Running a live site: roles, URLs, backups and security

Clients and employers care most about one thing: that the site keeps working. Good WordPress administration is a set of small routines that prevent the common disasters.

User roles

• Subscriber: can log in and manage a profile.
• Contributor: writes and edits own posts but cannot publish.
• Author: publishes and manages own posts.
• Editor: manages and publishes everyone's content.
• Administrator: controls plugins, themes, settings and users.

Give each person the lowest role that lets them do their job. A guest writer does not need Editor, and a marketing assistant rarely needs Administrator.

Permalinks

Choose a clean, readable structure such as post name when the site is new. Changing it later changes every URL, so links from search results and other sites can break. If you must change it, list the important old URLs, add 301 redirects, and test them afterwards. Also check that the search engine visibility option is switched off at launch; it is often left on from development.

Backups that actually restore

A full backup has two parts: the database, which holds posts, settings and users, and the files, mainly wp-content with uploads, themes and plugins. Store copies away from the web server, keep several dates, and test a restore on a staging site now and then. A backup you have never restored is only a hope.

Security and update hygiene

1. Use long, unique passwords and two-factor authentication for admin accounts.
2. Keep WordPress core, themes and plugins updated; most break-ins use known holes in outdated code.
3. Before a major update on a business site, back up, test on staging, then update live at a quiet time.
4. Delete unused plugins and themes rather than just deactivating them.
5. Protect wp-config.php, which holds the database password.

Weekly checklist: confirm the latest backup exists, apply pending updates after testing, review admin users, and open the home page and a key form to check they still work.