Every business intends to sort out backups and most find out whether they work at the worst possible moment. A backup you have never restored is a belief, not a backup.
This covers a backup arrangement proportionate to a small business, and what to do in the first twenty minutes of an outage.
- 1
Know what actually needs backing up
Files, database, and configuration. Miss the database and you lose every page, enquiry and order while keeping the theme. Miss uploads and you lose every image. List the three and confirm your backup covers all of them.
- 2
Follow the three-two-one rule
Three copies, on two kinds of storage, one off-site. Your host’s backup is one copy on one system — if the host has an incident or your account is suspended, that copy is unreachable exactly when needed. At least one backup must live somewhere you control.
- 3
Automate it and check it is running
Daily for a site that changes often, weekly otherwise, retained for at least thirty days so a problem noticed late can still be reversed. Set a calendar reminder to confirm backups are actually running — silently failing backup jobs are extremely common.
- 4
Restore one, on purpose, before you need to
Restore to a staging site or a local environment and confirm the result works. This is the step everyone skips and the only one that proves anything. Do it once when you set backups up, then annually.
- 5
Write the outage checklist while calm
Is it just you? Check downforeveryoneorjustme. Is the domain expired? Is the SSL certificate expired — a very common cause of an apparently dead site. Is the host reporting an incident? Written down in advance, this takes five minutes; improvised at 8am, it takes an hour.
- 6
Keep the access details somewhere findable
Registrar, host, CMS admin, DNS provider, email provider. In a password manager the right people can reach — not one person’s browser. Being locked out of your own registrar during an outage is a genuinely avoidable disaster.
- 7
Know who to call and what to tell them
Whether it is your host or your agency, know the route and what they will need: when it started, what changed recently, what you have already checked. "The website is broken" starts a long conversation; a clear account starts a short one.
Deciding whether to restore
Restoring reverses everything since the backup, including orders and enquiries. For a small fault, fixing forwards is usually better. Restore when the site is compromised, badly corrupted, or when a fix would take longer than the data loss costs.
If the site is hacked
Take it offline, change every password including the host and registrar, restore from a backup predating the compromise, then find how they got in. Restoring without closing the hole means being back in the same position within days.
Frequently asked questions
It is a reasonable first copy and a poor only copy. If your account is suspended or the host has an incident, it may be unavailable precisely when needed.
Would rather we did it?
These guides are here so you can do it yourself. If you would rather hand it over, that is what we do.
Start a conversation