Backups That Actually Work: The 3-2-1 Rule for Small Business Websites

Everyone says they have backups. Far fewer people have ever tried to restore one.

A backup you’ve never restored isn’t a backup. It’s a hope. And the worst time to find out your backups don’t work is the day you actually need them.

The 3-2-1 rule

The 3-2-1 rule is the simplest backup plan that actually holds up:

• 3 copies of your data: the live site plus two backups.
• 2 different types of storage, so one failure can’t take out everything (for example your server’s backup system and a separate cloud storage account).
• 1 copy off-site, somewhere completely separate from your hosting provider.

Why off-site? Because the things that wipe out websites often take the server’s own backups with them: an account suspended over a billing problem, a hacked hosting account, a host going broke, or a data centre fire. (That last one isn’t hypothetical. It has happened to a major European host, and plenty of customers lost both their sites and their “backups” stored in the same building.)

What a WordPress backup needs to include

1. The database: all your pages, posts, settings, form entries and orders.
2. The files: wp-content, especially uploads (your images and documents), plus themes and plugins.
3. The configuration: wp-config.php and any server settings you’d need to rebuild.

A backup of only the database, or only the files, will not get you back online.

A real example: rebuilding our own server

This month we rebuilt the server that hosts our production websites from scratch. New operating system, everything wiped. Before pressing the button we took:

• A snapshot of the whole server at the hosting provider.
• Full website exports with our backup plugin.
• Separate database dumps, plus copies of the web files and server configuration.

Each was copied to three separate places and checked (opened, sizes compared, archives tested) before anything was deleted. After the rebuild, we restored the WebControl website from those backups. It worked first time, and that’s the point: we knew it would, because we’d checked.

Test your restores

At least a couple of times a year:

1. Take your most recent backup.
2. Restore it somewhere that isn’t your live site, such as a staging site or a local test install.
3. Check that pages load, images appear, you can log in and recent content is there.
4. Write down how long it took. That’s your real recovery time.

Questions to ask your host (or yourself)

• How often are backups taken? Daily is the minimum for most business sites; more often for shops.
• How long are they kept? If you get hacked and don’t notice for three weeks, a 7-day backup history won’t help.
• Where are they stored? Same server? Same company? Same data centre?
• Can I download a copy, or only the host?
• When was a restore last tested?

Keep it boring

Good backups are boring. They run automatically, land in more than one place, and get tested on a schedule. Nobody thinks about them until the day they save the business.

Want help setting up off-site backups or testing a restore? Get in touch.