A business website without backups is not a digital asset—it is a countdown. One bad deploy, a compromised plugin, or an accidental delete in the hosting panel can take offline the page that drives your pipeline. A clear website backup strategy turns a multi-hour crisis into a managed incident, as long as you know what to save, how often, and how to restore without improvisation.
In November, when many SMEs ramp up campaigns and publish seasonal landing pages, risk increases: more production changes, more CMS users, less time to test each release. This guide outlines a practical approach for corporate sites and online stores without a dedicated infrastructure team.
Why "the host already backs up" is not enough
Most hosting plans include automated snapshots, but they are often weekly, shared with other tenants, and designed for provider continuity—not to recover yesterday's 6 p.m. version of your site.
Contract terms define retention (7, 14, or 30 days), scope (database only or files too), and restore time. If you have not read them, you may assume coverage that does not exist. Your own policy—even a simple one—closes that gap and supports due diligence under GDPR.
What to back up on a business website
- Database. Content, orders, stored form entries, users, CMS settings.
- Code and templates. Theme, custom plugins, and the Git repository for bespoke builds.
- Uploaded media. Images, PDFs, catalogs, and files not in Git.
- Environment variables and secrets. Encrypted copy of
.env, API keys, certificates, SMTP credentials—never on the public web root. - DNS and email configuration. SPF, DKIM, MX records; restoring the site does not restore business email.
If your site relies on integrations, document webhooks and automation too. We covered connecting web forms to your CRM; without backing up that setup, a restore leaves leads orphaned.
The 3-2-1 rule, SME edition
Three copies, two media types, one off-site—still valid in a simplified form:
- On-server copy for quick rollbacks.
- Daily copy to external storage (S3, Backblaze, another datacenter).
- Monthly immutable copy against ransomware encrypting recent backups.
Versioned object storage plus a failed-job alert already puts you ahead of most businesses that have never restored anything.
How often to schedule backups
- Database: daily minimum; hourly for busy ecommerce.
- Files: daily with frequent content updates; weekly for stable catalogs.
- Full backup: weekly with incrementals between.
- Before major deploys: manual snapshot named after the campaign or ticket.
Pair this with monitoring and uptime: knowing the site is down helps; knowing which version to restore helps more.
Where to store backups
Keeping backups only on the same VPS as the site is like hiding a spare key under the mat. Use separate destinations: encrypted object storage, another region, credentials distinct from the hosting panel.
Avoid sole copies on a founder's inbox, unencrypted USB drives, or shared folders without version control.
Restore drills: the step almost everyone skips
An untested backup is an unverified promise. Quarterly, in an isolated environment:
- Restore the database and confirm CMS login.
- Check internal links, images, and contact forms.
- Measure real recovery time (RTO) and acceptable data loss (RPO).
Our website launch checklist fits the same discipline: shipping without a rollback plan multiplies incident cost.
Ransomware, hacks, and malicious deletes
- Mandatory MFA on admin accounts.
- Backup credentials with write-only access from the server.
- Immutable or air-gapped weekly copies.
- File integrity checks and log review after incidents.
Combine with HTTP security headers. Recovery usually means clean restore plus key rotation, not "patch and carry on".
Backups and GDPR
Backups hold personal data if you store forms, orders, or accounts. You remain responsible: encryption, access control, retention, and deletion when no longer needed.
When testing restores, anonymize or use dummy data. Do not copy production to an unencrypted laptop.
Common mistakes
- Trusting host backups without checking retention.
- Restoring over production before isolating the root cause.
- Forgetting uploaded media.
- Skipping Git for code.
- Scheduling heavy backups during peak traffic.
November quick checklist
- Confirm daily external backups for DB and files.
- Manual snapshot before seasonal campaign changes.
- Test a restore in under 60 minutes.
- Ensure the team knows who to call.
- Check backups do not expire before year-end.
Next step
If you cannot say how long recovery would take or what you would lose since the last good backup, schedule a restore test this week. That is the difference between "we have hosting" and "we have business continuity".
