Does My Business Website Need Backups and a Recovery Plan?
Plan recoverable website backups with clear coverage, independent access, restoration tests and realistic limits on downtime and data loss.
Part of our guide: UK Website Compliance and Security: A Practical Guide for Small Businesses
A business website needs a recovery plan proportionate to what would happen if it failed. Backups are part of that plan, but a backup is only useful if you can access it and restore the functions that matter.
A simple information site and an active booking system have different recovery needs. Decide how much downtime and lost information the business could tolerate before choosing the backup schedule.
List what must be recoverable
Include website source files, content, images, databases, configuration and the instructions needed to rebuild or deploy the site. Identify external services that are not contained in a website backup.
Domain and DNS access, email, payment systems and booking providers may need separate recovery arrangements. Record their account owners and support contacts.
The guide to keeping website files explains why a downloaded copy of visible pages is not necessarily a complete backup.
Thinking about your own rebuild?
Tell us about your business, your current website and what you would like to improve. We will help you work out the next step.
Set practical recovery targets
Ask two questions: how long can the service be unavailable, and how much recent information could be lost without unacceptable harm?
A brochure site changed monthly may tolerate a different backup interval from a system receiving bookings throughout the day. Set the recovery requirements according to the business’s needs.
Write the agreed targets down. Avoid promising instant recovery unless the infrastructure and support arrangements have been tested to deliver it.
Keep a copy outside the main failure
If every backup is reachable through the same compromised account, one incident may affect all copies. Use appropriate separation and access controls.
The NCSC’s backup guidance explains the value of protected copies and restoration testing.
Check what the hosting package actually includes: frequency, retention, location, access and restoration charges. “Backups included” is not a complete specification.
Protect backup information
Backups can contain personal data and secrets. Restrict access, use appropriate encryption and include them in retention and security decisions.
Do not store credentials in an ordinary shared document beside the public website files. Use a suitable secure system and an authorised recovery process.
Keep the arrangements in the website compliance and security inventory.
Test restoration before an emergency
Restore a copy into a safe, separate environment. Verify important pages, images, search, forms and any database-backed functions.
Prevent a test restoration from sending real customer emails, taking payments or overwriting the production service. Use safe test settings and clearly identify the environment.
Record the steps, duration, missing dependencies and person who performed the test. A successful file download is not the same as a successful restoration.
Plan for people being unavailable
Make sure an authorised colleague can find the accounts, suppliers and instructions. Do not rely on one developer’s personal inbox.
The developer-disappearance guide covers continuity when the usual contact cannot help. Agree who can approve emergency expenditure and customer communications.
Keep an independent contact channel available if the website and its associated email are both affected.
Treat compromise differently from accidental deletion
If the site may have been hacked, restoring a backup without fixing the cause can recreate the problem. Preserve evidence and follow a controlled response.
Use the warning-signs guide and seek specialist support where necessary. Identify a clean recovery point rather than selecting the latest copy automatically.
After restoration, run the post-launch checks and monitor the service.
Review after meaningful changes
A new booking tool, hosting move or database can change what needs protection. Update the plan when those dependencies change, not only at an annual review.
For help documenting website recovery requirements and handover gaps, contact AfterWorks.
