iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Back up according to your recovery point objective (RPO): the maximum amount of website or server data your business can afford to lose after an outage. A static site may need copies after changes and a periodic automated backup, while a publishing site often needs daily protection and a busy store may require hourly or near-continuous database and log copies. Set the interval so the oldest restorable copy is always inside that loss window, then verify it with scheduled restore tests.
Start with RPO, not a calendar rule
Recovery point objective (RPO) answers one question: if the server fails at 3 p.m., how much recent work can disappear without unacceptable business impact? NIST SP 800-209 defines it as the amount of data that can be lost after a failure. Backup technology and frequency should be selected to meet that objective, rather than adopting “daily” because it is a familiar setting.
Write an RPO separately for each important asset. Website files, a database, uploaded media, server configuration, TLS certificates, deployment files, encryption keys and application secrets do not all change at the same rate or have the same consequences when lost. If an online store can recreate only 15 minutes of orders from payment-provider records, its order database may need a 15-minute or tighter RPO even if images and theme files are copied once a day.
RPO examples
- 24-hour RPO: Losing a day of changes is acceptable. A daily database and file copy can be sufficient if the job completes reliably before the next day’s work.
- One-hour RPO: The protection system must create or replicate usable points at least hourly. A nightly backup cannot meet this target, even if it is a large full image.
- Near-zero RPO: Continuous or near-continuous replication may be considered for critical transactions, but replication is not automatically an independent, recoverable backup. It must be isolated, retained and tested like any other recovery copy.
Recovery time objective (RTO) is the companion measure: how quickly the site or server must be usable again. A schedule that meets RPO but requires two days to restore fails a business that needs service within two hours. Record both objectives before choosing storage, software or a managed service.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
How site type and change rate affect frequency
NIST SP 800-123 notes that backup frequency depends on site and configuration volatility, data type and volume, available media and time, criticality and threat level. Measure how often files, rows and configuration values actually change. Increase frequency during launches, migrations, upgrades and periods of unusually high activity.
| Workload | Practical starting schedule | Adjust when |
|---|---|---|
| Static brochure site | Capture a copy after content or configuration changes, plus an automated periodic copy; retain several restore points and keep one off-site. | Shorten the interval if edits are frequent or losing the period between scheduled copies exceeds the documented RPO. |
| Blog or CMS with regular publishing | At least daily database and file backups; take additional copies during active publishing, plugin changes or upgrades. | Use more frequent database protection when several posts, comments or customer records are created each day. |
| E-commerce or high-change application | Hourly or more frequent database and log protection when the business cannot recreate that much activity. | Consider continuous or near-continuous replication only after confirming restore points, retention and isolation. |
| Server configuration and infrastructure | Take a full image before major changes and on a recurring weekly-to-monthly cadence appropriate to the environment; separately capture rebuild configuration and secrets. | Shorten the cadence after infrastructure, hosting, database or threat changes. |
These are starting points, not universal mandates. Calculate the oldest copy available during a failure and compare it with the RPO for each asset. A site that changes only once a month still needs a tested recovery path; low change volume does not remove the risk of ransomware, hardware failure or an incorrect deployment.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose a layered set of backup types
Full backups
A full backup captures the selected server, files and databases at a point in time. It is the simplest single restore source, but it consumes the most storage, network bandwidth and processing time. Take one before major application, database or infrastructure changes and on a recurring weekly-to-monthly cadence that your environment can complete and verify.
Incremental backups
An incremental copy contains changes since the previous backup, whether that previous copy was full or incremental. It is usually faster and smaller, making daily or more frequent protection practical. Restoration may require the original full backup and every subsequent incremental in the chain, so monitor chain integrity and keep the required sequence together.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Differential backups
A differential copy contains changes since the last full backup. It grows until the next full image, but a restore generally needs only the full backup and the latest differential. This can simplify recovery at the cost of larger daily copies than an incremental plan.
NIST SP 800-123 describes general patterns of full backups weekly to monthly and incremental or differential backups daily to weekly, subject to the environment’s RPO. A high-change database may need transaction-log or replication protection between those points, while a small static site may not.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Build the 3-2-1 layout—and isolate one copy
The 3-2-1 rule means keeping three copies of the data, on two media types, with one copy off-site. NIST’s National Cybersecurity Center of Excellence presents this as practical protection against data-loss events. A production disk plus two backup folders on the same server is one failure domain, not three resilient copies.
- Three copies: include the live data and at least two independent recovery copies, or three backup copies if your policy defines the count that way.
- Two media types: combine storage classes such as local disk and removable or cloud storage. Keep credentials and administration paths separate where possible.
- One off-site: place a copy in another facility or region so a fire, flood, provider outage or site-wide compromise cannot remove every copy.
