Adopt the 3-2-1 rule extended to 3-2-1-1-0, as CISA and NIST guidance describe it: set RPO and RTO for each application, encrypt every copy, keep one isolated immutable copy, automate the schedule, and run scheduled restore tests. Follow that and a ransomware hit or a bad deploy becomes an afternoon of work. At Forge Web Studio, we offer managed maintenance if you would rather hand this off.
TL;DR:
- Protect files, databases, configurations, certificates, secrets, and integration settings; prioritize order data and payment settings for stores, and repositories plus build artifacts for custom sites.
- Schedule backups by change rate: daily copies suit brochure sites, while frequently edited sites need incrementals and regular full copies; stores need frequent database capture.
- Retain multiple versions because corruption or faulty deployments may go unnoticed for days; add longer term archives when contracts or compliance require them.
- Secure backup accounts with MFA and deletion limits, store encryption keys separately, and use credentials that production servers cannot use to erase copies.
- Restore into an isolated staging environment, test key journeys, and validate the database and configuration; compare recovery time with RTO without overwriting production.
Table of Contents
- What should a website backup include?
- How often should you back up, and for how long?
- Which backup types and storage locations should you combine?
- How do you secure your backups?
- How do you automate backups reliably?
- How do you test restores before you need them?
- What belongs in a backup policy and go-bag?
- Why we fold backup readiness into maintenance
- Want us to handle backups and recovery for you?
- FAQ
- Sources
What should a website backup include?
A backup that only holds your site files will not rebuild a working site. Inventory everything the site needs to run, then protect it in tiers. CISA's small business guidance suggests starting with customer data, configuration files and software settings.
- Site files and uploads: themes, media, custom code
- Database dumps: CMS content, orders, user accounts
- Configuration files: web server, DNS records, redirect rules
- SSL certificates and private keys
- Environment variables, secrets and cron jobs
- Source code and build artifacts
- Third-party integration settings: payment, email, analytics
- Go-bag items: hosting and registrar logins, cloud console access
Critical items are the database, uploads, keys and configs. Optional items are caches and old logs. For a WordPress site, the developer documentation names files and the database as the two essentials.
A brochure site can start with files plus a small database. An e-commerce store must put order data and payment settings first, because those change constantly. A site with custom code adds the repository and build artifacts, which spare you a long rebuild.
How often should you back up, and for how long?
Two numbers set your schedule. IBM defines RTO as the maximum acceptable downtime and RPO as the maximum acceptable data loss. RPO tells you how often to copy data. RTO tells you how fast your restore process must be, which shapes the tools you pick.
IBM's definitions: RTO is your maximum acceptable downtime, and RPO is your maximum acceptable data loss. Together they decide how often you back up.
- Static brochure site: daily backups are enough, since content rarely changes.
- CMS site with regular edits: frequent incremental backups plus regular full backups.
- E-commerce store: frequent replication or database dumps, because lost orders cannot be recreated.
For retention, small sites typically keep multiple versions. Silent corruption and bad deploys often go unnoticed for days, so a single latest copy can already be damaged. Add longer-term archives where compliance or contracts require them. NIST/NCCoE guidance adds that you should plan by asset priority and document how often each system updates.
Which backup types and storage locations should you combine?
A full backup copies everything. It restores simply but takes the most time and space. An incremental backup copies only what changed since the last backup, which is fast and small but needs the whole chain to restore. A differential backup copies everything changed since the last full backup, landing in between on size and restore effort.
The core rule is 3-2-1: three copies, on two kinds of media, with one off-site. CISA notes the 3-2-1-1-0 extension for ransomware defense, which adds one immutable copy and automated integrity checks that confirm zero errors.
- Local disk: fastest restores, but it dies with the server.
- Removable media: cheap and portable, easy to forget or lose.
- Cloud object storage: off-site by default and easy to automate.
- Immutable or WORM storage: cannot be altered or deleted for a set period.
CISA's backup options paper lays out the pros and cons of internal drives, removable media and the cloud. Keep at least one copy offline or immutable and away from your production network.
Pro Tip: Give your backup account credentials that your production server cannot use to delete anything. An attacker who owns your server should not own your backups.
How do you secure your backups?
Backups hold everything an attacker wants, so treat them like production data. Encrypt copies in transit and at rest, and manage the keys carefully. A backup you cannot decrypt is as useless as no backup.
- Store keys separately: offline or in a dedicated key-management service, and back the keys up too.
- Keep one immutable or offline copy: ransomware actors target backup infrastructure, so a copy reachable from a compromised account is not safe.
