Keeping it alive and safe

The site that said "Christmas" in February

Rui runs a three-room guesthouse in Velas. In February, a guest tells him: "Your site says you have a Christmas offer on." Nobody remembered to change it. The same month, the browser starts showing a red warning to anyone who opens the site: the certificate has expired. And to top it off, the Instagram account is stolen. The password was the same as the email's.

None of these is serious if caught early. All of them cost a lot if nobody looks. A site is never finished: you keep it up, like the house where you welcome your guests.

The maintenance calendar

Put three tasks in your calendar, with an alarm.

Every month (15 minutes): are the opening hours and holidays right? Have you replied to all the reviews? Has anyone complained?
Every three months (half an hour): are prices, photos and texts still true? Do the links work? Did you make the backup?
Every year: the renewals. Domain, hosting, email and certificate. Most renew by themselves, but the card that pays for them expires. Checking the card date avoids a fright.

Tip

Put the renewal dates in the calendar a month ahead, with the service name in the title. If the card has changed, you have time to update it before the service drops.

Security in 4 rules

1. A different password for each service, in a password manager. Memorising dozens is impossible, and repeating is dangerous. The manager keeps them all behind a master password only you know. There are several, free and paid; pick one from a known provider and see the Current state page.

2. Two-step verification on everything. At the domain registrar, Google, social media, payments, email and the password manager. Even if the password is stolen, they do not get past the second step. Keep the recovery codes somewhere safe and outside your phone.

3. The "who has the keys" sheet. A sheet with three columns: the service, who has access, and how the account is recovered. When someone leaves (a helper, a nephew, an agency), you remove their access on each row and change the passwords you shared.

4. Backup. Once a quarter, export the site and the contact list and keep them outside the site itself: on an external drive or another storage service. Many site builders have an export option; look for a button with a name like "export" or "backup". If there is none, ask the provider how it is done.

Watch out

Never switch off two-step verification "because it is annoying". It is the most effective protection you have, and it is less work than recovering a stolen account. And never share a password by message: if you really must, change it right after the person has used it.

Measuring without spying

You do not need to know everything, only whether the site is doing its job. Once a month, open the statistics and look at three things: how many visits there were, which pages were seen most, and where people come from.

Search Console shows the Google searches that bring you people (the lesson on Google and maps).
Your host's or site builder's statistics, which usually come included.
Statistics tools without cookies, such as Plausible or Umami. Since they use no cookies, they need no cookie notice (see the previous lesson).

Ignore the rest: seconds per visit and charts that change nothing you do. If the price page is the most viewed, check the prices are right.

Tip

Ask one question a month and answer it with the numbers. For example: "How many people reached the Contact page?" If few did, the problem may be a hidden phone number, not the traffic.

If it goes wrong

Site down. Keep the contact of your host or site builder at hand, on paper and on your phone. Whoever knows what is going on answers faster if you tell them the time and what you see on screen.

Stolen account. Use the account recovery, change the password and switch on two-step verification. Look for posts or messages you did not write and delete them. If customer data was involved, warn them and talk to your accountant or lawyer.

Fake domain-expiry warning. An urgent message with a button is almost always phishing. Go to your registrar's site yourself, typed in the browser, and check the real renewal date.

Exercise

Write the "who has the keys" sheet: for each service, who has access and how the account is recovered.
Switch on two-step verification on every service in the sheet.
Make and keep a copy of the site and the contacts, outside the site itself.
Mark the renewals and the quarterly review in your calendar.
Look once at the statistics (Search Console or another) and note the 3 most viewed pages.

How I know it worked the keys sheet filled in, two steps on everything, a copy saved and the renewals in the calendar.

If it didn't work

Can't find two-step verification? Look in the account settings for a section with a name like "security" and an option with a name like "two-step" or "2-step verification".
Can't export the site? Ask the provider how to make a copy. If there is no way, note it: it is a criterion for your next site builder choice.
No statistics? Some platforms do not include them. Start with Search Console, which is free.
Lost the phone used for the two steps? That is what the recovery codes are for. Look for them in your keys sheet.

What you take from this level

Social media and WhatsApp: one network where your customers are, a rhythm you can keep up, and everything pointing to the site.
Bookings and appointments: a single calendar, automatic confirmation and reminder, and only the data you need.
Payments: methods with an invoice on every sale, and never card details by message.
Legal obligations: the list of 8 points, the complaints book and a privacy policy reviewed by people.
Maintenance and security: a calendar, unique passwords, two steps on everything and a copy outside the site.

What comes next

You have finished the course. Your online presence is up and has a maintenance routine. If you want to go further, there are two paths: the Artificial Intelligence course, for writing texts, answering customers and automating tasks with AI's help, and the Claude Code and Codex course, for those who want to code and automate with agents.