Are you actually backed up?
Most businesses believe they are, because the host says so. Whether that's enough depends on the answers to six questions, and it's much better to ask them now than on the day you need them.
Six questions to ask your host
-
How often is a backup taken?
Daily is common. A site taking orders or bookings may want more.
-
How long are they kept?
This matters more than people expect. A hacked site is often not noticed for weeks, and a hack found three weeks later needs a backup from before it started.
-
Where are they kept?
A backup on the same server as the website is lost with it. You want them somewhere else.
-
What do they include?
The files and the database both. A WordPress site restored without its database is an empty site.
-
Can I restore one myself, and does it cost anything?
Some hosts charge for a restore, or only restore the whole account. Being able to restore one file, or the database alone, is often what you actually need.
-
When was a restore last tested?
A backup nobody has ever restored is a hope rather than a backup.
The 3-2-1 rule
The rule people who look after data use: three copies of anything that matters, on two different kinds of storage, with one of them somewhere else entirely.
For a small business website, a sensible version is the host's own backups plus a regular copy you keep yourself, in storage the business controls. A WordPress backup plugin that sends its backups to your own cloud storage does that, as long as it sends them off the server rather than keeping them in the website's own folder.
Email is usually a separate question
Your website backup almost certainly doesn't include your email, especially if the email is with Microsoft 365 or Google Workspace. Those services protect against their own failures, but deleted mail is kept only for a limited time. A mailbox emptied by mistake, or by somebody who broke into it, may not be recoverable once that time has passed.
If the email matters to the business, and it usually does, find out how long deleted mail is kept on your plan and decide whether you need a backup of it as well.
Test a restore
Once a year, restore a backup to a test copy of the site, not the live one, and check it works. You find out whether the backup is complete, how long a restore takes, and what you need to know to do it, all on a day when nothing is on fire.
What to keep yourself
- A recent copy of the website's files and database.
- A copy of your domain's DNS records. Most DNS hosts can export them as a single file.
- A list of every account involved, with renewal dates. What that list should contain.
Before you restore
A restore replaces the site with the version from the day of the backup. Every order, enquiry and change since then disappears. Take a copy of the site as it is now before restoring over it, even if it's broken.
If you would rather somebody sorted it
Ask me
If you have read this and still are not sure what to do, bring the error message, the supplier's email or the decision you're stuck on to a one hour call. I'll tell you what I'd do, including when the answer is to leave it alone.
An hour with me, and a written summary, or write to info@dalaric.com and say what's wrong.
Short answers
Questions people actually ask
My host says they back up my website every day. Is that enough?
It depends on how long they keep them, where they keep them, and whether you can restore from them yourself. A hack found three weeks later needs a backup more than three weeks old. The six questions to ask.
Is a WordPress backup plugin enough?
It is a good second copy if it sends the backup somewhere other than the same server, such as cloud storage in your own name. A plugin that keeps its backups in the website's own folder loses them along with the site.
Are my emails backed up?
Probably not by your website backup, and not in the way you might assume by your mail provider. Deleted mail is usually kept only for a limited time, so a mailbox emptied by mistake may be unrecoverable after that. Email is a separate question.
More guides
My website is down
Is it just you, has the domain lapsed, or has the host stopped serving it?
Email is not arriving
Mail that bounces, vanishes or lands in spam, and the four records behind it.
The browser says my site is not secure
What the warning actually means, and the five things that cause it.