Website Backup Strategy: Three Copies, Two Places and One Restore Test

Every business owner has heard that they should back up their website, and most believe someone is doing it. A sound website backup strategy answers four questions: what is copied, how often, where the copies live and how quickly you could get back up and running. If you cannot answer all four in a sentence each, this article is for you.

Start with what actually needs protecting

A website is two things stuck together. There are files, such as the code, images and uploaded documents, and there is a database holding pages, orders, enquiries and settings. Many people copy one and forget the other. A backup of files without the database gives you a handsome shell with no content, and the reverse leaves you with content and no design. Write down both, and add anything outside the site that it depends on: your domain settings, email configuration and any third-party services holding data on your behalf.

The old rule that still works

The well-known 3-2-1 rule says keep three copies of your data, on two different kinds of storage, with one copy somewhere else entirely. Translated for a business site: the live site is copy one, a nightly backup stored with your hosting provider is copy two, and a further copy held in a separate account with a different company is copy three. The point of the separate account is that a problem which takes out your hosting, whether an outage, a billing dispute or a compromised login, should not also take out your safety net.

How often is often enough?

Ask a different question: how much work could you stand to lose? A brochure site that changes twice a year can live with weekly backups. A shop taking orders every few minutes needs the database copied far more often, and many shops use frequent incremental snapshots so that at worst a few minutes of orders are at risk. This quantity has a name, the recovery point, and it is worth agreeing in plain language with whoever looks after your hosting. The companion measure is the recovery time, meaning how long the site may be down before it hurts. Together they decide how much you should spend.

Keep copies out of reach of whatever broke the original

Ransomware and mistakes share a nasty habit of reaching everything connected to the thing they hit. Where possible, store backups so that the account running your site cannot delete them, using write-once or versioned storage, and protect the backup account with its own strong sign-in and two-step verification. Encrypt the copies, because a backup holds exactly the same personal data as the live site, and UK data protection law applies to it just as firmly.

Test the restore, not the backup

This is the step almost everyone skips. A job that reports success every night may be copying an empty folder. Once a quarter, restore a backup to a separate test address and check that pages load, images appear, the contact form works and a test order can be placed. Time it and write the steps down, because the person doing it on a bad day may not be the person who set it up. A restore test is also the moment you discover which logins and settings live only in someone's head.

Plan the first hour

Decide in advance who has authority to take the site offline, who contacts the host, who tells customers and where the instructions are kept, ideally printed or stored outside the site itself. If personal data may have been exposed, UK rules expect you to assess whether the breach must be reported to the Information Commissioner within 72 hours, which is not a decision to improvise at midnight.

What this costs

Do not forget your email and your domain

A site can be perfectly backed up and still vanish if the domain name lapses or the email account that receives renewal notices is abandoned. Put renewal dates in a shared calendar, register the domain under a company address rather than one person's inbox, and keep a record of who holds the registrar login. Treat the domain as the most valuable file you own, because everything else points to it.

Less than most people expect. Good hosting includes daily copies, off-site storage is priced by the gigabyte, and the main cost is a few hours of set-up and a calendar reminder. Set against a week of lost orders, it is the cheapest insurance a business buys. If you would like us to check your current arrangements and run a restore test, we do exactly that for sites across Northamptonshire and beyond.