Cyclone Hosting practical guide: A backup plan is successful only when it can restore the site within the time your business can tolerate being offline.
Why One Backup Is Not Enough
A backup stored only inside the hosting account may be affected by the same account problem, deletion, compromise, or storage failure as the website. A stronger plan uses more than one location.
Follow The 3-2-1 Principle
A common approach is to keep three copies of important data, use two different storage types, and keep one copy in a separate location.
Back Up Files And Databases
Website files contain themes, plugins, uploads, code, and configuration. Databases contain posts, pages, users, settings, and application data. A complete website backup usually requires both.
Match Frequency To Change
A mostly static website may need less frequent backups than an active store or membership site. Back up often enough that the amount of lost work after an incident would be acceptable.
Test The Restore Process
A backup is useful only when it can be restored. Periodically verify that files can be opened, database exports are valid, and the restoration steps are understood.
Create a fresh backup before software updates, major design work, domain changes, or migrations.
Define What “Recent Enough” Means
The recovery point objective, or RPO, is the maximum amount of recent data the business can afford to lose. A brochure site updated monthly may tolerate a daily copy. A store receiving orders every few minutes may not. The recovery time objective, or RTO, is how quickly service must be restored. Those two answers determine frequency, storage, automation, and whether a manual download is adequate.
Back Up Every Part Required For Recovery
| Component | Why it matters | Typical omission |
|---|---|---|
| Website files | Application code, themes, plugins, uploads, and configuration | Only public images are copied |
| Database | Pages, users, orders, settings, and application state | A file archive is mistaken for a complete WordPress backup |
| Mailboxes may be stored separately from the website | A website plugin backup is assumed to include mail | |
| DNS and configuration | Records and server settings are needed during a rebuild | No record of external DNS or PHP settings exists |
| Credentials and licenses | Recovery may require access to vendors and encrypted archives | The only password is stored inside the failed system |
Use More Than One Failure Boundary
A backup stored only inside the same hosting account can disappear with an account deletion, storage failure, compromise, or ransomware event. Keep an independent copy under separate credentials. The 3-2-1 principle is a useful baseline: three copies of important data, on two types of storage, with one copy kept off the primary system. For especially important data, consider an offline or immutable copy that ordinary account credentials cannot rewrite.
Retention Protects Against Late Discovery
Keeping seven identical daily copies is not the same as keeping useful history. Malware or an unwanted edit may remain unnoticed for weeks. A practical schedule may combine recent daily copies with several weekly and monthly restore points. Base the period on how long problems typically take to discover and on legal or business retention needs. Delete expired copies through a documented process so sensitive data is not kept forever by accident.
Monitor The Backup Job And Test The Result
- Alert when a scheduled job does not run, ends with an error, or produces an unexpectedly small archive.
- Check that encrypted archives can be opened with credentials stored outside the server.
- Restore into an isolated location, not over the live website.
- Verify representative pages, administrator login, database records, uploads, and application functions.
- Record the restore date, backup used, time required, problems found, and corrective actions.
A restore drill turns a backup claim into evidence. It also reveals missing database users, incomplete archives, incompatible software versions, and undocumented DNS dependencies before an emergency.
Official Reference
cPanel describes account-level options in its Backup interface documentation. Availability and retention depend on the hosting plan, so maintain an independent copy even when automated server backups are included.