Backups: The Insurance Nobody Thinks About

Why backups are not an IT luxury

The threat is real, and it does not only affect large corporations: according to the Bitkom business protection study 2024, 81 percent of German companies were affected by data theft, espionage or sabotage — with total damages of 266.6 billion euros. Attackers do not go looking for big names; they run automated scanners across millions of websites. Small companies running outdated software are the easiest targets.

But hackers are only one of many dangers. Just as often, mundane things destroy a website: a failed plugin update, a typo in a configuration file, an accidentally deleted page tree, a hardware failure at the hosting provider or cancelling the wrong contract. In all of these cases, a single detail decides whether you lose an hour or several weeks: the backup.

What actually needs to be backed up

A common misconception: "The website lives at the hosting provider — surely they back it up." Some hosts do create backups — but often only for their own disaster recovery, with no guarantee, no restore entitlement and no way for you to access them. Do not rely on it.

A complete website backup covers several layers that belong together:

• Files: themes, plugins, uploaded images and documents
• Database: all texts, pages, orders, form submissions — the actual content
• Configuration: server settings, SSL certificates, redirects
• Email accounts, if hosted with the same provider
• Credentials documentation: what lives where, and who has access?

The 3-2-1 rule: the proven standard

IT security has settled on a simple rule of thumb, which Germany’s Federal Office for Information Security (BSI) also recommends: back up your data regularly and, above all, externally. In concrete terms, the 3-2-1 rule says: keep three copies of your data, on two different types of storage, with one copy at a different location.

Translated to a website: the original on the web server, an automatic backup at the host — and at least one more copy on an entirely different system, such as external backup storage or a separate cloud. The reason is simple: a backup stored on the same server as the website burns in the same fire. If the server is hacked or fails, the original and the backup disappear together.

How often should you back up?

The answer hangs on a single question: how much are you willing to lose? For a company website that rarely changes, a daily automatic backup is entirely sufficient — in the worst case you lose one day of changes. For an online shop with ongoing orders, the database should be backed up much more frequently, sometimes hourly.

Just as important as frequency is keeping several generations. A single backup overwritten every night does not help if the damage is only noticed four days later — by then the broken version has long since replaced the good one. Staggered retention has proven itself: for example, daily for two weeks, weekly for two months. Manual backups "whenever you remember" are not a strategy — they are gambling.

Backups are also a legal duty: what the GDPR requires

Many business owners do not realise that data backups are not just self-protection but a legal requirement. Article 32 of the GDPR obliges companies to ensure "the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident". As soon as your website processes customer data — contact form, appointment booking, shop — this applies to you directly.

If personal data is irretrievably lost, that can constitute a reportable data breach. A working, documented backup concept is therefore part of the technical and organisational measures every company should be able to demonstrate — even the smallest.

The crucial point: a backup is only as good as its restore

The most expensive backup mistake is not the missing backup — it is the backup that does not work when it matters. Incomplete archives, corrupted files, forgotten database passwords, or simply: nobody has ever tested whether the backup can actually be restored. That surfaces at precisely the moment it becomes existential.

That is why every serious backup concept includes a regular restore test — at least once per quarter. It also reveals how long a restore realistically takes: an hour of downtime is bearable, while three days offline already costs many businesses real inquiries and orders.

Handle it yourself or outsource it?

Technically, you can organise all of this yourself: set up a backup plugin, connect external storage, configure retention, test restores quarterly and keep the documentation current. Realistically, it is a recurring task that gets postponed in day-to-day business — and is missing exactly when it counts.

The alternative is to hand backups over entirely as part of a maintenance or subscription model. Our website subscription (from €79 per month) includes daily automatic backups on separate infrastructure, monitoring and full restoration in an emergency — there is simply no state in which nobody holds a current copy of your website. Which route is right depends on your time and your need for peace of mind. Only one option is off the table: no backup at all.