← All guides

Security · 3 min read

Backups you can trust

Nobody cares about backups. Everybody cares about restores. A backup you've never restored is a hope, not a plan — here's how to make yours real.

The 3-2-1 rule

3 copies of your data, on 2 different media/locations, 1 of them off-site. Your host's daily backup is copy one. Your own weekly download (or a second provider) is the rest. Ransomware and datacenter fires don't care about your single copy.

What to back up (the forgotten half)

• Site files (uploads especially — code is in git, uploads aren't)
• Database — dumped properly, not just copied while running
• .env and config (secrets, API keys, mail settings)
• Email accounts and forwarders, if hosted with the site
• Cron jobs and scheduled tasks

The classic disaster: perfect file backup, no database dump, and the .env with all secrets gone. That list above prevents it.

The two commands that cover most sites

tar -czf site-$(date +%F).tar.gz /var/www/site
mysqldump -u user -p dbname | gzip > db-$(date +%F).sql.gz

Run them on a schedule, keep 30 daily copies, plus weekly copies for a few months. Storage is cheap; regret is expensive.

Test the restore — quarterly, calendar it

Spin up a scratch folder, unpack last week's backup, import the dump, and load the site. If it doesn't boot, your backup is broken and you found out on a calm Tuesday instead of during an outage. This one habit separates professionals from the hopeful.

What we handle for you

Daily automatic backups with 30-day retention on Business (hourly on Cloud Pro), weekly on Starter — each with 1-click restore of a single file or the whole site. Your own off-site copy is still smart; the 3-2-1 rule applies to us too.