An online business lives in places you don't own. The website is on a host, the shop is on a platform, the customer list is in an email service, the payments are in a processor, the files are in cloud storage. Each of those companies has terms allowing them to suspend or close your account, and each has had outages.
Most owners have no copy of any of it.
Start with an inventory
Before backing anything up, list every platform your business depends on. Write it in a file, Business Systems Inventory.md:
Platform | What it holds | Who has access | Export available? | Last export
Website host | Site files, database | me | manual + auto | 2025-04-08
Shop platform | Products, orders, customers | me, VA | CSV export | 2025-04-01
Email service | Subscriber list, sequences | me | CSV export | 2025-04-01
Payment processor | Transaction history | me | CSV export | never
Design tool | Product source files | me | manual download | 2025-03-15
Cloud storage | Everything else | me, VA | sync + backup | continuousThe "last export" column is the useful one. It'll be empty for most rows, and that's the finding.
Websites: what a backup actually needs
A website has two parts, and both are required.
Files — the code, themes, plugins, images, uploads. Everything in the web directory.
Database — posts, pages, settings, users, comments, orders. On most content platforms, this is where the actual content lives. Files without a database gives you a working shell with nothing in it.
A backup that's missing either one won't restore.
Don't rely solely on your host's backup
Hosts advertise backups, and they're worth having. They're also not sufficient:
- They're on the same infrastructure. A host-level problem can take the site and the backup.
- Retention is often short, sometimes only days.
- Restores may be chargeable, or slow, or require a support ticket.
- If your account is suspended, you may not be able to reach the backups.
- They may not include everything — some exclude large media directories.
Host backups are your first line for routine problems. They're not your protection against losing the account.
The setup worth having
1. An automated plugin or service backup to external storage. Whatever platform your site runs on, there are established backup tools. Configure them to send backups off the host — to your own cloud storage, a dedicated backup destination, or a service's own storage.
The critical setting is the destination. A backup stored on the same server is not a backup.
2. Schedule to match your change rate. A site with daily orders needs daily database backups. A brochure site that changes monthly needs monthly. Files change less often than the database — many people back up the database daily and files weekly.
3. Keep multiple restore points. At minimum: daily for a week, weekly for a month, monthly for a year. This matters because problems are discovered late. A hack or a corruption noticed three weeks later needs a restore point from four weeks ago.
4. Download a copy periodically. Once a month, pull a full backup to your own drive. This is your protection against losing the host account entirely.
5. Note your configuration. Not just the files: which plugins and versions, DNS settings, SSL setup, email routing, any custom server configuration. A site restored without its DNS and mail configuration is a site that's down.
Test the restore
Website backups fail at a high rate, and the failure is almost always discovered during an emergency.
Test by restoring to a staging environment or a local server — most hosts provide staging, and local development environments are free. Import the database, deploy the files, confirm the site loads and the content is there.
Do this once when you set it up, and once a year after. A database export that won't import is a common and expensive discovery.
Shop and e-commerce data
Whether you're on a hosted platform or self-hosted, export regularly:
Products — including descriptions, variants, pricing, and images. Images often export separately or not at all, so download those too.
Orders and customers — your transaction history and customer list. This is business-critical data with tax and legal implications, and platforms typically only retain and display a limited window.
Digital product files, if you sell them. The files themselves, in your own storage, not just uploaded to the platform.
Listing copy — titles, descriptions, tags. Real work that's tedious to recreate, and easy to keep as text files.
Reviews, where exportable. Often not, and worth screenshotting for anything you use in marketing.
Monthly, for anything with regular sales. Quarterly at minimum.
Note that customer data carries obligations. Exports containing personal data need to be stored securely — encrypted, with access controlled — and retained only as long as you need them.
Email lists and marketing data
Your subscriber list is frequently the most valuable asset in an online business, and it exists on one platform.
Export monthly: subscribers with their tags, segments, and signup dates. Signup date and source matter for consent records, not just for marketing.
Also export or document: email templates, automation sequences and their logic, form configurations, and your performance history.
Sequences generally can't be exported in a portable form. Screenshot them or write them out — the logic of a well-tuned sequence is real work.
Financial and payment data
Payment processor: export transaction history at least annually, more often if volume is high. Processors limit how far back you can look, and closed accounts become inaccessible.
Accounting system: export the full ledger annually. If the subscription lapses or the company is acquired, exports get harder.
Invoices issued: PDF copies in your own storage.
Tax records: covered in detail elsewhere, and the key point is the same — your own copies, in your own storage.
Social and content platforms
Download your data from each platform you use meaningfully. Most offer a full export.
Content you've published — posts, videos, images. If a platform closes your account, the content goes with it, and platforms close accounts with limited explanation.
Follower and connection lists, where exportable.
For video and long-form content in particular: keep the source files. A published video is a compressed derivative; the original is what lets you re-edit, re-publish elsewhere, or repurpose.
The domain, which is the real single point of failure
Your domain is more critical than your website, because it controls your email and your entire online identity.
- Turn on auto-renew, and make sure the payment method is current
- Turn on registrar lock, which prevents unauthorized transfers
- Use two-factor authentication on the registrar account
- Make sure the contact email isn't at the domain itself — if the domain lapses, you can't receive the warning
- Record your DNS configuration somewhere outside the registrar
- Note the renewal date in your calendar independently
An expired domain takes down your website and your email simultaneously, and recovery windows are short before it can be registered by someone else.
The schedule
Continuous or daily: website database, if the site changes daily.
Weekly: website files.
Monthly: full website backup downloaded to your own drive. Shop data export. Email list export. Cloud storage backup verified.
Quarterly: payment processor export. Social platform exports. Test-restore the website to staging.
Annually: everything, plus accounting export, plus a review of the inventory — new platforms get added to a business constantly and rarely get added to the backup plan.
Where the copies go
Your business exports should live in your normal backup system, which means they inherit its 3-2-1 protection.
02 Finance/
05 Business/
Backups/
Website/
2025-04-08-full-backup.zip
Shop/
2025-04-01-products.csv
2025-04-01-orders.csv
Email/
2025-04-01-subscribers.csvEncrypt anything containing customer data. Set a retention rule so exports don't accumulate indefinitely — personal data kept longer than needed is a liability.
The question that tells you if you're covered
If every platform you use suspended your account tomorrow, what could you rebuild from?
Work through the inventory row by row. The rows where the honest answer is "nothing" are the work.
This isn't a remote scenario. Platform suspensions happen — usually over an alleged terms violation, often automated, and appeals are slow and uncertain. The businesses that survive it are the ones with their customer list, their product files, and their content in their own storage.
Next in this series: What Happens to Your Digital Accounts When You Die