CISA’s StopRansomware guidance adds two properties that the basic mnemonic does not state: keep critical backups offline and encrypted, and regularly test their availability and integrity. “Offline” means production credentials or malware cannot directly alter or delete the copy; a backup share permanently mounted with administrator access does not provide that isolation. A network-attached storage device can automate local copies, but by itself it is neither off-site nor isolated.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Use immutability or write-once retention where available for the copy that must survive an administrator-account compromise. Encrypt data in transit and at rest, and store recovery keys separately from the backup destination. Document who can retrieve a copy during an incident; an inaccessible encrypted backup is not a usable recovery asset.
Set retention around business and legal needs
Retention answers how far back you can recover, not how often you create a copy. NIST guidance recommends defining retention by data and log type, legal and business requirements, protection, destruction and archiving. Do not apply one arbitrary number of days to every asset.
Recommended Free Tools
- Daily points: preserve enough recent copies to cover ordinary mistakes, failed deployments and short investigation windows.
- Weekly and monthly points: retain longer-lived snapshots to recover from an error discovered after several daily copies have rotated out.
- Event-driven points: keep a protected copy before upgrades, migrations, schema changes, certificate replacement or major content releases.
- Logs and regulated records: set retention from contractual, legal or audit obligations, then apply access control and documented destruction dates.
Retention must include the metadata needed to restore: database versions, application packages, configuration, certificates, keys and dependency information. A file archive without the settings required to boot the application may satisfy storage quotas but not the recovery objective.
Automate the schedule and monitor the result
- Document objectives. Write RPO and RTO values for files, databases, configuration, certificates and keys. Identify the person accountable for each value.
- Inventory what must be copied. Include web roots, uploads, database contents, scheduled-job definitions, virtual-host settings, firewall rules, deployment manifests and secrets needed to rebuild. Exclude caches and reproducible temporary files only after confirming they are not required.
- Configure recurring jobs. Combine full images with incremental or differential copies at the interval that meets each RPO. Schedule database-consistent snapshots rather than copying live database files blindly.
- Alert on failure. Send an actionable alert when a job fails, produces an incomplete copy, runs outside its time window or leaves less free space than the next retention cycle requires. Treat an unacknowledged alert as a recovery risk.
- Protect destinations. Apply separate credentials, encryption, access logging and offline or immutable retention to the off-site copy. Test that production administrators cannot silently erase every copy.
- Record retention. Define daily, weekly, monthly and event-driven points, plus legal holds and destruction procedures. Review storage growth instead of allowing an unbounded archive.
Prove that backups restore
A successful backup job is not proof that an application can be recovered. NIST SP 800-209 calls for periodic restore tests against the required recovery time and validation of backup-copy health. CISA likewise recommends regular availability and integrity testing. Test in an isolated environment so the exercise cannot overwrite production.
Rank #4
- High capacity in a small enclosure – The small, lightweight design offers up to 6TB* capacity, making WD Elements portable hard drives the ideal companion for consumers on the go.
- Plug-and-play expandability
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
Use three restore exercises
- File restore: Retrieve a deleted page, upload or configuration file. Check permissions, ownership, timestamps and whether the web server can read it.
- Database restore: Restore a representative database to a clean instance. Run consistency checks, log in as an application user and verify recent records, indexes, character encoding and time zones.
- Complete rebuild: Start with an empty server or recovery account. Reinstall the operating system or image, apply configuration and secrets, restore files and database, update DNS or the load balancer in a controlled test, and measure elapsed time against the RTO.
Record the backup point used, start and finish times, data-loss interval, errors, operator actions and unresolved gaps. NIST SP 800-209 offers a validation heuristic of roughly one to 1.5 orders of magnitude fewer validation samples than backup frequency; for example, hourly copies may be validated daily. Use that as a planning heuristic, then increase testing after major changes or failures.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common scheduling mistakes and their fixes
“A nightly full backup is enough”
It is enough only when a 24-hour loss fits the RPO and the job completes before the next day’s work. Add incremental, differential, log or replication protection when the tolerated loss is shorter.
“Replication is the backup”
Replication can copy corruption, accidental deletion or ransomware quickly to the secondary system. Preserve point-in-time versions, isolate the destination and test an independent restore.
“The NAS covers the 3-2-1 rule”
A second device on the same network may satisfy a media distinction but not off-site or offline isolation. Add a geographically separate, encrypted copy and protect it from production credentials.
Best Value
- Plug-and-play expandability
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
“The job says successful, so restoration is guaranteed”
Permissions, missing keys, incompatible database versions, broken backup chains and silent corruption can all defeat recovery. Perform file, database and full-rebuild tests and retain their results.
“Keep everything forever”
Unbounded retention increases cost, exposes old sensitive data and can complicate legal destruction. Define retention by asset, business purpose and obligation, with documented deletion and archive controls.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteRevisit the plan when conditions change
Review the schedule after a major application release, hosting move, database migration, infrastructure redesign or change in threat level. Recalculate change rate and transaction volume, confirm that storage and network windows still complete, and rerun restore tests. A schedule remains appropriate only while its measured recovery point and recovery time satisfy the current RPO and RTO.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
