solobuild
Most solo founders know their website needs SSL, a firewall, and backups. Fewer could explain what each one does, which threats it covers, and which gaps remain once all three are in place. That fuzziness costs money in two ways. Some people pay for overlapping protection they already get from their host, while others assume a padlock icon means the site is safe and skip the one thing that would have saved them. This guide explains each piece in plain terms, shows how they fit together, and gives you a short setup you can finish in an afternoon.
SSL: the lock on the delivery truck
SSL (more precisely TLS, its modern version, though almost everyone still says SSL) encrypts the connection between a visitor's browser and your server. When someone types a password or a card number into your site, SSL makes sure nobody sitting on the same coffee shop Wi-Fi can read it in transit. It also proves the visitor is talking to your real domain and not an impostor. The padlock in the address bar and the https at the start of the URL are the visible signs that it is working.
What SSL does not do matters just as much. It protects data while it travels, and that is all. It does nothing to stop someone from logging into your admin panel with a guessed password, exploiting an old plugin, or uploading malware to your server. A hacked site can still show a perfectly valid padlock. Think of SSL as an armored truck carrying your mail. The truck is secure, but it does not lock the doors of the building it delivers to.
The good news is that SSL is now free and usually automatic. Let's Encrypt, a nonprofit certificate authority, issues free certificates, and most hosts install and renew them for you. SiteGround, for example, includes a free SSL certificate on all three of its shared hosting plans. Cloudflare's free plan also provides what it calls Universal SSL for any domain you route through it. Unless you have a specific compliance requirement, there is little reason to pay for a certificate in 2026.
One change is worth knowing about. Certificate lifetimes are getting shorter across the industry. The maximum dropped to 200 days in March 2026, it falls to 100 days in March 2027, and it reaches 47 days in March 2029. Let's Encrypt is moving faster, with its default certificates set to shrink to 64 days in February 2027 and 45 days in February 2028. If your host renews certificates automatically, you will not notice. If you ever installed a certificate by hand, now is the time to switch to automatic renewal, because a manual process that worked once a year will break when renewals come every six weeks.
WAF: the bouncer at the door
A WAF, or web application firewall, sits in front of your website and inspects incoming requests before they reach your server. It looks for patterns that match known attacks, such as someone trying to inject database commands through a contact form, hammering your login page with thousands of password guesses, or probing for a known hole in an outdated plugin. Requests that look malicious get blocked, and normal visitors pass through without noticing anything.
It helps to separate a WAF from the ordinary firewall on a server. A traditional firewall decides which ports and network addresses can connect at all. A WAF works one level higher and understands web traffic itself, so it can tell the difference between a real customer submitting a form and a bot stuffing that form with attack code. For a small site running WordPress or any other content system with plugins, this is the layer that catches most of the automated attacks that hit every site on the internet daily.
There are two common ways to get one. The first is through your host. SiteGround advertises anti-bot and DDoS protection plus custom firewall rules on all of its plans, along with daily malware scanning. The second is a cloud WAF that sits between visitors and your host, which you set up by changing your DNS. Cloudflare's free plan includes a basic managed ruleset and five custom rules, and its Pro plan at $20 per month billed annually unlocks the full managed rulesets. Sucuri sells a standalone firewall starting at $9.99 per month, and its Business Platform plan at $549 per year bundles the WAF with monitoring and unlimited malware cleanups.
A WAF is not a substitute for keeping your software updated. It buys you time when a new vulnerability is announced, and it filters out a large share of background noise. If you leave an abandoned plugin installed for two years, though, eventually something will get through. The firewall reduces your risk, and good habits close the rest of the gap.
Backups: the spare key in a safe place
Backups are the only one of the three that helps after something has already gone wrong. SSL and a WAF try to prevent problems. A backup lets you recover from the ones prevention missed, including problems that have nothing to do with attackers, like a botched plugin update, a theme change that breaks your layout, or your own late-night deletion of the wrong folder. If you only had budget and attention for one of these three, backups would be the one to choose.
A useful backup has three properties. It is recent, so you lose a day of work rather than a month. It is complete, covering both your files and your database, since a WordPress site with files but no database is just an empty shell. And it is stored somewhere other than the server it protects. That last point trips up a lot of solo founders. If your host's backups live on the same account that got compromised, or the host itself has an outage or closes your account, those backups may be gone too.
Most decent hosts now include automatic backups. SiteGround backs up every site daily and keeps 30 days of history, which covers the most common recovery case of rolling back a bad change. For an extra layer, add a second copy that you control. On WordPress, a backup plugin can send copies to cloud storage like Google Drive or Dropbox on a schedule. On other platforms, a monthly manual export to your own computer is better than nothing. The goal is simply that no single failure can wipe out both the site and every copy of it.
