How to back up a business website and confirm it can be restored

A server failure, a bad update, an attack or an accidental deletion: any of these can leave a company without a website. A backup is the cheapest insurance, provided you can really restore the site from it.

Step 1. Decide what to back up

A website usually has two parts:

• files: theme or code, plugins, uploaded images and documents,
• database: content, settings, orders, form submissions.

Files without the database (or the other way round) will not restore the site. Also record what lives outside the server: DNS configuration, email access, environment variables and service keys.

Step 2. Apply the 3-2-1 rule

• 3 copies of data (production plus two backups),
• on 2 different media or services,
• 1 copy off-site, away from the website server.

A backup on the same server as the site will not protect you from that server failing.

Step 3. Turn on automatic backups

1. Check whether your host offers automatic backups and how long it keeps them.
2. Set a frequency that matches how fast things change: daily for a shop or a site with forms, less often for a static brochure site.
3. Define retention, meaning how many versions back you keep. A few older versions save you when a problem is only noticed a week later.
4. Add a second, independent copy in an external location such as cloud storage.

Step 4. Protect the backups

• Encrypt backups if they contain customer data.
• Limit access to people who truly need it.
• Remember GDPR: personal data in backups is also subject to retention rules.

Step 5. Test a restore

This is the step most companies skip.

1. Create a test environment (a subdomain or a local server).
2. Restore the latest files and database there.
3. Check that the site opens, login works, and forms and payments are consistent.
4. Write down how long it took. That is your realistic recovery time.

Repeat the test every few months and after major changes.

Step 6. Write a recovery plan

One page is enough: where backups live, who has access, who to notify, and in which order to restore components. When something goes wrong, you do not want to work it out under pressure.