Until disaster strikes
People remember backups in two situations: when they set them up in advance, or when the site is already down and there is nothing to restore. The second is a catastrophe: a vanished online store means stopped sales, lost orders and a lost customer base. And there are plenty of ways to lose a site: a hack, a bad update, a developer’s mistake, a hosting failure, a virus. A backup turns a catastrophe into a couple-of-hours nuisance.
What exactly to back up
A full copy of a site is two parts, and both are critical:
- Files: code, templates, images, uploads.
- Database: products, orders, customers, articles, settings. It is often the database that gets lost — the files are there but the database is empty, and the site is dead.
A backup without the database (or without the files) is an illusion of protection. You need both parts, taken in sync.
How often
Frequency depends on how much data you are willing to lose:
- An active store with orders every hour — daily, or better several times a day, backups. Losing a day of orders hurts.
- A corporate site or blog — daily or every few days is enough.
- A rarely changing site — weekly plus before every change.
A separate rule: make a backup before any update of the CMS, plugins or an edit — most “breakages” happen at exactly that moment.
The 3-2-1 rule
The classic of reliable storage:
- 3 copies of the data;
- on 2 different media/services;
- 1 — in another location (offsite).
Why “in another location” matters: a backup sitting on the same server as the site is useless if the server fails entirely or gets encrypted by a virus. Keep a copy separately — in the cloud, on another server. Auto-backups on the hosting side are good (we mentioned this in the breakdown of choosing hosting), but an additional independent copy is more reliable.
A backup that does not restore is not a backup
The most insidious mistake: copies are made for years, and at the moment of truth it turns out they are corrupted or incomplete. So periodically test recovery — deploy a backup on a test environment and make sure the site comes up and the database is there. An untested backup is a lottery you play at the worst possible moment.
The link with security
Backups are the last line of defense, but not the only one. They are complemented by CMS and plugin updates, HTTPS and access protection — the things we wrote about in the security checklist. This is especially relevant against ransomware: if a virus has encrypted the site, a clean offsite backup is the only way back without paying a ransom.
Related articles
Conclusion
Backups are cheap insurance against an expensive catastrophe: automatic backups of files and the database, a frequency matched to your data, storage by the 3-2-1 rule and — crucially — testing recovery. Set this up before you need it, not after. We will set up automatic backups and a recovery plan for your site — get in touch.
