Topic hub

Website Backups

Website backups protect against accidental deletion, failed updates, account loss and cyber incidents. A backup is only valuable when it contains the right assets, is protected from the same incident and can be restored…

1 published guides0 subtopicsUpdated 21 July 2026

Start here

The main guide for this topic

Comparison

Cloud versus Local Backups

Cloud and local backups describe storage locations, not automatically their resilience. A cloud copy controlled by the same compromised administrator account may be less independent than an encrypted …

Open the complete guide →

Published guides

Articles in this section

Comparison7 August 2026

Cloud versus Local Backups

Cloud and local backups describe storage locations, not automatically their resilience. A cloud copy controlled by the same compro…

Read guide →

About this section

Information checked: 21 July 2026.

In brief: Back up the complete service, store a protected independent copy and prove restoration works.

Define the backup scope

Common website backup components
Component	Why it matters
Application files and uploads	Code, media and generated assets
Database	Content, users, orders, settings and relationships
Configuration	Environment, DNS, scheduled jobs and integration settings
External data	Bookings, payments, email lists or CRM records held elsewhere
Documentation and credentials	Recovery procedure, contacts and protected access

Design for realistic incidents

Keep at least one copy logically independent from the live hosting account.
Protect backup administration with MFA and separate permissions.
Use retention that covers slow discovery of damage.
Monitor failed jobs and unexpected deletion.
Encrypt where appropriate and control restoration access.
Test restoration, not only download or archive creation.

Match recovery to data change

A daily backup may be adequate for a static brochure site but unacceptable for a shop receiving orders every few minutes. Define the maximum tolerable data loss and recovery time, then design frequency and tooling around those targets.

Acceptance check

The backup system is credible when a named person can restore the site in an isolated environment and reconcile data created after the selected backup.

Reconcile external systems

A website database may not contain the authoritative payment, booking or email-delivery record. Recovery plans should identify external sources of truth and the procedure for reconciling actions that occurred while the website was unavailable.

Records to keep

Backup scope and exclusions.
External system exports and retention.
Recovery-point and recovery-time objectives.
Restoration-test report.

Owner test: Restore a copy and compare a sample order, booking or enquiry with the independent provider record.

Sources and date checked

This practical guidance was checked against the following primary sources. Date checked: 21 July 2026.