Website backup and restore: how does it work?
A website backup makes a complete copy of your site at set moments — both the files and the database — and stores it safely in a separate place. Restoring means putting that copy back so your site works again after a hack, a failed update, a server outage or human error. The key principle: a backup you have never restored is not a backup but an assumption. Below you'll find what a good backup contains, how often to make one, what the 3-2-1 rule is, why offsite storage and the restore test are crucial, and how to automate the whole thing.
Why backups are indispensable
Sooner or later something goes wrong: a plugin update breaks the site, a hacker plants malware, a hard disk fails or someone accidentally deletes an important page. Without a backup you then lose your content, customer data and revenue — and recovery can take days or weeks. A good backup turns a disaster into a minor inconvenience: you restore the last working version and you're online again. For most businesses the website is a sales and communication channel; downtime costs money and trust immediately. A reliable backup and restore strategy is therefore not a luxury but basic hygiene, like a lock on the door.
What belongs in a full backup?
Many people think of a backup as just the files, but a working website consists of two parts you need both of. First, the files: the themes, plugins, images, uploads and code. Second, the database: this holds your pages, blog posts, settings, users and, for a webshop, also orders and customer data. Restore only the files without the database and you get an empty or broken site. A full backup therefore always contains both the file system and a dump of the database, ideally as one coherent package from the same point in time, so they line up perfectly after a restore.
How often should you back up?
The right frequency depends on how often your site changes. A static company site that rarely changes is well served by a weekly backup. An active blog or news site wants daily. A webshop with a constant stream of new orders is better off backing up every hour or even continuously, because every lost order is lost revenue. The rule of thumb: you should never be willing to lose more data than is created between two backups. Ask yourself “how much work and revenue can I afford to lose?” — that determines your interval. Combine it with a sensible retention period, so you can also go back to a version from days or weeks ago.
The 3-2-1 rule and offsite storage
The gold standard for backups is the 3-2-1 rule: keep at least 3 copies of your data, on 2 different types of storage, with 1 in another physical location (offsite). Why? A backup that sits on the same server as your website is worthless the moment that server fails, gets hacked or catches fire. By keeping at least one copy elsewhere — for example in separate cloud storage or at another provider — your data survives even a total loss of the main environment. Encrypt offsite backups, as they often contain sensitive customer and business data. That keeps your backups both available and protected.
The most important step: the restore test
This is the step almost everyone skips, and the one that makes the difference between real safety and false confidence: test whether you can actually restore the backup. A backup you cannot restore is worthless. Backups can quietly become corrupt, the database dump can be incomplete, or the restore process turns out to be far more complicated under pressure than expected. So periodically restore to a test environment and check that the site comes back complete and working. That way you know not only that you have backups, but also how long a restore takes and exactly what to do — information that is worth gold the moment things really go wrong.
Automation and retention
Backups that depend on someone remembering to do them manually get forgotten. So automate the whole process: scheduled backups at the right frequency, automatic writing to offsite storage, and alerts when a backup fails. Set a sensible retention period — for example daily backups of the last week, weekly of the last month and monthly of the last year — so you can return to the right moment without using unnecessary storage. At Secrotec we set this up as standard on our secure hosting and as part of website maintenance, including periodic restore tests. Run into a problem? We help you solve website and hosting problems.
Frequently asked questions
Short, direct answers to the most common questions.
A backup is making and keeping a copy of your website; a restore is putting that copy back so your site works again. The two are inseparable: a backup only has value if you can actually restore it. That is why you test the restore periodically, instead of blindly trusting that the copy is good.
Both the files and the database. The files contain themes, plugins, images and code; the database contains your pages, settings, users and, for a webshop, the orders. If either is missing, your site won't come back, or won't come back correctly, after a restore. A full backup captures both parts at the same moment so they work together perfectly when restored.
As often as needed to avoid losing an unacceptable amount of work or revenue. A static site is fine with weekly, an active blog with daily, and a busy webshop preferably every hour or continuously. The core question is: how much data can I afford to lose between two backups? The answer sets your frequency.
The 3-2-1 rule states: keep at least 3 copies of your data, on 2 different types of storage, with 1 in another physical location (offsite). That way your data survives even if the main server fails, is hacked or is lost. It is the widely accepted standard for making your backups robust and reliable.
Because a backup you cannot restore is worthless. Backups can become corrupt or incomplete unnoticed, and the restore process often turns out to be more complicated under pressure than expected. By periodically restoring to a test environment, you confirm that it works, how long it takes and what to do — before you actually need it.
Yes, and it is strongly recommended. Manual backups get forgotten. With an automated setup, backups run on schedule, go to offsite storage automatically, and you get an alert if something fails. Combine this with a sensible retention period. Secrotec sets up automated backups with restore tests as standard on our hosting and within maintenance.
Are you sure your backup can be restored?
We set up automated backups, store them securely offsite and test the restore — so after an incident you're genuinely back online within hours.
