Business and Website Backup: A Practical Guide

Most businesses only think about backups on the day they discover they don't have one. The website goes down after a plugin update, someone on the team deletes a folder full of quotes by mistake, or ransomware encrypts every file on the office computer and demands payment. In moments like these, the difference between an hour of disruption and weeks of crisis comes down to one simple question: is there a recent, working copy of the data stored somewhere else?

Backup is not a complicated technology project. It is a working habit plus a handful of settings that you configure once and check from time to time. In this guide we cover:

• what a backup is and which problems it protects you from;
• the main types of backup and where to keep them;
• what the 3-2-1 rule is and why it is considered the standard;
• what to back up and how often;
• how to back up a WordPress, Webflow or Wix website, as well as company computers and phones;
• how to build a simple backup plan and which mistakes to avoid.

What a backup is and why your business needs one

A backup is a copy of your data made in advance, so that you can restore it quickly if the original is damaged, deleted or becomes unavailable. The copy is usually kept on a separate device or in the cloud, not in the same place as the original files.

Everyone knows the simplest form of backup: you email an important file to yourself or drop it into a chat. If the laptop dies, the copy is still waiting in the cloud. That works for a single file, but not for a business. A business has documents, invoices, a customer database, design files, a website on a server and a set of cloud tools, and each of them needs an organised, automatic backup.

It is worth separating two ideas that people often confuse:

• Sync copies every change to every device. If you delete a file on your laptop, it is deleted in the cloud as well. Sync is convenient for everyday work, but it does not protect you from accidental deletion or ransomware.
• Backup keeps earlier versions over time. Even if a file was deleted or encrypted today, you can restore yesterday's version or last week's.

What a backup protects you from

Data is more fragile than it looks. These are the most common situations in which an up-to-date backup saves a business money, time and a great deal of stress.

Accidental deletion

You were clearing out folders to free up space and selected one folder too many? It happens to everyone. Without a backup, a one-second mistake can wipe out contracts, project files or the company's photo archive.

Ransomware and malware

Ransomware encrypts the files on a computer and on any drives connected to it, then demands payment for the decryption key. Paying is no guarantee that you will get your files back. The reliable way to recover is to clean the system and restore your data from a backup the ransomware could not reach. For other risks worth knowing about, read our guide to information security threats for businesses.

Hardware failure

Hard drives, SSDs and USB sticks do not last forever. Mechanical drives have moving parts that wear out, and SSDs have a limited number of write cycles. A dropped laptop or a power surge can end a drive's life much earlier than expected.

Human error and failed updates

A colleague overwrites a shared file, a plugin update takes the website down, a change in the server settings drops a database table. You cannot prevent every one of these mistakes with procedures alone, but you can make sure there is always a point you can roll back to.

Disasters and provider outages

A fire, a flood or a break-in at the office can destroy both the computers and the external drive sitting next to them. Cloud and hosting providers have outages too. That is why at least one copy should always be kept in a different physical location.

Types of backup: full, incremental, differential and snapshot

Not every backup is created the same way. The method affects how much space your backups take, how long they take to run and how quickly you can restore from them.

Full backup

A copy of all the data you selected. Restoring from it is the simplest option, but it takes the most space and the most time to create. A full backup is usually made once a week or once a month and supplemented with lighter backups in between.

Incremental backup

Saves only what has changed since the last backup of any type. It is fast and space-efficient, but to restore you need the full backup plus every incremental backup in the chain that follows it.

Differential backup

Saves everything that has changed since the last full backup. It grows over time, but a restore needs only two pieces: the full backup and the latest differential one.

Snapshot

A point-in-time image of a system, disk or server. Cloud and hosting providers offer snapshots of virtual servers, and operating systems use them to create restore points before updates. Snapshots are excellent for rolling back quickly, but when they live on the same infrastructure as the original, they do not replace an external backup.

Where to store backups and the 3-2-1 rule

The most important rule of backup is simple: never keep your only backup in the same place as the original. A backup on the same disk will disappear with it in a hardware failure, get encrypted with it in a ransomware attack and get overwritten with it by human error.

The 3-2-1 rule

The 3-2-1 rule is the widely accepted standard for protecting important data:

• 3 copies of your data: the original plus two backups;
• 2 different types of storage, for example an external drive and the cloud;
• 1 copy at least in a different physical location, away from the office.

Today the rule is often extended to 3-2-1-1-0: one copy that is immutable (it cannot be changed or deleted) or kept offline, and zero errors when you test a restore. The extra steps exist because of ransomware, which deliberately hunts for backups that are connected to the network.

