars for a course and then spend two dollars a month on hosting, and hosting comes with storage and bandwidth limits. If you have good hosting, my rule of thumb is back up everything. If you are on shared hosting with limited bandwidth and backing up your full site is going to slow down your users’ experience, back up the database first and worry about the server files later, since that is the part you are most likely to need in a hurry.

Think of it like a funnel. Requests are coming in: someone is signing up, someone is taking a course, and now a backup request is coming in too. Once you hit the bandwidth ceiling, everything throttles, and your users’ experience suffers because the funnel is too small for everything trying to get through it at once.

Why Cheap Hosting Can Sabotage Your Backup Strategy

Michael Moore: If your site is making you money, spend money on hosting. That funnel problem is also why scheduling matters. If you know your peak traffic periods, schedule your backup for the middle of the night when user interaction is low, so the funnel stays open for backups during off hours and stays open for your users during busy hours. It is the same reason a restaurant does not mop the floors while serving dinner.

Automate it, too. I use a bullet journal with a monthly list, a daily list, and a daily time-blocked list, and I still drop the ball sometimes because I am human. Automating your backup means you do not have to remember it. Set it and forget it, and focus on growing your business instead of the maintenance side of it.

What To Look For When Choosing WordPress Hosting

A viewer on YouTube followed up asking for reasonable prices on shared versus dedicated hosting.

Michael Moore: Price is only one factor. It depends on your needs and on what you are actually getting for your money. Check your PHP memory, which works something like RAM: if you do not have enough, the server kills the process with a memory exhausted error. Check your PHP execution time too. A bad host will not raise this, so if a process needs more than the default thirty seconds to complete, it times out and never finishes. Also check your monthly bandwidth allowance. If a piece of your content goes viral, what happens if you go over? Do you get charged a lot more, or does your site just go down?

If you are making money on your site, do not skimp. Get a plan with the PHP memory, execution time, and bandwidth headroom to support your growth, because as your user base grows, your database grows with it, and you will need the hosting to match. Full disclosure, I work for iThemes, which is owned by Liquid Web, a managed hosting company, and Liquid Web’s pricing compares well against other managed WordPress hosts, partly because they own their own infrastructure instead of reselling someone else’s cloud. If you are a newer site owner, iThemes Hosting is also worth a look for the same reason.

Why You Should Never Store Backups On The Same Server As Your Site

Michael Moore: Choosing an off-site location for your backups matters. It used to be that people kept backups on an external hard drive because cloud storage was not really an option yet, but hard drives fail. If you store your backup on the same server as your site, what happens when that server goes down? What happens if that server gets hacked? Would you feel confident restoring a hacked site from a backup that lived on the same compromised server? I would not. And if a natural disaster takes out that location entirely, and I live in Oklahoma so that is always on my mind, you want your backups somewhere else too.

Where To Store Your Backups For Real Redundancy

Michael Moore: Redundancy across multiple locations matters as much as being off-site at all. Amazon S3 stores your backup across multiple servers spread across a region, so if one part of their server farm goes down because of a natural disaster, another one somewhere else picks up the slack and you are still covered. Stash uses Liquid Web’s object storage for the same reason. Google Drive and Dropbox are cheap options too. I get a hundred gigabytes on Google Drive for about two dollars a month and keep all my family photos there as well. Do not just back up your site. Back up anything that matters to you.

BackupBuddy backs up to your own server by default, but for off-site storage you can use Stash, Google Drive, Dropbox, or Amazon S3. If you remember safety deposit boxes at a bank, this is the same idea: somewhere fireproof, away from the thing you are protecting. I keep a fire safe at my own house for exactly that reason.

Why You Should Scan For Malware And Practice Your Restore

Michael Moore: Scanning your backups for malware is another step worth taking. Every backup that goes to Stash gets scanned for malware automatically, so you know it is safe to restore from. If your site gets hacked and you are not scanning your backups, you could spend a lot of time and effort restoring a backup that still has malware sitting in it.

The most important step of all is practicing your restore. Think about why soldiers practice taking apart and putting back together their weapon. When the moment comes, they can do it without thinking, because there is already enough stress in the situation. You want to be able to restore your site under pressure without having to think about it, because if disaster does strike, it is going to be stressful, and downtime is money, lost trust, and lost sales.

I see this all the time in support. Someone installs BackupBuddy but never actually sets up a backup schedule, so there is no backup when they need one. Or they have a backup but never learned how to restore it, and their site sits down while they figure out how to use a plugin they bought two years ago. Do not skip this step.

How To Set Up BackupBuddy And Stash Live On Your Site

Michael Moore: Here is how quick this actually is. On a fresh install with BackupBuddy already installed, I go to BackupBuddy, then Stash Live, and enter my iThemes username and password. Thanks to a password manager for making it easy to have a unique password for every site. That is it. I am done.

