Skip to content

article

Security, updates, and backups on managed StretchWP sites

How StretchWP keeps sites patched and hardened, how scheduled backups and restores work, and what you should and shouldn't do to keep the managed protection intact.

The managed-maintenance model

On a self-hosted WordPress site, staying secure means personally applying core updates, plugin updates, and security patches, and hoping nothing breaks. On StretchWP, that maintenance is managed for you: updates are applied and monitored, the security plugin (Defender) hardens the site continuously, and backups run on a schedule so you always have a recovery point.

This article covers the three pillars — security, updates, and backups — and how to work with them rather than around them.

Security

Every StretchWP site runs the first-party Defender security layer, which provides:

  • Login protection against brute-force attempts and common credential attacks.
  • Firewall rules that block known malicious patterns.
  • Hardening — disabling risky WordPress defaults, protecting sensitive files, and enforcing safer configuration.
  • Threat reporting surfaced back to your workspace and WordPress dashboard.

Because security is centrally managed, you should not install a second security plugin. Two firewalls competing on one site cause lockouts and false positives.

Updates

WordPress core, the managed plugin suite, and security definitions are kept current for you. Updates to the Stretch plugin suite are delivered through the Hub as signed updates (cryptographically verified), so a site only accepts legitimate updates from Stretch, not a spoofed source. Version compatibility across the suite is coordinated so one update doesn't break another.

What this means for you:

  • You rarely, if ever, need to click "update" yourself for managed components.
  • Third-party plugins you install yourself are your responsibility to keep updated (or you can request they be managed).
  • If an update to a managed component ever caused an issue, a backup restore is available.

Backups and restores

The Snapshot plugin takes scheduled backups of your site's files and database. These backups are what make risky changes safe — if a theme edit, plugin, or content change goes wrong, you can restore to a previous point.

To request a restore:

  1. Open StretchWP in your workspace and select the affected site.
  2. Review available backups / recovery points.
  3. Request a restore to the point you want (before the problem occurred).
  4. Confirm. Restoring overwrites current site state with the chosen backup, so make sure you're not discarding wanted changes.

A realistic example

You install a third-party plugin to try a new contact form, and your homepage suddenly shows a fatal error:

  1. You open StretchWP and select the site.
  2. You request a restore to this morning's backup, taken before you installed the plugin.
  3. The site is rolled back and the homepage works again.
  4. You investigate the plugin separately (in a safer way) instead of leaving the live site broken.

Meanwhile, you never had to update core or the security suite manually — that happened on its own.

Tips

  • Back up before big changes. Backups run on schedule, but before a major redesign or a bulk import, note the most recent recovery point so you know your fallback.
  • A restore is destructive to newer changes. Anything created after the backup's timestamp is lost in a restore. Save/export new content you want to keep first.
  • Don't duplicate managed roles. No second firewall, no second backup plugin, no competing cache. Duplicates are the most common cause of "mystery" failures.

Troubleshooting

Locked out of your own login — Defender's brute-force protection may have triggered on repeated failed attempts (or a bot hitting your login). Wait for the lockout window to clear, or request help to whitelist your access.

A plugin you installed broke the site — restore to a backup from before the install, then approach the plugin differently.

You think a component is out of date — managed components update automatically; if the WordPress dashboard shows a nag for a managed plugin, it's usually cosmetic/timing. If a genuine third-party plugin needs updating, that one is yours to handle.

FAQ

How often are backups taken? On a regular schedule managed by Stretch. For a critical change, confirm the latest recovery point first.

Can I download a backup? Backups are used for restore within the managed service. If you need a portable export, request it through support.

Do I ever have to patch anything? Only third-party plugins/themes you personally added and chose to self-manage. The core stack is handled for you.

Was this helpful?

Help us improve this article

Use these controls to share whether this answer solved the issue. Feedback helps prioritize updates to StretchSuite Support.