The rule
Keep three copies of your data, on two different types of storage, with one off-site and outside your hosting account. And restore one occasionally, because an untested backup is a hope, not a plan.
Nobody thinks about backups until the morning they need one. By then the useful decisions were all made months earlier — or not made, which is the usual case.
Decide two numbers first
Every backup decision follows from these, and they are business questions rather than technical ones:
| Question | Term | What it determines |
|---|---|---|
| How much data can we afford to lose? | Recovery Point Objective | Backup frequency |
| How long can we afford to be down? | Recovery Time Objective | Backup type and infrastructure |
A brochure website might answer "a week" and "a day" — cheap and simple. An e-commerce store answering "an hour" and "fifteen minutes" needs meaningfully more investment. Answer honestly; over-specifying costs money you could spend elsewhere.
What actually needs backing up
- Database — orders, customers, content. The part that cannot be recreated.
- Uploaded files — product images, documents, user uploads.
- Application code — should already be in a repository you own.
- Configuration — server settings, environment variables, cron jobs.
- Credentials and access — documented somewhere secure and separate.
- DNS records — surprisingly painful to reconstruct from memory.
The gap that catches people out: backing up the database but not the uploads folder. You restore successfully and every product image is missing. Confirm explicitly that your backup covers files as well as data — many default configurations do not.
Where backups should live
- On the server Fast to restore, useless if the server fails. Convenience only.
- With your host, separate storage Better, but still inside one account — a suspension or billing dispute can lock you out of both.
- Independent cloud storage S3, Backblaze, or Google Cloud Storage in an account you control separately. This is the copy that saves you.
- An occasional local copy For genuinely critical data, a periodic download you hold yourself.
If a dispute with your hosting provider would also cost you your backups, you do not have backups — you have copies.
The failure modes backups must survive
| Scenario | What saves you |
|---|---|
| Server hardware failure | Any off-server backup |
| Accidental deletion by staff | Recent backup + retention history |
| Ransomware or site compromise | Backups predating the compromise |
| Bad deployment corrupts data | Point-in-time restore |
| Hosting account suspended | Off-site, independent copy |
| Provider goes out of business | Off-site, independent copy |
Retention matters as much as frequency. A compromise or corruption may go unnoticed for weeks. If you only keep three days of backups, all three may already contain the problem. Keep daily backups for a month and monthly ones for a year where storage cost allows — it is inexpensive.
Testing — the step everyone skips
- Pick a recent backup and restore it to a staging environment, not production.
- Check the data is complete — record counts, recent orders, uploaded files present.
- Confirm the application actually runs against the restored data.
- Time the whole process. This is your real recovery time, and it is usually longer than assumed.
- Write down the steps so someone else could do it under pressure.
Do this twice a year. It is the only way to know whether the backup strategy works, and it is where most people discover it did not.
A recovery plan you can actually follow
Written down, stored somewhere accessible when your systems are down — not on the server that failed:
- Who declares an incident and who leads the response
- Where backups are, and the credentials to reach them
- Step-by-step restore instructions
- Hosting and domain registrar support contacts
- What to tell customers, and who says it
- How to verify the system is genuinely healthy afterwards
Realistic costs
Cloud object storage is genuinely cheap. For most Indian SMBs, comprehensive off-site backup costs less per month than a single support call after data loss.
Unsure whether your current backups would actually save you? Ask us to check — it is a short review that occasionally uncovers something alarming. See also our security checklist and maintenance checklist.