Website Backups That Actually Restore

The website security guide makes the case for backups, so this page skips the argument. Almost every backup that lets a business down failed for a dull reason: it was incomplete, it lived in one place, or nobody had opened it.

A website is three things, and most backups capture one

When people say "back up the website" they picture a folder of files: the theme, the plugins and every image uploaded since launch. That is a third of it.

The database holds the page text, the products, the orders and nearly every setting, so restoring the files alone gives you a working, empty website. The email is not in there at all: on Microsoft 365 or mailbox hosting your messages sit on that provider's servers, and restoring the site will not bring a deleted mailbox back.

The bottom of that table catches people out mid emergency. Keep your own written note of the DNS records that point the domain at the site. Rebuilding them from memory while the site is down is miserable.

Where the copies belong

One rule carries most of the weight: a copy that exists only on the server the site runs on is not a second copy.

• A platform failure takes both. Whatever loses the site loses anything stored beside it.
• A suspension takes both. Hosts suspend accounts over abuse, spam from a compromised site or an unpaid bill, and a suspended account is one you cannot reach into.
• An attacker usually has both. Whoever can write to the website can generally write to the folder next to it.
• A closed account takes both. Retention normally ends with the subscription, so leaving a host means leaving its backups.

So: more than one copy, in more than one place, with at least one you can reach without your host. And never leave a backup file where a browser can download it. It contains your database, and your database contains your users.

How often, without picking a number

Frequency gets sold as a feature, which pushes people towards a number instead of a decision. The better question is how much work you are willing to do twice. Whatever falls into the gap between the last backup and the moment things went wrong is what you retype, if you can.

The backup people skip is the manual one, taken before a risky change: a major plugin update, a theme swap, a migration to different hosting. It is also the one most likely to be needed.

How many to keep

Keeping one backup and overwriting it is not far off keeping none. It gives you a single moment to return to, and nothing to reach for if the trouble started earlier. Compromises are where that bites. A site can carry injected code for a long time with nothing looking wrong on screen, so by the time it surfaces the newest backup holds the same code, and so does the one before it. What saves you is depth: several copies, spaced out, so you can step back past the point where things went bad.

Restoring, and the decisions you did not expect

A restore is rarely one button. Partway through you get asked things nobody warned you about, while the site is down.

• Everything, or only the broken part? A full restore rolls the whole site back, including orders and enquiries that arrived since. Often the better move is one folder, leaving today's database alone.
• Which point in time? The newest copy is the obvious choice and the wrong one after a compromise.
• Over the live site, or beside it? Beside it, if you can. Keep the broken state before you overwrite it: it is the only record of what happened.
• Files and database from the same moment? Mixing a recent database with older files gives you missing images and pages that half work.
• Clean, or just working? A restored site that loads is not proof the infection has gone. Scan it and close whatever was used to get in, or it happens again. That is the difference between a restore and a proper cleanup.
• What changes afterwards? Every password, if this followed a break-in.

When the restore itself stops halfway

Restores stall: an upload drops, an import gives up on one table, an archive turns out to be truncated. Do not run it again over the top, because that hides where the first pass stopped. Work out what landed, run the missing piece on its own, and if the archive will not open at all, reach for the copy before it.

Settle who owns this while nothing is broken. A designer moves on, a licence lapses, nobody is told. Whoever picks it up needs the logins, the storage location and the written steps.

How AldoMedia handles this

AldoMedia has been building and maintaining websites for Western New York businesses since 1999, which means a fair amount of time restoring sites for people who thought they were covered. We are an independent authorised reseller. Reselling the product is the easy part; getting a copy off the server and proving it restores is the work.

We get backups running, put a copy somewhere other than the hosting account, restore one to prove it works, and tell you how long a real restore would take. If you only want to know whether the backups you have are real, that is a shorter conversation. Ring 716-771-2536 or tell us what you have. Our support pages cover the rest.

Get Automatic Website Backups Ask us to check your backups