Every BackupBuddy subscription comes with at least a gigabyte of Stash storage to get started, which is significant for a website, especially if you offload your media instead of storing it locally. Upload your videos to YouTube or Vimeo and play them on your site instead of hosting them yourself, and you can even set them to private. Vimeo Pro and Wistia are both popular with course builders for this reason.

The Difference Between Stash And Stash Live

Michael Moore: This part is a little confusing, and I wish we had named it more clearly. Stash is the remote destination itself. If Stash does not work for you, BackupBuddy can also back up to Google Drive, Amazon S3, or Dropbox, each of which takes a bit more setup, like creating your own app credentials for Google Drive.

Stash Live is the part of BackupBuddy that automatically sends a backup to Stash the moment your database changes, and it also scans your site a few times a day to catch any plugin updates or other changes and sync them. You enter your iThemes username and password once, and you genuinely do not have to think about the rest of it again.

How To Turn On The Basic iThemes Security Settings

Michael Moore: For security, pull up the plugin’s settings and click Secure Site under the security check. That single action turns on a set of basic protections that are not going to cause conflicts on your site. It gives you a solid baseline layer of protection right away, and you can go in afterward and fine-tune anything you want to adjust.

Chris Badgett: I want to call that out, because it is genuinely just installing two plugins with default settings turned on. You end up with a solid baseline, and only later, if you want to, do you go in and tighten or loosen specific dials.

How Brute Force Protection, Magic Links, And Recaptcha Work Together

Michael Moore: One setting worth turning on is network brute force protection. When a lot of different IP addresses get locked out across other sites connected to the iThemes network, those same IPs get blocked on your site too, before they even get a chance to try. Magic links are enabled by default as part of this baseline, so if you do get locked out, a link to recover access gets emailed to you automatically. Your site also gets scanned for malware twice a day as part of the same baseline setup.

reCAPTCHA takes a bit more setup, since you need your own Google reCAPTCHA keys, but it is worth turning on. It helps block bots from abusing open user registration and from spamming your comment section, while still letting real people through. If you are using version three of reCAPTCHA with the threshold set a bit higher, be aware that something like a browser autofilling your username and password can look automated to reCAPTCHA and get blocked at login, so test it after you turn it on.

What The iThemes Security Dashboard Shows You

Michael Moore: The security dashboard gives you an overview of what is happening on your site: any lockouts, any banned users, how your malware scans are going, any 404 detections, and any trusted devices you have set up. It also keeps a history of brute force attacks and tracks whether your plugins and WordPress core have been updating on schedule. You can customize the layout and share it with other users on your team. The goal is not to become a security expert. It is to glance at one dashboard, see if anything needs your attention, and get back to the work you actually care about.

What Backups And Security Give You Back As A Business Owner

Chris Badgett: The peace of mind piece is what stands out to me. If something on an e-commerce store gets hacked, and I have to restore from a day earlier, I can manually recreate whatever orders came in during that window. Knowing the worst case is losing an hour, or a day, instead of losing everything, is a huge amount of peace of mind. That maps directly to the tolerance question you asked earlier. For an e-commerce site, your tolerance for lost data is very low, which is exactly why the frequency matters so much. Without a backup, if something happened to your LifterLMS site, you would be starting over completely, and that is a very long road back.

Michael Moore: You are exactly right. This is really just installing a couple of plugins with default options turned on and then getting to forget about it. As a small business owner myself, that is the mindset I care about most, because when I think about our customers, I think about my dad. He does not have time to worry about this, and honestly he does not want to. If you do not have the time and you do not care about the technical side, that is fine. Install a couple of plugins, turn on the defaults, and go do the work you actually enjoy. Life is too short to spend it on maintenance you did not sign up for.

What Michael Moore Learned From His Father About Teaching And Growth

Chris Badgett: You have mentioned your dad a few times today as a professional trainer who has built a positive impact and earned a living doing it. What are some things you have learned from watching him?

Michael Moore: He has always taken care of himself physically so he can maintain the energy the work requires. He has never stopped learning either. He went back and earned an engineering degree just because he was curious about it. He is never satisfied that he knows enough about a subject, and he keeps growing, because if you are not growing, you are dying. Take care of yourself, and stay curious. Those are the two big ones.

He also genuinely cares about people. My stepmom told me a story about the two of them on a crowded, sketchy subway car in New York City, and my dad struck up a conversation with a stranger holding a baby, just asking how old the baby was, because that is his element. He is a people person.

Before I go, I want to say that LifterLMS is a genuinely well-built product. I have done a lot of testing and support work with membership plugins over the years, and there are some rough ones out there. This is not one of them. Anyone using it made a good choice.

Chris Badgett: We appreciate that, Michael. If you take one thing away from today, it is this: get these two plugins in place, turn on the default settings, and you are in a much better position for security, disaster protection, and the ability to recover quickly if you ever need to. That should help you sleep at night. Thank you so much for coming and sharing all of this.

Michael Moore: I had a lot of fun. Thank you.