Backups and hosting for small businesses: the basics without jargon

What hosting actually is

Hosting is a computer (a server) that is permanently connected to the internet and serves your site’s files to anyone who opens it. The domain is only the address; the hosting is the place the address points to. The two can be with different companies, and it is often better that way.

The main types, from the simplest to the most flexible:

• Shared hosting — many sites on one server. Cheap and easy, suitable for a brochure site with few visits. The downside: you depend on your neighbours and on the provider’s settings.
• Managed hosting — the provider looks after the server, updates and often backups for you. More expensive, but it saves you worry.
• VPS (virtual private server) — your “own” server in the cloud. It gives freedom, but someone has to maintain it: updates, security, monitoring. Without such a person it is a risky choice.
• Static hosting — for sites made of pre-generated pages with no database. It is usually fast, secure and cheap, because there is little on the server to “hack”. It suits many brochure sites.

The 3-2-1 backup rule

A single backup on the same server is not a backup: if the server burns or is breached, you lose both. That is why people use the simple 3-2-1 rule:

• 3 copies of the data — the original and two more.
• 2 different places or media — for example the hosting and cloud storage.
• 1 copy off-site — with another provider or in the office, separate from the server.

For a website this usually means: the files and the database (if there is one) are copied automatically every day or every week, and at least once a month a copy is downloaded and kept somewhere else. How often depends on how often the site changes: for an online shop with daily orders, a daily backup is a must.

A backup you have not tested does not exist

The most common surprise is that a backup exists but cannot be restored: the database is missing, the file is corrupted or nobody knows how to bring it back. So:

1. Every few months, restore a backup to a test address and check that the site opens normally.
2. Write the restore steps on a single page: who does what and where the copies are.
3. Check how far back the backups go. If a problem is noticed after a month, seven-day backups will not help.

The domain and DNS: who holds the keys

A domain is registered with a registrar, and its settings (DNS) record where the website points and where your email is received. Whoever controls the DNS controls both your site and your mail.

• The domain must be registered in your name or your company’s, with your own contact email.
• Turn on auto-renewal and check that the payment card has not expired; an expired domain can be registered by someone else.
• Turn on two-factor authentication for the registrar account.
• Give your developer access as a separate user if the system allows it, instead of sharing your own password.

SSL and separate email

An SSL certificate is what makes the address start with https and shows the padlock in the browser. Today it is the bare minimum: browsers warn visitors about sites without it, and unencrypted contact forms expose visitors’ data. Many providers offer free certificates that renew automatically; make sure renewal really is automatic.

Keep your business email separate from the website hosting, with a dedicated mail service. That way, if the site has a problem or you change developer, your email keeps working. It is also wise to set up the SPF, DKIM and DMARC records in DNS: they help your messages stay out of spam and make it harder to forge your address.

An access list

Create one document (kept in a password manager, not in a plain file on the desktop) with the following:

• domain registrar — address, user, who has access;
• hosting — provider, user, contract, paid until when;
• site admin panel — which users exist and which are no longer needed;
• email service and DNS;
• where the backups are and how to restore them;
• phone and email of the person or company that maintains the site.

When an employee or contractor stops working with you, remove their access the same day and change any shared passwords.

What to do when the site goes down

1. Check from another device and another network (for example mobile data); sometimes the problem is only on your side.
2. Check that the domain has not expired and that the hosting is paid.
3. Look at the hosting provider’s status page; outages are often reported there.
4. Contact the hosting support or your developer and describe exactly what you see: the error message, since when, after which change.
5. If the site has been hacked (unfamiliar content, redirects to other sites), do not delete things in a hurry: change the passwords, notify support and restore from a verified clean backup.
6. If customers’ personal data is affected, check with a lawyer whether you must notify the regulator and the people affected; under the GDPR the deadlines for this are short.

A free monitoring service that checks the site every few minutes and emails you will tell you about a problem before your customers do. Site speed is a separate topic, covered in the article on how to keep a small website fast.

A short list for today

• I know whose name the domain is in and when it expires.
• I have my own access to the registrar, the hosting and the admin panel.
• Backups are automatic, at least one is outside the hosting, and I have tested a restore.
• The site runs on https and the certificate renews itself.
• My email does not depend on the website hosting.
• I have a written plan for what to do if the site stops working.

If any of these points is a struggle, you can write to us; we will tell you what to check, even if your site was not built by us.