Online store backups

A backup is a copy of the site, the database (products, orders, customers) and files, stored separately, from which the store can be restored after a failure, a mistake or a break-in. A backup only makes sense if restoring from it has been tested.

In plain words

A store loses data not only to hackers. There are update errors, accidental deletion of products, disk failures, contractor mistakes, ransomware infections. The answer to all of them is the same: a clean copy stored apart from the site.

Risk context: according to the Verizon 2026 DBIR, ransomware is present in 48% of breaches, although ransom payments are shrinking and many companies do not pay (Verizon). The direction of the measures is clear: a proper backup makes the situation solvable without negotiations.

What to back up

• The database: products, prices, orders, customers, settings. This is the most valuable part.
• Files: images, uploads, themes and settings.
• Hosting and domain settings: DNS records, certificates, integration keys (store them securely).
• Data from external systems: CRM, accounting system, PIM. If they live in separate services, their backups are needed too; see CRM, PIM.

Rules recommended by the NCSC

The UK National Cyber Security Centre states these principles (NCSC). They are general principles, not statistics:

• The 3-2-1 rule: at least three copies on two different media, one off the main site. The rule itself does not require any copy to be disconnected.
• The "offline" rule: at least one copy is disconnected from the system at all times, so that a single incident cannot hit all copies. Cloud storage cannot be physically unplugged, so access is protected instead: strong passwords, multi-factor authentication, limits on which clients can change the backups.
• Version recovery: check that the service can roll modified data back to a previous version and restore deleted items within a limited time.
• Frequency: the more often you back up, the less data you lose on restore.
• Testing: backups should be tested regularly to make sure they work.

CISA likewise advises organizations to back up and encrypt data and to have an incident response plan (CISA).

How long to keep them and how often

There is no single number; it depends on your loss. Two questions:

• How much data are we ready to lose? For a store with dozens of orders a day, a daily backup means that in the worst case a day of orders disappears. Then the database is backed up more often.
• How long can we be without the store? This decides whether "find the backup and deploy it by hand" is enough or fast recovery is needed.

Example (made-up): a store gets 40 orders a day, average order 1,500 UAH. Losing 12 hours of orders without a backup means about 20 orders, or 30,000 UAH of revenue, not counting the time to reconstruct them from paper and messenger traces.

Common mistakes

• The backup sits on the same server. A failure or break-in hits the backup too.
• Nobody tested the restore. The file exists but does not open.
• Only files are backed up, not the database.
• A contractor keeps the only copy and you have no access to it.
• Backups are not encrypted and are left open, yet they hold customer data: see personal data.
• Whoever can delete the site can delete all the backups too. Separate the permissions.

FAQ

How often should an online store make backups? It depends on how many orders you are ready to lose. For an active store the database is backed up at least once a day, often more often; choose the exact frequency by order volume.

What is the 3-2-1 rule? Three copies of the data on two different media, one off the main site (NCSC).

Are the backups made by the hosting provider enough? They may be, but check how long they are kept, who has access, and whether the database and files can be restored separately. Your own copy elsewhere adds reliability.

How do I check that a backup works? Deploy it on a test site and place an order. The NCSC advises testing backups regularly.

Related terms

• Online store security: the minimum
• Hosting, CDN and traffic peaks
• How to move to a new online store platform without losing traffic and data
• Technical debt

Sources

• NCSC (UK), Offline backups in an online world — ncsc.gov.uk/blog-post/offline-backups-in-an-online-world
• Verizon, 2026 DBIR — verizon.com/business/resources/reports/dbir
• CISA, Secure Our World — cisa.gov/secure-our-world