- Lock down access: require MFA on every backup account and limit who can delete.
- Log and alert: flag failed jobs, deletions and logins from unusual places.
- Check outsourced providers: the CISA MS-ISAC Ransomware Guide recommends offline, encrypted backups and making sure managed service providers follow secure backup practices.
If you outsource backups, write security requirements into the contract: encryption, access controls, retention and restore times. Verbal assurances do not help at 2 a.m.
Pro Tip: Print or write down the location of your encryption keys and keep it in a sealed envelope with your go-bag. Keys stored only on the server they protect are a trap.
How do you automate backups reliably?
Manual backups get skipped during busy weeks, and the skipped week is always the one you needed. Automate the schedule, then add integrity checks and failure alerts so a silent failure becomes a message in your inbox.
- Hosting snapshots: simple and quick to restore, but usually tied to one provider.
- Server-agent backups: flexible and scriptable, though you maintain the agent.
- CMS plugin exports: easy for small sites, but they depend on the plugin working and the server staying healthy.
- CI/CD artifact storage: ideal for code and builds, not for live content.
- Cloud object storage with lifecycle rules: cheap, off-site, and it expires old versions automatically.
- Managed backup services or MSPs: the least effort for you, with the contract and security questions noted above.
Bandwidth and cost matter once your site grows. Favor incremental or block-level backups so you move only changed data, and use lifecycle rules to age older copies into cheaper storage. Full nightly transfers of a large media library add up quickly in both time and fees. Whatever you choose, make the tool alert you when a job fails or finishes without transferring data.
How do you test restores before you need them?
An untested backup is a guess. CISA and NIST guidance treats testing as mandatory: scheduled restoration drills are how you confirm integrity and readiness. Run partial restores regularly, and include full-site restores in your testing schedule.
- Pick a restore point, ideally one that is a few days old.
- Restore it into an isolated staging environment, never over production.
- Walk the main user journeys: homepage, forms, login, checkout.
- Validate database integrity and configuration, including SSL and redirects.
- Time the restore and compare it with your RTO.
- Log what broke and fix it before the next drill.
Add checksums so you detect corrupted files automatically. After a rebuild, also check redirects with a 1:1 redirect map and confirm cache behavior using our caching basics guide. If you want a structured exercise, this tabletop disaster recovery testing guide walks teams through one.
CISA and NIST treat restore testing as mandatory, because drills are the only reliable proof a backup works.
What belongs in a backup policy and go-bag?
Write the policy down so nobody improvises during an outage. Cover scope, RPO and RTO for each asset, retention, encryption and key handling, access controls, the testing schedule and escalation paths.
- Backup owner: keeps jobs running and reviews alerts.
- Restore operator: performs the recovery.
- Approver: authorizes a restore to production.
- Go-bag keeper: maintains the recovery kit.
The CISA small business guide recommends a go-bag. A go-bag can hold credentials, cloud console access, gold images, offline copies and redirect maps. The ransomware guide also advises keeping gold images and backup hardware for rebuilds. Store the runbook encrypted where your team can reach it, plus a printed fallback.
Why we fold backup readiness into maintenance
In our experience, most backup plans fail from neglect rather than missing tools. That is why our maintenance guide treats recovery planning as routine upkeep. We document restore runbooks, build redirect maps after rebuilds, and verify caching and mobile behavior after every restore. A backup you never rehearse is only a hopeful file. Treat recovery as a habit you practice, like locking the door.
— Dylan
Want us to handle backups and recovery for you?
Our website maintenance service and site builds can support your website upkeep, so you are not figuring this out mid-outage. We work directly with you and you keep full ownership of your site and content.
Not sure where your current setup stands? Review our pricing page and request an audit or consultation, and we will go through your backups, restore times and gaps with you.
FAQ
What is the 3-2-1 rule for backing up?
Keep three copies of your data, on two different types of media, with one copy stored off-site. CISA calls it the industry standard. It protects you when any single device, location or account fails.
What is the best way to back up a website?
Combine automated backups of files and the database with an off-site, encrypted copy and a tested restore process. Match the schedule to how often your site changes. Then rehearse restores, because an untested backup is unproven.
What is the 3-2-1-1-0 backup rule?
It adds two items to 3-2-1: one immutable or offline copy, and zero errors confirmed by automated integrity checks. CISA describes this approach as a ransomware defense, since attackers cannot alter the immutable copy.
What are the three types of backup strategies?
Common backup types include full, incremental and differential. Full copies everything, incremental copies changes since the last backup, and differential copies changes since the last full backup. Most sites mix them, such as nightly fulls with hourly incrementals.