External drives

An external hard drive is the cheapest and simplest option for a single computer. Its main advantage: once the backup is done you unplug it, and ransomware cannot reach it. The downside: someone has to remember to plug it in, and it can fail too. A USB flash drive is fine for moving files around, but not for long-term storage.

NAS: network storage for the office

A NAS (Network Attached Storage) is a small file server connected to the office network. You can install several disks, mirror them and schedule automatic backups from every computer without plugging anything in by hand. Many models can also send an extra copy to the cloud. Keep in mind that mirroring disks inside the NAS protects against one disk failing, but not against deletion, ransomware or fire, so it is not a substitute for an off-site copy.

Cloud storage

Services such as Google Drive, OneDrive and iCloud give you access to files from anywhere and keep a version history. A Google account comes with 15 GB of free storage, and larger volumes require a subscription. Businesses can also use dedicated backup services that automatically back up computers and servers to the cloud and keep versions over long periods. This is where the difference between sync and backup matters: a synced folder on its own is not a complete backup.

Remote servers and object storage

For websites and systems that run on servers, the usual practice is to send backups to an external storage service such as Amazon S3, Google Cloud Storage or Backblaze B2, under an account that is separate from the server itself. That way, even if the server is hacked or deleted, the backups stay safe. In the past FTP was used for this, but today it is better to transfer files over encrypted protocols such as SFTP.

What to back up and how often

Backing up everything every day is expensive and unnecessary. The principle is to back up whatever cannot be recreated, or would be costly to recreate, at a frequency that matches how quickly it changes.

What a business should back up

• business documents: contracts, quotes, invoices and reports;
• customer databases and data exports from systems such as your CRM;
• working files: designs, plans, presentations and original photos;
• the website: files, database, images and content;
• mailboxes and calendars, if the service does not already back them up;
• critical settings: passwords in a password manager, licences and access credentials for your services.

RPO and RTO: two questions that set the frequency

To decide how often to back up, ask two questions:

• RPO (Recovery Point Objective): how much work can you afford to lose? If the answer is "no more than a day", you need at least a daily backup. For an online shop that takes orders every hour, the answer is much shorter.
• RTO (Recovery Time Objective): how quickly does the business have to be up and running again? If the website is your main sales channel, you need a backup that can be restored in hours, not days.

General frequency guidelines

• Critical data (orders, finances, customer databases): at least daily, and more often for busy systems;
• Projects and working documents: at the end of every working day and after any significant change;
• A brochure website that rarely changes: weekly, plus before every update;
• Archives that change little: monthly, or after adding a large batch of files;
• Operating systems and settings: before every major update.

How to back up a website: WordPress, Webflow and Wix

A website is often a company's most important digital asset, and it is also the easiest one to forget about. How you back it up depends on the platform.

WordPress websites

A WordPress site has two parts, and you need to back up both: the files (theme, plugins, uploaded images) and the database (content, users, orders and settings). Backing up only one of them will not let you restore the site.

The common approaches:

• Your hosting provider's backup: many managed hosting companies run automatic daily backups. Check how many days the backups are kept, where they are stored and how you restore from them.
• A backup plugin: plugins such as UpdraftPlus, Jetpack VaultPress Backup or BlogVault schedule backups and send them to external storage, for example Google Drive or Amazon S3.
• Manual backup: downloading the files over SFTP and exporting the database through phpMyAdmin. Useful before a big change, but not a replacement for automatic backups.

For a WooCommerce store, where orders come in all the time, a daily backup is not always enough. Choose a solution that backs up the database more often. And always back up before updating WordPress core, the theme or a plugin. To learn more about building and maintaining a site like this, see our guide to building a WordPress website.

Webflow websites

On Webflow, the infrastructure and hosting are managed by the platform, so there is no server for you to back up. Webflow saves backups of your site automatically, and you can also create a manual backup before a major change and restore an earlier version from the site settings. On top of that, it is worth:

• exporting your CMS collections to CSV from time to time, so you have a copy of the content outside the platform;
• keeping a copy of your original images and files;
• backing up the data your site sends to other systems, such as form submissions that go to your CRM.

To learn more about what the platform offers, read our guide to Webflow.

Wix websites

Hosting is managed on Wix too. Site History lets you go back to an earlier saved version of the design, and before big changes it is convenient to duplicate the site. Bear in mind that version history mainly covers design and structure, so the data itself, such as content collections, contacts and orders, should be exported regularly.

What to check with your hosting provider

• whether there is an automatic backup, how often it runs and how long it is kept;
• whether backups are stored outside the website's own server;
• whether you can restore on your own or need to open a support ticket;
• whether restoring comes with an extra charge.

