1. No Backups

Not having a backup solution in place is the number one mistake non-developers make. Backups in essence are the insurance you must have on your site. Simple mistakes quickly turn into worst case scenarios when you don’t have a backup – like forgetting to pay your hosting bill or having a server crash. In my experience, most website owners don’t have the time or resources on-hand to rebuild their entire website from scratch, which makes not having a backup catastrophic.

If you’re unsure about your current backup situation, first check your hosting provider. Some hosts like Media Temple can perform nightly backups automatically.

However, not all hosting platforms include a backup feature, so plugins can be another good option. Backup Buddy and Updraft both allow you to create your own backups and automate future processes. Other plugins out there allow you to export your backups to Google Drive or Dropbox, etc.

2. Not Taking Backups Before Running WordPress Updates

Software updates are a necessary part of the online world we live in, and even WordPress itself goes through core updates every so often. While you should always have your software running on the latest version, not every new update will play friendly with your unique website.

Before you ever click “update” for any software release, make sure you take a backup. The intent is to have a rollback point should some functionality or display become altered, or even break, as a result of running the update. If internal WordPress updates cause issues with your website, this is a good time to hire a developer who can squash the bugs introduced with the new software features.

3. No Staging Environment for Testing

Any time your website is undergoing changes or updates, a good rule of thumb is to test it in a neutral staging environment. Running any updates on a live website risks your users bumping into something broken, possibly even before you know there’s an issue.

This is especially true for more novice non-developers who rely mostly on Google to understand how to read and write code. A trial-and-error DIY approach can actually take you pretty far. But even simple copying and pasting can lead to major breaks you can’t solve on your own without a developer. With a staging environment, you get to see issues before you push them live. (As with backups, some hosts have plans with staging environments included.)

4. Not Using Child Themes

Most WordPress websites are built using themes. Using pre-made themes is arguably the easiest way for non-developers to build websites that look like they were done professionally. But any time you are making code changes to your website, it’s vital to ensure you’re changing the right theme.

Parent themes often run a large percentage of your website. Just like software, they occasionally need tweaks and updates. This means that when the theme is updated, any custom code changes get overwritten and lost. This is a huge hit if your theme makes up 70% or more of your website. This is where child themes come in handy. Keeping your changes within a child theme will allow you to update the parent theme without overwriting the custom code.

5. Using ‘Admin’ as Your Username

It makes sense why web owners would stick with a simple, default username setting. But having ‘admin’ as your username is actually an open invitation to hackers. In today’s world, automated bots commit the majority of WordPress hacks by mindlessly guessing a username and password anytime they detect a WordPress login form. This is what’s known as brute-force hacking, and it’s very avoidable.

You absolutely still need an administrative account for your website. Just name it literally anything other than admin. When your ‘admin’ user account no longer runs the functions for your website, you are safe to delete it permanently.

Changing the WP-admin path provides an extra layer of protection, since bots won’t be able to find your login page for brute force attacks. WordFence is an additional security plugin and has blocked more than 8 billion attacks just in the last 30 days. You can also use this plugin to change the default /wp-admin path to something unique.