Your clients will never ask you if their photos are safe

Think for a moment about what you’re keeping.

A couple has handed you the most important day of their lives. Two parents let you into their home in their baby’s first days, when they still hadn’t slept a full night. A pregnant woman stood in front of your camera in a way she has probably never stood in front of anyone else. They’ve given you some of the most intimate images they will ever have.

And not one of them has asked you where you keep them, who else can see them, or what would happen if they disappeared tomorrow.

They don’t ask because they assume it’s taken care of. Just as nobody asks their bank whether it locks the vault at night. That trust is a gift. But it’s also a responsibility that we often take on without even realising we have.

On 21 October, the internet had to change its locks in a hurry

On 21 October, urgent patches were released for two critical security flaws in PHP, the language that runs a huge share of the world’s websites, including every site built with WordPress. The flaws allowed an attacker to take control of a server without needing a password. There were already attempts to exploit them four days before a fix existed. In Spain, several public bodies took their websites offline for hours while they were being updated.

And there was one detail that hits close to home for you. The flaw also affected network drives, NAS devices, where a great many photographers keep their working archive. One of the most popular manufacturers took days to have a fix, and in the meantime its advice to customers was as simple as it was unsettling: disconnect the device from the internet.

Imagine getting that warning with ten years of weddings on it.

I’m not telling you this to scare you. I’m telling you because that week a lot of photographers did nothing. Not because they were careless, but because they didn’t even know there was something to do, or whose job it was to do it.

The awkward question: who applied the patch on your website?

If your website, your galleries or your shop run on a server you manage yourself, someone had to update it that week. If you have a WordPress site with plugins, someone had to check that everything still worked afterwards. If you’re on a cheap hosting plan you signed up for years ago, someone had to know which version of PHP it was running.

That someone, very often, is you. And you didn’t know it.

And it isn’t just responsibility, it’s time. Hours spent checking, updating and making sure nothing has broken. Hours you’re not shooting, editing or looking after a client.

I explained this in more detail a few days ago on the blog, layer by layer: which part of your website’s security depends on you and which on whoever hosts it. I won’t repeat it here. Just hold on to the question, because it’s the one that matters: if it happens again tomorrow, do you know who has to act?

It has happened to us more than once

A photographer writes to us, sometimes in a hurry, sometimes a little embarrassed. They’ve lost a client’s photos. A drive that failed, a backup that wasn’t where they thought it was, an accidental deletion. And they ask whether they can recover them from the gallery they’d published on our service, the one they’d set up so their client could view and download the photos.

We enabled full-gallery downloads a while ago, so that anyone can recover a gallery themselves if they ever need to. And in one case it went further: a client asked us to download absolutely every photo they had on our servers, because something had gone wrong with their photo server, their NAS, the place where they kept all their work.

We’re more than happy to help at moments like that. But I don’t want you to take away the nice part of the story. I want you to take away the other part. In every one of those cases, the photos were saved by chance. Because, by chance, they happened to be somewhere that wasn’t their backup system. A client gallery is not a backup. It’s a stroke of luck.

And luck is not a plan.

Your photos are only as safe as your least-tested backup

Most photographers I know have backups. Two drives, something in the cloud, the studio NAS. The problem is almost never not having a backup. It’s never having tested it. A backup you’ve never restored is just a hope.

If you really want to know where you stand, try this test this week: pick a session from two years ago and restore it in full from your backup. Without looking at the original drive. Time yourself. If it takes ten minutes, congratulations. If you discover missing folders, that the backup stopped in 2024, or that you can’t remember your cloud password, better to find out on an ordinary Tuesday than on the day you need it.

The door they actually use to get in

Even though this time the problem was PHP, the most common way a photographer loses control of their digital business has nothing to do with servers. It’s far more mundane.

It’s the password you use on six different sites. It’s the “your account will be suspended, verify your details here” email that lands on a Friday at eleven at night. It’s the Instagram account stolen on a Monday, with eight years of work and thousands of followers who were, in reality, your future clients.

And above all, it’s your email. Because your email is the master key: it’s what every other password gets reset through. If someone gets into your inbox, they get into everything else.

There’s no patch anyone else is going to apply for you here. This one is yours: a long, different password for everything, a password manager so you don’t have to remember them, and two-step verification switched on for your email, your Instagram and anywhere else that offers it. It’s an afternoon’s work. And it’s probably the best-spent afternoon of your whole year.

I say this from experience, because it’s exactly what we’ve just done ourselves. We’ve enabled two-step verification for logging into the panel our clients use to manage their website, galleries and shop. Not because anything happened. Precisely so that nothing does. When what you’re protecting is the work of thousands of photographers and their clients’ photos, no precaution is too much. And if your platform, your hosting provider or your bank offers you that second step and you haven’t switched it on yet, don’t leave it until you need it. By then you’re already too late.

Security is part of what you sell, too

There’s one idea I’d like you to take away. When a client hires you, they’re not just paying for the photos. They’re paying you to look after them. For them to arrive, for them to last, for nobody who shouldn’t see them to see them. The fact that they don’t ask doesn’t mean they aren’t buying it.

And when something goes wrong, your client doesn’t call your provider. They call you. That’s why it isn’t enough for someone to be taking care of the technical side: you need to know who’s doing it, how, and how fast. Handing it over is one of the best decisions you can make, as long as you know whose hands you’re leaving it in. What you can never hand over is the trust your clients have placed in you.

You don’t need to become a cybersecurity expert. You need to know three things: who maintains your website and galleries, whether your backup really works, and whether your accounts are protected by something more than a password. If you can answer all three calmly, you’re ahead of most. If not, you know what to do this month.

Your clients will never ask you if their photos are safe. That’s why you need to have sorted it out before they do.

Until next time,

Félix Mezcua