A backup is useful only when it can be restored
Do not wait for one day each year. Decide how much data you can afford to lose, keep independent copies and test recovery before an incident.
What to protect
- documents, photos and videos that cannot be recreated;
- contacts, recovery codes and an export or recovery plan for important accounts;
- website files, database, uploads and the configuration needed to run them;
- source repositories plus external data not included in Git;
- licence information and instructions another person can follow during recovery.
A practical 3-2-1 starting point
Keep three copies of important data, on at least two kinds of storage, with one copy separated from the main device or production account. Separation matters: a synchronized folder is not an independent backup if deletion or ransomware is immediately synchronized too.
Photos and personal data
Google Photos is convenient, but new uploads generally consume the shared Google Account quota. Storage Saver is not a general promise of unlimited free storage. Keep another export or local copy for irreplaceable photos and check that automatic backup is actually running.
For passwords I now use Apple Passwords. This is a personal workflow, not a claim that one manager suits everyone. Choose a supported password manager, protect it with a strong device/account password and multi-factor authentication, and keep recovery information securely.
A lesson from personal experience
When I repaired computers and reinstalled Windows, I repeatedly met people who relied completely on browser-saved passwords. After a profile failure or reinstall they discovered they did not know the credentials or recovery path. That experience is why I recommend testing account recovery before it is urgently needed.
Website backup checklist
- Record the acceptable data-loss window and set backup frequency accordingly.
- Back up files, database, uploads, environment/configuration and DNS/CDN settings where relevant.
- Keep a copy outside the hosting account and restrict access to it.
- Use Git for source history, but back up repository metadata and non-Git data separately.
- Perform a test restore to an isolated environment and record the result.
