# Website Backups and Restoration for Small Businesses > Find out what your website backups include, how much recent work a restore could lose, and what a useful recovery drill should demonstrate. Canonical: https://vassalmarketing.com/information/website-stewardship/website-backups-and-restoration/ **Maintained by Vassal Marketing** · Last updated on September 26, 2026 Reviewed at least quarterly and whenever a platform or rule it cites changes. General information, not legal or professional advice. Check rules that affect your business with a qualified professional. If your site disappeared tomorrow, what would you need to bring it back? Start with the pages, data, and outside services that matter, then ask your provider to demonstrate a restore. A successful practice run shows what your backup really covers. ## Why this matters Website files, uploaded images, customer records, and booking data can live in different places. A host's snapshot may include the site database but leave out email or an external appointment tool. A source-code repository may preserve the design and code while missing content uploaded through the editor. Write down what must be recovered, where each copy lives, and who can restore it. Then consider two questions: how much recent work could you afford to lose, and how long could the business manage without the affected service? These recovery objectives help your provider choose a schedule and a realistic recovery process. ## Responsible practices ### Define what the backup includes Ask for a list covering files, database, uploads, configuration, redirects, and the instructions needed to run the site. Record separate arrangements for DNS, email, forms, booking, and other external services. Keep secrets in protected storage; a document can record where to retrieve them without exposing their values. ### Choose an acceptable recovery point The recovery point objective is how much recent data loss the business is planning to tolerate. A nightly copy might omit everything entered since that copy was taken. A store receiving frequent orders needs a different plan from a brochure site edited occasionally. Include backups before risky changes as well as a recurring schedule. ### Keep a protected, independent copy Ask what happens to backups if the hosting account is compromised or closed. At least one appropriate recovery copy should have protection from the same failure affecting the live site. Confirm who can access it, how sensitive information is protected, how long copies are retained, and who can retrieve the necessary keys. ### Practice a restore without endangering the live site Have the provider run a restore drill in a safe test location: recover a selected page or file, then demonstrate the full site where the platform permits. Confirm the chosen backup is suitable for the incident. A suspected compromise calls for investigation and a known clean recovery point, not simply the newest archive. ### Check the business functions after restoration Open important pages, inspect images and redirects, and test forms through delivery. Check external booking links, administrator access, and any records that changed after the backup. Record what was missing and how long the work took. A working restore gives you a useful baseline for improving the plan. ## Worked example: What a nightly backup would—and would not—recover Hypothetical example: a service business has a nightly website backup. Its contact form stores requests in a separate service, and appointments live in an external booking platform. ### The failure The site breaks at 3 p.m. The available website backup was captured at 2 a.m. That leaves a 13-hour gap to investigate. ### Website edits A price-sheet update published that morning would need to be reapplied if it is absent from the restored copy. ### Inquiries and appointments Do not assume restoring the website restores these records. Check the form and booking systems separately, including their own access and recovery arrangements. ### The practice run Restore to a safe test location, confirm the pages and images, reapply the approved change, and send a test inquiry. Record the elapsed work and any missing dependency. Use the example to discuss acceptable loss and recovery order. It is not a recommended backup interval or a promised recovery time. ## Recovery drill checklist ### What you can check 1. List the website functions your business could least afford to lose. 2. Ask what each backup includes and what needs a separate recovery method. 3. Agree how much recent work could be lost and the recovery time you are planning around. 4. Request the result of a restore drill and a list of the gaps it found. ### What to ask your provider to handle 1. Document capture schedules, retention, protected storage, access, and restoration instructions for each system. 2. Demonstrate a safe restore and verify customer paths, rather than reporting only that the backup job ran. 3. Explain recovery dependencies and the difference between a planning target and a contracted response or restoration commitment. ## Avoid these failures - Relying on the only copy inside the same account as the live site. - Restoring over newer records without identifying what would be replaced. - Keeping archives indefinitely without access controls or an appropriate retention plan. - Calling a backup complete before testing the required recovery steps. Good website care lowers risk, but no provider can guarantee uninterrupted service. ## Questions business owners ask ### Is a hosting snapshot enough? It may cover much of the site, but verify its scope, retention, account dependency, and restore process. Email, DNS, external booking, and other services may need separate recovery arrangements. ### How often should backups run? Base the interval on how often important data changes and how much loss the business can accept. Also consider how long a problem might go unnoticed and whether older clean copies remain available. ### What should a restore drill show? That an authorized person can recover the required site into a safe test location, identify missing dependencies, and complete important customer paths. Record the time taken and corrective work. ### Will restoring the site erase newer inquiries? It depends on where inquiries are stored and what the restore replaces. Have the provider identify newer records before proceeding and explain how they will be preserved or reconciled. Do the same for orders, appointments, and uploaded files. ## Primary guidance - [CISA: Back Up Business Data](https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/back-up-business-data) - [NIST SP 1300: Cybersecurity Framework 2.0 Small Business Quick-Start Guide](https://csrc.nist.gov/pubs/sp/1300/final) - [NIST: Guide for managed service providers to conduct, maintain, and test backup files](https://csrc.nist.gov/pubs/other/2020/04/24/protecting-data-from-ransomware-and-other-data-los/final) - [OWASP: Review old backup and unreferenced files for sensitive information](https://wstg.owasp.org/latest/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management/04-Review_Old_Backup_and_Unreferenced_Files_for_Sensitive_Information/) ## Connected guidance - [Ongoing website maintenance](https://vassalmarketing.com/information/website-stewardship/ongoing-website-maintenance.md): Agree on routine care, urgent response, and a report you can understand. - [Domain, hosting, and account ownership](https://vassalmarketing.com/information/website-stewardship/domain-hosting-account-ownership.md): Find the accounts behind your site and confirm who can access or recover them. - [Website Stewardship service](https://vassalmarketing.com/services/website-stewardship.md): See the care and update work available within an agreed service scope.