Website backup: how to protect your site, database and e-mail properly
Plan your website backup properly: the 3-2-1 rule, what to back up, how often, where the offsite copy goes and how to test that a restore really works.
A good website backup covers files, database, e-mail and DNS records, runs automatically at least daily, keeps several versions and has at least one copy outside your hosting account. And it is only as good as the last successful restore, so test that regularly. Your hosting provider’s backups are a good base, but they do not replace a strategy of your own. Here is how to build one, step by step.
The 3-2-1 rule explained
The Swiss Federal Office for Cybersecurity (NCSC) recommends the 3-2-1 method as the basis for reliable data backup. For a website, this means:
- 3 copies: the original on the web server and two backups.
- 2 different storage media or systems: for example the hosting provider’s backup system and a storage medium of your own.
- 1 copy in another location: outside the hosting account, such as on a NAS in the office, an external hard drive or separate cloud storage.
Some experts extend the rule to 3-2-1-1-0: one extra copy offline or immutable, and zero errors when the restore is verified. That is a good goal for small companies and associations, but even the basic 3-2-1 rule protects against the most common failures.
What belongs in a website backup?
Many people back up only the files and forget the database, or the other way round. Without both, a dynamic website cannot be restored.
| Component | What exactly | How to back it up |
|---|---|---|
| Files | CMS files, themes, plugins, uploaded images and documents, .htaccess, configuration files | Server backup, download via SFTP, plugin |
| Database | Content, users, orders, settings (MySQL/MariaDB) | Server backup, export with phpMyAdmin, plugin |
| Mailboxes, folders, filters, forwarders | Server backup or copy via IMAP | |
| DNS zone | A, MX and TXT records including SPF, DKIM and DMARC | Export the zone or document the records |
| Access and settings | PHP version, cron jobs, redirects, credentials for external services | Documentation in a password manager |
Tip: You usually do not need to back up SSL certificates: free certificates are reissued automatically after a restore. For purchased certificates, keep the private key and the certificate in a safe place.
How often to back up and how long to keep it
Frequency depends on how much data you can afford to lose in the worst case. Retention depends on how late you might notice a problem. Malicious code on a website often goes unnoticed for weeks, and then only backups from before the attack help.
| Website type | Frequency | Recommended retention |
|---|---|---|
| Brochure website, rarely changed | weekly and before every change | several weeks, plus monthly snapshots |
| Business website or blog with WordPress | daily | daily snapshots for 1–2 weeks, plus weekly and monthly ones |
| Online shop | daily, database several times a day | as above, plus monthly snapshots over several months |
| Mailboxes | daily | at least as long as the website backups |
A backup is not an archive: if you have to keep business records such as invoices (Swiss law generally requires ten years for accounting records and vouchers), they belong in a separate archiving solution. Personal data in backups is also subject to data protection law. This is general information, not legal advice.
The outside copy: offsite and offline
If all backups sit with the same provider, they are gone too if the account is suspended, terminated or compromised. This is how you create an independent copy:
- Regularly download a full backup from the control panel, for example once a month and before major changes.
- Store it on a NAS, an external hard drive or separate cloud storage, not with the website’s hosting provider.
- Encrypt the file, because it contains passwords, customer data and e-mail.
- Disconnect external drives from the computer after the backup, as the NCSC recommends. That way ransomware cannot encrypt the copy as well.
- Use separate credentials with two-factor authentication for the cloud storage.
You do not have to download it by hand: in cPanel you can also choose a remote server via FTP or SCP as the destination for a full backup. If you run your own server or a NAS with SSH, the copy can be sent there regularly. Afterwards, check that the files actually arrive and are complete; a backup job that has been failing silently for months would otherwise only be noticed in an emergency.
Backups in cPanel and JetBackup
With cPanel hosting there are usually two routes. The cPanel Backup feature creates a full account backup as an archive to download, plus partial backups for the home directory, individual databases, and e-mail forwarders and filters. You cannot restore a full account backup yourself in cPanel; the provider has to do that. Partial backups, on the other hand, you can restore yourself.
Many providers also use JetBackup. There you see the automatic backups by date and restore individual files, databases, mailboxes, DNS zones or cron jobs selectively, without rolling back the whole account. Which areas and how many days are available is set by the provider, so check this in your account.
WordPress: plugin or server backup?
There are many backup plugins for WordPress that back up files and database and upload the archives to cloud storage automatically. That is convenient, but it has limits, because the plugin runs inside the very website it is supposed to protect.
| Criterion | Backup plugin | Server backup |
|---|---|---|
| Runs independently of WordPress | no | yes |
| Backs up e-mail and DNS | no | usually yes (e-mail), DNS depends on the provider |
| Destination outside the hosting | easy (cloud storage, SFTP) | usually with the provider, download possible |
| Load on the website | runs on the same account | runs in the background at server level |
| Restoring a hacked website | unreliable if WordPress itself is affected | possible independently of the CMS |
The best solution is a combination: the provider’s server backup covers the daily backups, and a plugin or a regular manual download keeps a copy outside the hosting. Before every update of WordPress, a theme or plugins, also create a manual backup.
Ransomware and hacked websites
Ransomware encrypts data and demands a ransom; with websites, injected malicious code and deleted content are more common. In both cases:
- At least one copy must be out of attackers’ reach: offline or with separate credentials.
- Keep older snapshots, because the time of the attack is often unclear.
- After an attack, do not simply restore: close the hole first (updates, change passwords), otherwise the website will soon be infected again.
- Report incidents to the NCSC, where you will also find guidance on what to do.
Test the restore
The NCSC advises practising restoring backups before you depend on them in an emergency. Here is how:
- Choose a backup and restore it into a test environment, for example a subdomain such as test.your-company.ch.
- Check the homepage, subpages, images, forms, login and, for shops, the checkout.
- Check that the database matches the files (same point in time).
- Measure how long the restore takes and write down the steps.
- Delete the test environment afterwards or protect it with a password.
Tip: A test every six months is a good rhythm for small websites. Also test after every change of provider, backup tool or plugin.
Checklist for your website backup
- Files, database, e-mail and DNS zone are covered.
- Automatic at least daily, plus manual before updates.
- Several versions over weeks and months.
- At least one encrypted copy outside the hosting account, one of them offline.
- Restore tested and documented.
At HostOn, web hosting and WordPress hosting include daily JetBackup backups of files, databases and e-mail, which you restore yourself in cPanel at no charge. The copy outside the hosting is still your job, so download a backup regularly.
Frequently asked questions on this topic
At least as often as the content changes. For most business websites a daily automatic backup makes sense; for online shops with ongoing orders, back up the database several times a day. Add a manual backup before every update.
It is a good foundation, but not a complete strategy. The backups sit with the same provider and are overwritten after a fixed period. An extra copy outside your hosting account protects you if the account is suspended, you change provider or a hack is discovered late.
You keep three copies of your data (the original and two backups) on two different storage media, with one copy in another location. The Swiss Federal Office for Cybersecurity (NCSC) recommends this method as the basis for reliable data backup.
If your mailboxes are on your hosting, they are usually included in a full server backup. A WordPress backup plugin, on the other hand, does not back up e-mail. Check whether your backup solution really covers the mailboxes.
Restore the backup into a separate environment, such as a subdomain or a local installation, and check that pages, images, forms and login work. Note how long the restore takes.
Only if attackers cannot reach them. At least one copy should be stored offline or with separate credentials so that it is not encrypted or deleted along with everything else during an attack.
