The good news is that this plan does not require a large technical team. It requires a few decisions made in advance, while the site still works and the pressure has not arrived. This guide is for owners of small and medium-sized websites, regardless of platform, and focuses on what to understand and check rather than instructions for a particular tool.
What actually needs backing up?
A website is not a single file. A site built on a content management system such as WordPress generally has two distinct parts: files, including the theme, plugins and images, and a database containing posts, pages, settings and comments. Backing up only one is half a backup. Files without a database restore an empty site, while a database without images restores text without pictures.
Some things are not part of the website at all but are still essential to restoring it: hosting account access details, domain registrar details, DNS settings, the email account receiving renewals and invoices, and settings for external services such as forms or payments. Collect these in an organized list, keeping passwords in a password manager rather than an unprotected file.
Anyone managing several sites or wanting to follow changes in platforms and tools can find news and guides for website owners in Hebrew on topics such as search and traffic, revenue and platforms. But only you can prepare the list for your own site.
The 3-2-1 rule, and the addition that makes it effective
A familiar backup rule of thumb is 3-2-1: at least three copies of the data, on two different devices or storage media, with one outside the usual location. The UK's National Cyber Security Centre (NCSC) mentions this rule in its post on offline backups from August 2019 and adds an important warning: the rule protects against a local failure but does not require any copy to be disconnected.
Why does that matter? According to the same post, the NCSC has encountered cases where ransomware encrypted not only the original data but also connected external drives, network storage and even cloud backups connected to the same system. A backup accessible with the same password and from the same location as the site may fail along with it. The recommendation is therefore to keep at least one offline or isolated copy that a single incident cannot reach.
For a small website owner, this might look like the following, for illustration only: an automatic daily backup with the hosting company, a weekly copy kept with a separate storage service using a different password and a monthly copy downloaded to a computer or drive that is disconnected most of the time. Three copies, in at least two places, with one unavailable to an attacker who has taken over the hosting account.
The hosting company's backup: convenient, but not enough
Most hosting companies offer backups, sometimes included in the price. These are very useful for everyday situations, such as a plugin update breaking the site and needing to return to the previous version. Before relying on them alone, clarify how long backups are retained, whether they are kept on the same server or elsewhere, whether restoration requires contacting support and whether restoration carries a fee.
The most important question is what happens if the account itself disappears. If hosting is suspended, the company closes or someone takes over the account, a backup held only within that account will not help. This is exactly why a separate copy is needed.
Timing matters, too. A backup kept for seven days will not help if a breach happened three weeks ago and was only discovered now. Keep older copies as well as the latest one. The NCSC recommends using versioning and deleted-data recovery, where the provider offers them, to return to the last known good state.
Two questions that determine backup frequency
No single backup frequency suits every website. Instead of guessing, answer two questions. First: how much work are you willing to lose? A brochure website updated once a month may manage with weekly backups, but a store receiving daily orders or a blog publishing several posts a week will lose much more if the latest backup is old.
Second: how long can the site be down? For a site serving as a business card, two days offline is inconvenient. For a site that generates income, even a few hours means a loss. The answer determines whether a backup you restore yourself over a weekend is enough or whether you also need someone available who can do it quickly.
With these answers written down, it is easier to choose a tool and assess whether the existing backup meets your needs. Anyone who has lost files already knows the issue is not just technical. The article on what really happens when files disappear provides background on recovering data from storage devices.
A recovery drill: the most important hour of the year
This is the difference between a backup and a plan. The NCSC emphasizes that backups should be created frequently and checked regularly to ensure they work as expected. A backup that has never been restored is an assumption, not a fact.
A simple drill does not have to touch the live site. Restore the backup to a test environment, temporary subdomain or local computer and check three things: does the site load, are the content, images and internal links in place, and how long did the whole process take? Record the answer to the last question, because that is what you will tell customers or readers in a real incident.
During the drill, write a short recovery document. It need not be a long technical manual, just a list of steps in the right order: where the backups are, how to access each account, the restoration sequence and what to check afterward. During an incident, even an experienced website owner thinks less clearly. A list prepared in advance does some of the thinking for them.
After a breach: understand before restoring
When a site is breached, the natural impulse is to restore the latest backup immediately. Sometimes that is a mistake. If the attacker entered through a vulnerable plugin or weak password, a quick restoration brings the site back with the same vulnerability and sometimes with malicious code planted before the backup was made.
A better sequence is to change passwords for all relevant accounts first, identify as far as possible how and when the breach happened, choose a backup from before that point and update all components before the site goes live again. Business owners can read more about the organizational side of protection in the article on cyber threats to businesses in Israel. For a site holding customer information, consult a professional as well, since there may be obligations beyond restoring the site.
A one-page plan
To bring everything together, a single page printed or stored outside the website can cover:
- What to back up: files, the database and a list of accounts and access details.
- Where: at least three copies, in two places, with one offline or isolated.
- How long: daily copies for the short term and older copies for the long term.
- When to check: a regular recovery drill, at least quarterly or after every major site change.
- What to do during an incident: the steps in order, with a person responsible for each one.
No plan guarantees that nothing will happen. But a website with a tested backup and steps written in advance turns a crisis into a few hours of work instead of days of guesswork. The investment is a few hours a year, and it pays for itself the first time something goes wrong.
More articles in the Internet section.
