Backup

What should a website backup include?

A website backup needs to include not just files but also the database and settings. If you only keep the files that build the pages, you can't recover information that piles up every day, like bookings, members, orders and posts.

Settings are what people most often miss. Your domain connection records (DNS), redirect rules and contact email settings are invisible day to day, but if they're lost, the website may still open while emails stop arriving or old addresses break.

On a custom-built website, the source code is usually kept separately in a code repository like GitHub. But the database and photos customers upload aren't in that repository, so they need their own backup.

What is the 3-2-1 backup rule?

The 3-2-1 rule is a widely used backup principle: keep 3 copies, on 2 different types of storage, with 1 of them in a different location. It isn't a legal requirement, but it's an easy standard that keeps a single accident from wiping out every copy.

For a small business website, that can look like "the original on your current server + your hosting company's automatic backup + a copy in a separate cloud storage service." The key is that the last copy sits with a different company and a different account from your server.

Attacks that lock up your files, like ransomware, can also lock any storage connected to them. That's why it's safer to keep at least one copy that isn't normally connected to your website.

The account holding your copies needs protection too. If your website admin account and backup account share a password, a break-in on one could wipe out your copies as well. Use a different password and two-factor authentication for your backup account.

How often should I back up my website, and how long should I keep backups?

Set your backup frequency by asking, "If something goes wrong, how many days of data can I afford to lose?" For an informational site you update once or twice a month, back up whenever you make changes. If bookings come in every day, back up at least daily to keep losses small.

How long you keep backups matters too. Hacks often go unnoticed for a while, so if you only have the most recent backup, you may end up restoring a version that's already infected. Keep several points in time, such as a few days ago and a few weeks ago.

If a backup contains customer names and contact details, that backup is personal information too. Store it encrypted, limit who can see it, and delete it from backups as well once the retention period stated in your privacy policy has passed.

Along with how often, decide when backups run. Scheduling them to run automatically in the early morning hours, when few customers visit, keeps your website from slowing down and means nobody has to remember to do it.

How do I check that a backup can actually be restored?

The only way to know a backup works is to actually restore it. Plenty of people trust the "backup complete" notification, only to find on the day they need it that the files are corrupted or partly missing.

If an agency handles it, you don't need to run a restore test yourself, but you can ask when they last tested a restore. If they can't answer right away, ask them to run one.

1. 01Check that the most recent backup in the list is dated as scheduled.
2. 02Compare the backup size with the previous one. If it has suddenly shrunk a lot, something may be missing.
3. 03Restore the backup to a test environment, not your live website.
4. 04Check that the front page, photos, posts and booking records all appear.
5. 05Note how long the restore took. That tells you how long you'd have to wait in a real incident.
6. 06Write down the result and the next check date, and repeat about once a quarter.

What should I check when someone else handles my backups?

The most common mistake is assuming "the hosting company will take care of it" and never checking. Backup frequency, retention period and restore fees all vary by plan, so it's best to ask directly and write down the answers.

Be sure to check whether you can get your backups when you cancel. The moment you switch providers, backups that only lived on that company's servers can disappear along with them.

Also ask how quickly they can restore. Even with a backup, if restoring takes days, you can't take bookings or orders in the meantime. Knowing their response time for urgent outages and how long a restore takes ahead of time means less panic in a real incident.

• How often do you back up, and how many points in time do you keep?
• Are backups stored somewhere other than the website's server?
• Do you also back up the database and uploaded photos?
• When I need a restore, who do I contact, how long does it take, and does it cost anything?
• Who holds the passwords and access rights to the backup files?
• Can I receive the final backup when the contract ends?

When does a small business actually need a backup?

The most common moment is human error. If a staff member deletes all your past notices while tidying menus in the admin panel, or the pages break after an update, a backup lets you go straight back to how things were before.

If your website takes bookings, the most important thing on the day a server problem hits is that day's booking list. Bookings made after the last backup can't be restored, so keeping booking notification texts or emails helps you fill in the gaps.

If you take online payments, order and payment records also stay in your payment gateway (PG) dashboard. Even if your website data is lost, you can match up orders using those records, so be sure to add your payment gateway admin account to your account list too.

ISSYMO's maintenance subscription takes a backup every month along with security updates. If your website piles up records daily, like bookings or orders, confirm the backup frequency separately in your meeting.