The step almost everyone skips is testing a restore. A backup you have never restored is a guess. Once or twice a year, restore a backup to a staging site or a test subdomain and confirm it actually loads. It takes thirty minutes, and it turns a stressful emergency into a routine task you have already practiced.
How the three fit together
Each layer covers a different moment. SSL protects data while it moves between visitor and server. The WAF screens traffic as it arrives and blocks the obvious attacks. Backups sit quietly in the background until the day something slips past the other two, or until you break the site yourself. None of them overlaps much with the others, which is why the honest answer to which one you need is usually all three, at a basic level.
The table below summarizes the tools mentioned in this guide. Prices were checked on each vendor's site in October 2026 and change often, so confirm before buying. SiteGround's prices in particular are introductory and renew at much higher rates.
| Tool | Best For | Free Tier | Starting Price |
|---|---|---|---|
| Let's Encrypt | Free SSL certificates, usually installed by your host | Yes, fully free | Free |
| Cloudflare | Free SSL and a basic WAF in front of any host | Yes, includes basic managed WAF rules | Pro at $20/mo billed annually |
| SiteGround | Hosting with SSL, daily backups, and firewall included | No | $2.99/mo intro, renews at $17.99/mo |
| Sucuri | Dedicated WAF plus malware cleanup guarantee | No | Firewall from $9.99/mo, platform plans from $229/yr |
For most one-person businesses, a sensible starting point is a host that includes SSL, daily backups, and basic firewall rules in the plan, plus one off-site backup copy you control. That covers the large majority of real risk for very little money. If you want a closer look at dedicated security services, our roundup of the best website security tools for solo builders compares them in more detail.
You move up from there when the cost of downtime rises. If your site takes payments, runs a membership, or brings in leads you cannot afford to lose for a day, a dedicated service like Sucuri starts to make sense. The main thing you are paying for is not the firewall alone, since free options exist, but a team that will clean up a hacked site within a guaranteed time window. Its Basic Platform plan at $229 per year includes unlimited malware cleanups but not the WAF, so read the plan list carefully if the firewall is what you want.
A one-afternoon setup checklist
If you want to act on this today, the order matters. Start with the free and automatic pieces, then add paid layers only where your situation calls for them.
First, open your site and confirm the padlock appears on every page, including checkout and login pages. Then check that your host renews the certificate automatically. If you are shopping for hosting, SiteGround handles SSL, daily backups, and basic firewall rules on its entry plan, which removes three setup chores at once.
Next, find your host's backup screen and note how often backups run, how long they are kept, and how a restore works. Set up a second backup that goes somewhere outside your hosting account. Put a reminder on your calendar to test a restore in six months.
Then decide on a WAF. If your host already includes firewall rules, that may be enough for a simple brochure site or blog. If you run WordPress with several plugins, putting Cloudflare's free plan in front of the site is a low-cost improvement. Reserve paid WAF plans for sites where an attack would cost real revenue.
Finally, cover the habits that no tool replaces. Turn on two-factor login for your hosting account, domain registrar, and site admin. Delete plugins and themes you no longer use. Apply updates at least weekly. These steps are free and they close the doors a firewall cannot see. If the worst happens anyway, our guide on what to do when your website goes down walks through the recovery steps.
FAQ
Do I need SSL if my site doesn't sell anything?
Yes. Browsers mark sites without SSL as "Not secure," which hurts trust even on a simple blog, and Google has used HTTPS as a ranking signal for years. Contact forms and newsletter signups still send personal data like names and emails. Since certificates are free and usually automatic, there is no good reason to skip it.
Does SSL protect my website from hackers?
No. SSL only encrypts data traveling between the visitor and your server. It does not block login attacks, plugin exploits, or malware uploads. For that you need a WAF, updated software, strong passwords with two-factor login, and backups for recovery.
Is a free WAF good enough for a small website?
For many small sites, yes. Cloudflare's free plan and the firewall rules included with hosts like SiteGround block a large share of automated attacks. Paid WAF plans add more complete rulesets and, in Sucuri's case, a guaranteed malware cleanup service. The upgrade is worth it when downtime or a hack would cost you real money.
How often should I back up my website?
Daily backups are the standard for any site you update regularly, and most good hosts now run them automatically. Keep at least a few weeks of history so you can roll back to a point before a problem started, since some hacks go unnoticed for days. Store at least one copy outside your hosting account.
Are host backups enough on their own?
They cover most everyday problems, like a bad update. They are risky as your only copy, because an account compromise, billing dispute, or host outage can take them away along with your site. A second backup stored elsewhere costs little and removes that single point of failure.
The bottom line
SSL, a WAF, and backups each protect a different moment in your site's life, so treating them as interchangeable leaves gaps. The practical answer for a one-person business is to get all three at a basic level, mostly for free or bundled with your hosting, and then spend money only where your revenue depends on the site staying up. Start with the free pieces this week, add an off-site backup, and test one restore. That small routine will protect you better than any single paid tool on its own.