How often should I back up my website?

As often as you would be willing to lose work. A brochure site that changes monthly needs monthly backups; a store taking orders needs daily at minimum. The frequency matters less than two other things: storing them off-host, and having actually restored one.

Should I move my site off WordPress?

Only if it is causing a specific problem you can name. WordPress is the right answer for a site whose owner publishes frequently and needs a familiar editor. It becomes the wrong answer when the plugin stack has grown past what anyone maintains.

Do I need SSL on a website that takes no payments?

Yes. Browsers mark any HTTP page with a form as "Not secure", HTTPS is a confirmed ranking signal, and certificates are free with automated renewal on any serious host. There is no scenario in which a public business site should still be served over HTTP.

Security and hosting

Can my website get hacked if it has no login?

Yes. Most compromises are automated and target the software rather than an account: an outdated plugin, a vulnerable dependency, a misconfigured server, or credentials stolen elsewhere. Having no visitor login removes one route, not the category.

Answered by Anas Bin Masud 191 words 3 sections

How small sites are actually compromised

A plugin or theme with a known vulnerability, exploited by an automated scanner
An outdated server-side runtime the host has not upgraded
FTP or hosting credentials reused from a service that was breached
A file upload form that does not validate what it accepts
A dependency compromised upstream and pulled in by an update

What compromise usually looks like

Not defacement. Far more often it is spam pages injected into a subdirectory, hidden links added to your templates, or your server used to send phishing mail. The symptom is a Search Console warning or a deliverability collapse, discovered weeks later.

The defences that matter most

Keep everything updated, applying updates on staging first
Reduce the attack surface — remove plugins and features you do not use
Set security headers, especially a content security policy
Keep tested backups off-host so recovery is possible
Use unique credentials and two-factor authentication everywhere

The longer version

This answer is deliberately short. If you want the full treatment, Technical SEO, in the order the problems actually block you covers it in about 4 minutes — free, ungated, written from client work.

Who answered this

Anas Bin Masud builds e-commerce sites and does technical SEO for businesses in the UK, Canada and Pakistan — fifteen live client sites, six of them stores taking real payments. These answers come from those projects rather than from a content brief. More about how I work, or ask me something directly.