CMS Security Handbook: The Comprehensive Guide for WordPress®, Joomla!®, Drupal™, and Plone®

Identifying a Basic Backup Policy

Your backup policy is a guide that you will write that dictates the how, when, and the frequency with which you back up your sites and systems.

Your specific backup policy is something that you will determine on an individual basis. You have the choice of doing a full backup every time, which has the advantage of maintaining a complete backup of all data. It has the downside of getting very unwieldy to manage. Your earlier discovery phase should have identified what is to be backed up, and how often.

One factor to determine is the rate of change of the data. This is the amount of data that changes within a given timeframe. This will guide you to the frequency of backup — that is, hourly, daily, weekly, monthly, or some other schedule. If you have a very busy site with lots of traffic, you may opt for a daily backup. If you have a very static site, then monthly or even less is probably okay.

The other choices in your policy include which system or systems you need to back up. If you have a single site, then that's simple. However, if you are backing up multiple CMSs and other server data, you'll have to decide which systems to back up.

When you back up means what time of the day or night you will conduct a backup. This may or may not be a big factor in your situation. The idea is to avoid performance issues for your users. As you will see later in this chapter, you can take a Drupal site offline temporarily while you make the backup. This is preferable ...