The backup that actually works when you need it

Everyone who has lost data had a backup — on paper. The problem is that nobody tried restoring it before they needed it, and at that moment it turned out to be incomplete, corrupt, or locked behind a password nobody remembered.

The 3-2-1 rule

• Three copies of your data: the original and two backups.
• On two different media: the server disk and somewhere else.
• One off-site: away from the server itself — a copy on the same disk dies with the disk.

What do you back up?

A website is not one thing. A complete backup needs four parts, and forgetting one makes recovery half a recovery:

• The database: content, orders, accounts.
• Uploaded files: images and documents — usually not stored in the database.
• Configuration and environment variables: without the encryption keys, your encrypted data is useless.
• DNS records and mail settings: document them as text; rebuilding them from memory under pressure is painful.

An untested backup is not a backup

1. 01Schedule backups automatically — manual ones are forgotten within two weeks, whatever the intention.
2. 02Monitor that it runs: a stopped scheduled task does not complain, and silence reads as success.
3. 03Actually restore one every few months into a staging environment, and record how long it took.
4. 04Keep more than a single day: damage discovered after a week needs a copy older than a week.

The question that measures your readiness is not “do you have backups?” but “how long would restoring the site take right now, and who tested that last?”. If you cannot answer with a number, you do not have backups — you have hope.