Solution · Security
Backups and disaster recovery for websites and systems
Every company believes it has backups until it needs one. Then it turns out that the backup was on the same server that failed, stopped running months ago, did not include the database, or cannot be restored because nobody knows how. We set up backups that are complete, stored separately and tested — and a recovery plan that says exactly what happens when something goes wrong.
[ 01 ]
In short
In short
- 01
A backup that has never been restored is a hope, not a backup.
- 02
Copies are kept in more than one place, at least one of them outside the main server and hosting account.
- 03
Frequency follows how much data you can afford to lose: an online store taking orders all day needs more frequent database backups than a brochure site.
- 04
Some copies must be protected from deletion, so that ransomware or a compromised account cannot wipe them too.
- 05
Recovery time is planned: how long it takes to be back online, and in what order systems are restored.
[ 02 ]
Scope
What to back up
- Databases: orders, customers, content, users. Usually the most valuable and most frequently changing part.
- Uploaded files: images, documents, attachments.
- Code and configuration: kept in a repository, plus server configuration that is not in the repository.
- Secrets: stored securely and separately — keys and passwords needed to rebuild the system.
- Email and documents, if they are hosted on your own infrastructure.
Two numbers that define the plan
- Recovery point objective (RPO) — how much data you can afford to lose, measured in time. If the last backup was twelve hours ago, twelve hours of orders are gone.
- Recovery time objective (RTO) — how long the business can be offline before the damage is serious.
We agree on both for each system; they determine backup frequency, storage and how recovery is automated.
Where copies are kept
The widely used 3-2-1 rule: at least three copies of data, on two different types of storage, with one copy off-site. For websites, this usually means the live data, a backup with the hosting provider and a copy in separate cloud storage under a different account. Some copies are made immutable — they cannot be changed or deleted for a set period. Details in backup strategy: the 3-2-1 rule.
Testing restores
On a schedule, a backup is restored into a separate environment, and we check that the site starts, the data is complete and recent, and the process takes as long as expected. Problems found during a test are cheap; problems found during an incident are not.
Recovery plan
A short document that answers:
- who decides that recovery is needed and who performs it;
- the order in which systems are restored;
- where backups and the credentials to access them are kept;
- how to check that the restored system is clean, if the incident was an attack;
- how customers and partners are informed.
If a site has been hacked, restoring the latest backup is not enough: the backup may contain the same vulnerability or malicious code. The steps are in website hacked: what to do.
Monitoring backups
Each backup job reports success or failure. If a backup does not run, is unusually small or has not been updated, the responsible person is alerted. This is part of 24/7 monitoring.
What we need from you
- Access to hosting, servers and existing backup settings.
- How much data loss and downtime is acceptable for each system.
- A storage account for off-site copies in your company's name, or agreement on where they will live.
[ 03 ]
FAQ
Frequently asked questions
Our hosting provider makes backups. Is that enough?
It is a good first layer, but those backups live with the same provider and the same account. If the account is compromised, suspended or the provider has an incident, they may be lost too. An independent copy closes that gap.
How long should backups be kept?
Long enough to recover from problems discovered late — for example, data corruption noticed after a few weeks. A common pattern is daily copies for a few weeks and monthly copies for longer. Personal data retention rules also apply.
Can backups be restored to a different hosting provider?
They should be. We make sure backups are in standard formats and document how to restore them elsewhere.