How to back up company computers and phones

Windows computers

Windows 11 has two built-in tools. The Windows Backup app backs up folders, settings and apps to your Microsoft account and OneDrive. File History in the Control Panel keeps versions of your files on an external drive or a network folder. If you need earlier versions and not just the latest copy, use File History or dedicated backup software.

Mac computers

macOS comes with Time Machine: connect an external drive or a NAS, select it in System Settings under General, turn on encryption, and the system backs up automatically and keeps versions over time. In the settings you can choose how often backups run and exclude folders you don't need.

iPhone and iPad

The easiest option is iCloud Backup: in Settings, tap your account name, go to iCloud and turn on iCloud Backup. You can also back up to a computer: through Finder on a Mac, or through the Apple Devices app on Windows. It is worth ticking the option to encrypt the local backup, because only encrypted backups include saved passwords and Health data.

Android phones

On Android, turn on Google backup in Settings to back up contacts, settings, app data and messages, and use Google Photos for photos and videos. Many manufacturers, such as Samsung, also offer their own backup service. In a business, make sure devices are connected to a company account and not only to an employee's personal account.

A step-by-step backup plan for your business

Backup only works when it is systematic. Here is a basic plan that suits most small and medium-sized businesses.

Seven steps to a backup plan

1. Map your data. List every place where company information lives: computers, phones, the website, email, the CRM, cloud services and accounting software.

2. Set priorities. For each source, decide how much data you can afford to lose (RPO) and how quickly you need to be working again (RTO).

3. Choose your tools. At least one automatic backup tool for each source. Manual backups only as an extra.

4. Apply 3-2-1. Make sure you have at least one copy off-site and one copy that ransomware cannot reach.

5. Encrypt and restrict access. A backup contains all of your company's sensitive information. Protect it with encryption, strong passwords and two-factor authentication, and give access only to the people who need it.

6. Test your restores. At least once a quarter, restore a file, a folder or the whole website to a test environment. A backup that has never been tested is only an assumption.

7. Document it and assign ownership. Write down on a single page what is backed up, where, how often and who is responsible, and what to do on the day something goes wrong.

If your business holds personal data about customers in the European Union, data protection rules such as the GDPR expect you to keep that data secure and to be able to restore access to it in a timely way after an incident. An organised, encrypted backup with restricted access is part of sound information security. This is not legal advice: to find out exactly which requirements apply to your business, talk to a legal adviser or a data protection specialist.

Common backup mistakes

• Relying on sync alone. A file deleted or encrypted in a synced folder disappears or gets encrypted in the cloud too.
• Keeping the backup next to the original. An external drive that is always connected to the computer will be encrypted along with it in a ransomware attack.
• Never testing a restore. Backups fail silently: a full disk, an expired password, a plugin that stopped working. You only find out when you try to restore.
• Backing up only part of the website. Files without the database, or the database without the images, are not enough to restore the site.
• Trusting the provider blindly. Even when the platform makes backups, check exactly what is saved and for how long, and keep your own copy of important data.
• Forgetting about access. A perfect backup is useless if nobody knows where it is or what the password is.

How RJL Studio keeps your website and data safe

At RJL Studio we build and maintain websites on WordPress, Webflow and Wix, and backup is a standard part of every project. We set up automatic backups for the website and its database, send copies to external storage, back up before every update and check that restores actually work. When needed, we also connect your website, CRM and cloud tools with automations, so that important data is stored in more than one place.

Want to know whether your website is properly backed up? Read about our WordPress website services and our Webflow services, or get in touch and we will get back to you.

Frequently asked questions

What is the difference between backup and sync?

Sync copies every change to every device, including deleted and encrypted files. Backup keeps copies and earlier versions over time, so you can return to the state before the problem. A business should use both, but only backup protects you from accidental deletion and ransomware.

How often should a website be backed up?

It depends on how quickly the site changes. A brochure website that is rarely updated can be backed up weekly and before every update. An online shop or a site with forms and orders needs at least a daily database backup, and sometimes more frequent ones.

Doesn't my hosting provider back up my site for me?

Many hosting providers do, but the terms vary a lot: how many days backups are kept, where they are stored and whether restoring costs extra. Even when your provider makes backups, it is worth keeping an additional copy of your own in external storage, under a separate account.

Do I need to back up a website built on Webflow or Wix?

The platform backs up the infrastructure, and you can restore earlier versions from it. Even so, it is worth exporting your content and data from time to time, such as CMS collections, contacts and orders, and keeping a copy of your original files outside the platform.

How do I know my backup actually works?

Only by testing a restore. At least once a quarter, restore some files or the website to a test environment and check that everything opens and works. It also helps to set up an email alert for failed backups, so you don't discover the problem on the day you need the backup.