Information checked: 21 July 2026.
Back up a website by capturing every component required to rebuild the service, placing the copy outside the live failure boundary and recording how it will be restored.
In brief: Capture files, database, configuration and external dependencies, then restore a copy to prove it works.
Step 1: identify the complete service
- Website files, uploads and generated assets.
- Database and scheduled-job state.
- Environment and web-server configuration.
- DNS records and certificate arrangements.
- Code repositories and deployment instructions.
- External service exports and integration configuration.
Step 2: create and protect the copy
- Use a consistent automated process.
- Record start, completion, size and integrity information.
- Transfer a copy to a separate protected account or storage boundary.
- Restrict deletion and restoration permissions.
- Monitor failure and unexpected size changes.
- Retain versions according to recovery and data-retention needs.
Step 3: verify
Backup verification levels
- Job success
- The software reported completion
- Inventory check
- Expected files and database are present
- Integrity check
- The archive can be read and matches recorded checks
- Isolated restoration
- The service can actually be rebuilt
- Business reconciliation
- Orders, forms and integrations behave correctly
Acceptance check
Record the exact backup selected, restoration dependencies and any data that must be replayed after recovery. A backup without a tested procedure remains an assumption.
Watch for silently incomplete jobs
A backup may report success while excluding a large uploads directory, database table or encryption key. Compare size and inventory with expectations and alert on unexplained changes. Do not place temporary archives inside the public website directory.
Records to keep
- Backup manifest and component count.
- Job log and integrity value.
- Storage destination and permissions.
- Latest isolated-restore evidence.
Owner test: Open the backup without the live server and locate one recent image, content record and configuration item required for recovery.
Do not confuse export with complete backup
A CMS content export may omit themes, uploads, users, settings or transaction records. A hosting snapshot may omit an external mailbox, payment account or DNS configuration. Label every backup by scope so that an operator does not discover the missing component during an emergency.
Sources and date checked
This practical guidance was checked against the following primary sources. Date checked: 21 July 2026.
Keep the decision under your control
Retain the relevant accounts, source material, supplier terms and recovery information. Recheck changing prices, interfaces and rules before acting.