Does your website backup actually work? How to check before you need it

Almost every website “has a backup”. Far fewer have a backup that, on the day it is needed, can actually bring the site back. People usually find out at the worst possible moment: after an attack, a failed update or a human mistake.

The good news: checking takes about an hour, done calmly. Here are the questions to ask, in order.

1. What exactly is being saved?

A site like WordPress has two parts, and you need both:

• the files: theme, plugins, uploaded images and documents, configuration files;
• the database: pages, posts, settings, users, orders.

A backup of only the files, or only the database, is not enough to rebuild the site. Check in your backup plugin or hosting settings that both are included.

2. Where are the copies?

If the backup lives on the same server as the site, a hardware failure, an attack or a problem with the host can take the site and the backup down together.

A simple, proven rule is 3-2-1:

• 3 copies of the data (the original plus two backups);
• on 2 different storage types or services;
• 1 copy off the server, somewhere else (for example a separate cloud storage space).

Your host’s backups are useful, but treat them as one of the copies, not the only one.

3. How often, and for how long do you keep them?

• Frequency depends on how often the site changes. A brochure site that rarely changes may be fine with a weekly backup; a shop or a booking site needs at least a daily one.
• Retention: keep several versions over time, not just the latest. An attack or a mistake is sometimes discovered days later: if your oldest backup is from yesterday, it may already be “dirty”.

4. Would you notice if a backup failed?

A backup that silently stopped three months ago is the most common case.

• Turn on email notifications for failures, if your system offers them.
• Every so often, open the backup list and check two things: the date of the latest one and its size. A backup that is suddenly much smaller than usual is a warning sign.

5. Who can delete them?

If anyone who gets into your hosting panel can also delete the backups, one attack can wipe out both. It is safer to keep the external copy in a separate account, with different credentials and two-factor authentication turned on.

6. The test that counts: restoring

A backup is only proven when you have restored it. You do not need to do it on the live site:

1. create a test copy (staging), which many hosts offer in a click, or use a local environment;
2. restore the latest full backup there;
3. check that the site opens, the main pages are there, images and forms work, and you can log in to the admin area;
4. write down how long it took and the steps you followed.

That time is valuable: it tells you how long the site would be offline if something went wrong. And the written steps become the procedure to follow when there is no time to think.

Do it at least once a year, and every time you change host or backup system.

Do not forget the rest

The website is not everything. Ask yourself too:

• email: does your email provider keep backups? How long can deleted messages be recovered?
• DNS: do you have a list of your domain’s records (email, verifications, subdomains)? Rebuilding them from memory is hard.
• access: are the logins for hosting, domain and backups stored somewhere safe, and not only in one person’s head?

In short

A backup really works if it is complete, off the server, monitored and above all tested. An hour today, done calmly, is worth far more than a night of panic tomorrow.