In brief
Check recoverability as well as backup status, and keep a copy separate from the production system.
What needs backing up?
Alongside files and databases, configuration, uploads and connections to external services matter too. Make an inventory and identify what is needed to restart the system.
Source control does not replace backups of business data. Uploaded images and customer data generally need a separate backup process.
Frequency and retention
Set the backup schedule according to acceptable data loss. An infrequently changed brochure site and an active online store may need different backup routines.
Keeping only the latest copy may not be enough if a problem is discovered late. Agree on retention and separate storage arrangements with your provider.
Testing recovery
Run the test in a separate environment. Check the database, files and application behavior, not just whether the archive opens. The test must not overwrite the production system.
Record how long recovery took, which access permissions were missing and who performed the steps. Update the recovery instructions accordingly.
Provider backups and your own responsibilities
Check the specific plan’s retention period, recovery conditions and which data is backed up. A general claim that backups exist does not provide the full picture.
For critical data, consider what happens if access to the provider fails. Keep copies and recovery information organized and appropriately protected.
- Inventory: website, database, mailboxes and background tasks.
- Testing: internal pages, files, HTTPS, and sending and receiving email.
- Recovery: acceptable data loss, an owner and a working backup.
