[{"data":1,"prerenderedAt":174},["ShallowReactive",2],{"publication:en:P117":3},{"meta":4,"copy":17,"relatedArticles":133,"terms":166,"term":167,"resourceParent":168,"glossaryParent":171},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":15,"preparedOn":16},"P117","\u002Fblog\u002Fwebsite-backup-retention","article","website backup retention policy","Website backup retention policy: choose history you can actually restore","Website backup retention policy and restore history","Separate backup frequency, retained history and recovery objectives. Plan for late discovery, rotation, protected access and tested older restore points.",[13,14],"\u002Fservices\u002Fbackups","\u002Fservices\u002Fwebsite-maintenance","2026-05-21","2026-10-30",{"intro":18,"sections":19,"checklist":92,"faq":98,"links":108,"sources":125,"cta":128},"A website backup retention policy should define which recovery points remain available, for how long, under whose control and with what evidence of restoration. Retention is different from backup frequency and recovery objectives. Plan for errors discovered late, copy rotation and protected access, then test an older point as well as a recent one. There is no universal period that guarantees recovery or settles legal obligations.",[20,25,65,74,82,87],{"title":21,"paragraphs":22},"Separate frequency, retained history and recovery objectives",[23,24],"Backup frequency describes how often a copy is made. Retention describes the history that remains available after rotation or deletion. Recovery objectives describe the acceptable data loss and time needed to restore business work. These decisions interact, but one does not determine all the others. A job running frequently can still leave a short history that does not cover a late-discovered problem.","Start with the important website data and functions. Orders, enquiries, uploaded files and deployment configuration can have different recovery needs and dependencies. Record the selected policy for the actual dataset rather than apply the same setting everywhere. The business owner should understand what can be recovered at each point and what later activity might need reconciliation after a restore.",{"title":26,"paragraphs":27,"sources":30,"table":34},"Plan history around credible discovery scenarios",[28,29],"The Netherlands NCSC notes that accidental deletion may not be noticed immediately and connects retained history to that problem. Ask which scenarios the business needs to handle: a recent mistake, an unnoticed content change, an unwanted deployment or an incident whose start is uncertain. The policy should explain how available history supports those decisions without promising that any chosen window includes a clean copy.","Our retention-planning record separates scenario assumptions from verified recovery. It is an original decision aid, not a required legal schedule or a calculation of attack dwell time. If the earliest needed state cannot be established, record that uncertainty and its owner. Avoid treating the first alert date as proof that every earlier point is trustworthy or that every later one must be discarded.",[31],{"label":32,"url":33},"Netherlands NCSC: 3-2-1 backup copies, media and location","https:\u002F\u002Fwww.ncsc.nl\u002Fen\u002Fbackup\u002Fall-about-good-backups",{"caption":35,"headers":36,"rows":40},"Discovery, rotation and restore-history planning record",[37,38,39],"Question","Policy decision to record","Acceptance evidence",[41,45,49,53,57,61],[42,43,44],"What is protected?","Data categories, application and dependencies.","Required recovery components are covered.",[46,47,48],"When might loss be found?","Credible discovery scenarios and uncertainty.","History is reviewed against those scenarios.",[50,51,52],"Which points remain?","Actual retained generations and rotation rules.","An older needed point is still accessible.",[54,55,56],"Who can change history?","Retention\u002Fdeletion authority and protection.","Administrative changes have an owned control.",[58,59,60],"How is it restored?","Provider, credentials, versions and selected environment.","Controlled restoration reaches the accepted business state.",[62,63,64],"What constraints apply?","Capacity, contract, privacy and organizational requirements.","Responsible owners approve the policy and its limits.",{"title":66,"paragraphs":67,"sources":70},"Review rotation and deletion as part of protection",[68,69],"Understand when older points are replaced, whether deletions propagate and who can shorten the history. A policy stored in a document does not preserve data if the actual provider or job uses a different setting. Record the configured behavior and a way for the owner to notice failed backups, unexpected deletion or a changed protection period. An unattended alert does not provide an operating response.","The UK NCSC's protected-backup principles address the threat of destructive access to recovery data. Use that concern to review administrative control and failure handling, not to label every remote or cloud copy ransomware-resistant. Verify relevant protection features and their limits in the actual service. A longer retention period is of little use if one compromised account can remove the history immediately.",[71],{"label":72,"url":73},"UK NCSC: protection principles for ransomware-resistant backups","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fcollection\u002Fransomware-resistant-backups",{"title":75,"paragraphs":76,"example":79},"Balance useful history with sensitive-data and capacity needs",[77,78],"Older copies may contain information or credentials no longer present in the live website. Restrict access and document how recovery material is stored and handled. More history also affects storage and operational costs, but deleting it solely because capacity is full can defeat the stated recovery objective. Assign someone to resolve that tradeoff before the next scheduled rotation silently removes needed points.","Separate the technical recovery policy from legal, contractual and privacy requirements. The applicable decisions depend on the data, organization and jurisdictions; this guide does not prescribe one worldwide period or tell the business to delete or preserve