Website Backup Best Practice: Copies and Restore Tests
Website backup best practice comes down to three questions: what do you copy, how often, and can you actually get it back. This guide gives straight answers for business owners, based on UK National Cyber Security Centre advice and what we run for our own sites.
Website backup best practice: the short version
Back up everything the business needs to run, keep one copy away from the place the site is hosted, protect the accounts that hold the copies, and test a restore. A backup you have never restored is a hope, not a plan.
Why backups matter for a business website
A website is often the first place customers meet you, and for many businesses it is also where enquiries and orders arrive. Losing it, even briefly, costs sales and trust.
Backups also protect against everyday mistakes. A wrong update, a deleted page or a failed plug-in can be undone in minutes when a recent, tested copy exists.
What to back up
The NCSC advises copying all the data your business needs to operate, including your website, emails, invoicing, documents, contacts and customer information.
For a website that means three things: the files, the database and the settings. Missing any one of them can leave you with a copy that will not start.
Backup frequency: how often is enough
The NCSC page does not set a schedule, so the answer depends on how fast your data changes. Ask how much work you could afford to redo.
A brochure site that changes monthly can manage with nightly copies. A site taking orders or enquiries all day may need its database copied far more often, because every hour of lost orders is lost money.
Where to keep the copies
The NCSC describes two main options: online storage and an external device kept somewhere secure. For extra safety it suggests using both.
Do not leave an external drive plugged in, because some viruses also reach connected devices. Keep at least one copy away from your hosting account, so one failure cannot take everything.
Offline backup and protecting the accounts
An offline backup is a copy that is not connected to your network, so it cannot be changed by an attacker who gets in. It is your last line of defence against ransomware.
The NCSC also advises protecting online backups with 2-step verification. Its guidance on multi-factor authentication explains the stronger options.
How to run a restore test
The NCSC says to know how to restore your backup and to check that it contains all your important data. Do this on a schedule.
Restore the latest backup to a private test copy, never over the live site.
Open the pages, log in and submit a test form.
Check the database has recent records.
Note how long it took and write the steps down.
Backups for different kinds of site
The right plan depends on what the site does.
A brochure site changes rarely, so nightly or weekly copies are usually enough.
An online store or booking site changes all day, so the database needs the most frequent copies.
A web app or customer portal holds private data, so encryption and access control matter as much as the copy itself.
Whatever the type, the files, database and settings must all be included, and the restore must be tested.
A simple backup plan you can copy
List what the site needs to run
files, database, settings and any connected accounts.
Choose how often each part is copied, based on how much work you could afford to redo.
Store one copy away from your hosting account and keep another offline.
Protect every account that can reach the copies with 2-step verification.
Restore to a private test copy and write down the steps.
Repeat the restore test after major changes and on a regular schedule.
Who should own the backups
Name one person who is responsible for them. If an agency or host looks after the site, ask who checks that each backup completes and who performs a restore.
Ask for the answers in writing. A clear owner and a written restore procedure turn backups from a vague comfort into something you can rely on.
Common backup mistakes
Storing the only backup on the same server as the site.
Never checking that the backup completes.
Keeping the backup account protected by a weak password.
Not knowing who restores it, or how.
Backing up files but not the database.
What to ask your host or agency
You can check most of this with a few direct questions.
What exactly is backed up
files, database and settings?
How often, and how long are copies kept?
Where are the copies stored, and who can reach them?
Are they encrypted?
When was a restore last tested, and can I see the result?
How long would a full restore take?
A good provider answers these without hesitation. A vague answer is a warning sign.
What our own backups do
Our Guardian product takes encrypted automatic backups every night, stores them away from your server and lets you restore to a private test copy first. We built it because we run our own group of websites and needed it ourselves. The product page lists what is live today.
If you would rather start with the site itself, see our web development services or read what a custom website costs.
Sources
Designed & developed by LAMTANS Technologies LLC, USA — part of the LAMTANS Group
Frequently asked questions
Does my host already back up my site?
Many do, but you cannot rely on it. Check what is kept, for how long and whether you can restore it yourself.
How many copies should I keep?
At least two, in different places, with one away from your hosting account.
Should backups be encrypted?
Yes, especially if they hold customer data, and the accounts that reach them need 2-step verification.
How often should I test a restore?
Test after any big change and on a regular schedule, so the steps stay familiar.
What is the biggest backup risk?
Finding out the backup was incomplete only when you need it.