In short: A backup is only useful if you can restore it. The 3-2-1 rule calls for three copies of your data, on two different media, with one kept off-site. You decide how much data you can afford to lose and how long you can afford to be down, test a restore at least twice a year and write a recovery plan.
A server failure or an update gone wrong. A cyber attack or a human error: sooner or later one of these happens. What makes the difference is a single question: can you get back up and running from a recent copy that works? If the answer isn't a confident yes, it's worth sorting things out before you need to.
Having backups doesn't mean you're safe
Plenty of hosting providers say they take backups. Check three things: how often, how long they keep them and where they're stored. If the copy sits on the same server as the website, a failure or an attack takes out both. If it's a week old, you lose a week of orders. And if nobody has ever tried restoring it, you don't know whether it works.
The 3-2-1 rule
It's the easiest rule to remember and still the most useful:
- 3 copies of your data: the original and two backups.
- 2 different media or systems, for example the server and external storage.
- 1 off-site copy, in a physical location or a cloud other than the one where the website lives.
Businesses worried about ransomware add a copy that can't be modified or deleted (an immutable copy) for a set period.
What to back up
- The database, with orders, customers and content. It's the part that changes most.
- Website files such as the theme, plugins, images and uploaded documents.
- Configuration such as settings files, certificates and server rules.
- Data outside the website such as management software, email, spreadsheets and shared documents.
How often
It depends on how much you can afford to lose. A shop that takes orders every hour can't make do with one copy a night: the database needs saving several times a day. A brochure website that changes once a month is fine with a weekly copy. Settle on two numbers and write them down:
- How much data you can lose (how far back the latest copy goes): technical people call this the RPO.
- How long you can be down (how soon you must be up and running again): that's the RTO.
The restore test
At least twice a year, restore a copy to a test environment. Check that the site opens and the orders are there. Make sure a test order goes through. Note how long it took you: that figure is your real estimate for the day you actually need it.
A one-page recovery plan
- Who decides and who does the work.
- Where the backups are and how to get to them (with the credentials kept somewhere safe).
- How to tell customers: a holding page and a message on your channels.
- The order of restoration: the database first, then the files, and finally checks on the basket and payments.
- What to do afterwards: find the cause and close the gap.
Common mistakes
- Relying solely on your hosting provider's backup.
- Not backing up email or data held in external software.
- Backup credentials that exist only in one person's head.
- Forgetting to delete copies once the planned period is over: personal data kept for too long is a privacy problem.
Further reading: website care and maintenance · hacked website · ransomware
Frequently asked questions
What is the 3-2-1 backup rule?
Three copies of your data (the original and two backups) on two different media or systems, with one copy off-site, in a location or cloud other than the website's.
Is my hosting provider's backup enough?
Usually not. Check how often it runs, how long copies are kept and where they're stored: if the copy sits on the same server, a failure or an attack takes out both.
How often should you test a restore?
At least twice a year, on a test environment, checking that the site opens and the orders are there. The time it takes is your real estimate for the day you actually need it.