a particular record. Bring those constraints to the responsible organizational owner and make the approved scope visible in the backup plan.",{"title":80,"text":81},"Illustrative example: discovery happens after the history rotates","A fictional business notices an unwanted site change only after all retained points have rotated to copies containing that change. The team records the gap and revisits discovery assumptions, history and recovery-source trust together. It does not promise that simply increasing the next retention setting can recreate lost older points. This is a planning example, not a customer incident or measured recovery result.",{"title":83,"paragraphs":84},"Test an older point and the selected business state",[85,86],"Choose a point relevant to the scenarios in the policy, not only the newest successful job. Restore through the supported process in a controlled environment with live integrations isolated. Verify the files, data, configuration and functions needed by the business. Record any version or permission dependencies that make an older point harder to use than a recent copy.","Agree the accepted data state and reconciliation with the business owner. A restore may recover the chosen historic state while omitting later orders or enquiries by design. Keep that limitation separate from a technical failure. If a point may contain malicious changes, assess trust and access remediation alongside restoration rather than interpret a successful functional check as proof of complete cleanup or preserved confidentiality.",{"title":88,"paragraphs":89},"Keep the policy owned as the website changes",[90,91],"Review retention when the website adds new data, a provider changes terms, a job is replaced or administrative ownership changes. Keep the current settings, exclusions, restore checks and responsible contacts in the handoff. Record what evidence supports the accepted policy and what remains outside scope. A maintained policy should help the next administrator make a decision without relying on the memory of the previous supplier.","CyberFixCrew is an Israeli cybersecurity company serving worldwide businesses with practical Israeli website and digital-infrastructure knowledge. We can discuss scoped backup and restore-history work described on this site. We do not guarantee recovery, clean history or a fixed restoration time, and no legal retention service is implied. Describe the website, data and recovery concern without submitting backup credentials or customer records.",[93,94,95,96,97],"Separate copy frequency, retained history and recovery objectives.","Plan for relevant late-discovery scenarios without inventing certainty.","Verify actual rotation, deletion and administrative protection.","Agree organizational constraints with the responsible owners.","Test an older recovery point and record the accepted data state.",[99,102,105],{"question":100,"answer":101},"If backups run often, is long history automatic?","No, frequency and retention are separate settings and processes. Check which recovery points actually remain available.",{"question":103,"answer":104},"Is there one correct retention period for every website?","No universal period is given. Consider business recovery scenarios, data, dependencies and applicable organizational requirements.",{"question":106,"answer":107},"Does increasing retention recover copies already deleted?","No, it may improve future history but cannot be assumed to recreate lost recovery points. Verify what is available now.",[109,112,115,118,121,123],{"path":110,"label":111},"\u002Fglossary\u002F3-2-1-backup","Separate copy structure from usable history",{"path":113,"label":114},"\u002Fglossary\u002Frpo","Understand acceptable data loss",{"path":116,"label":117},"\u002Fglossary\u002Frto","Define the recovery-time objective",{"path":119,"label":120},"\u002Fblog\u002Fbackup-restore-test","Verify a selected restoration point",{"path":13,"label":122},"Scope backup and restore work",{"path":14,"label":124},"Assign ongoing website maintenance ownership",[126,127],{"label":32,"url":33},{"label":72,"url":73},{"title":129,"description":130,"button":131,"type":132},"Review the recovery points the website can actually use","Describe the current history, provider and discovery concern without sending backup access or private data.","Discuss backup retention and recovery","check",[134,142,150,158],{"id":135,"path":136,"title":137,"description":138,"category":139,"artwork":139,"order":140,"publishedOn":141},"P102","\u002Fblog\u002Fdocker-backup-volumes","Docker backup volumes and database recovery: verify the whole app","Map Docker application data, configuration and database consistency. Test recovery in a controlled environment without triggering live orders or notifications.","backups",56,"2026-06-06",{"id":143,"path":144,"title":145,"description":146,"category":139,"artwork":147,"order":148,"publishedOn":149},"P188","\u002Fblog\u002Fbusiness-recovery-plan","Small business disaster recovery plan for websites and digital systems","Plan recovery around critical workflows, owners, time targets and data points. Use tabletop and controlled tests with clear return-to-service criteria.","plan-plus",63,"2026-06-22",{"id":151,"path":152,"title":153,"description":154,"category":139,"artwork":155,"order":156,"publishedOn":157},"P186","\u002Fblog\u002Fbackup-provider-checklist","How to choose a backup service: coverage, access and restore tests","Compare backup services through coverage, versions, ownership, restore evidence, support and exit options. Agree acceptance before relying on a sales claim.","servers",71,"2026-07-08",{"id":159,"path":160,"title":161,"description":162,"category":139,"artwork":163,"order":164,"publishedOn":165},"P072","\u002Fblog\u002Fbackup-access-separation","Backup access separation: protect copies without losing recovery","Map who can read, write, delete and restore backups, change retention or recover accounts. Verify separation and emergency access without deleting live copies.","access",79,"2026-07-24",[],null,{"path":169,"label":170},"\u002Fresources","Website security resources and templates",{"path":172,"label":173},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134058316]