When you run business software on your own hosting, you own your data, and you are responsible for keeping a copy of it. Hardware fails, accounts get suspended for unpaid bills, files get deleted by mistake and updates sometimes go wrong. A backup routine turns each of those from a disaster into an inconvenience. This guide sets out a simple routine a small business can keep up without technical staff.
The 3-2-1 rule
A widely used guideline is to keep:
- 3 copies of your data (the live copy plus two backups),
- on 2 different kinds of storage (for example your hosting account and a cloud drive),
- with 1 copy off-site, somewhere separate from your hosting company.
The point is that no single failure, whether a server problem, a lost laptop or a closed account, can take every copy at once.
What to back up
For a typical PHP application, two things matter:
- The data. This might be a MySQL database, a SQLite file, or a folder of data files (often called
data). It holds your sales, customers, orders and settings, and it changes every day. - Uploaded files. Product images, logos and documents, usually in an
uploadsfolder.
The application code matters less, because you can download it again from your purchase, but keeping a copy of the exact version you run makes restoring faster. Keep any licence keys and your admin login details in a password manager, not only on the server.
How to make a backup in cPanel
Files
- Open File Manager and go to the application's folder.
- Select the
dataanduploadsfolders (or the whole application folder). - Choose Compress and create a ZIP file.
- Download the ZIP to your computer, then delete it from the server so it does not sit in a public folder.
Databases
- Open phpMyAdmin and select the application's database.
- Choose Export, use the quick method and SQL format, and download the file.
Many hosts also offer a full-account backup under Backup or Backup Wizard, and some take automatic backups. Find out how long your host keeps them, but do not rely on them as your only copy: if your hosting account is lost, its backups may be lost with it.
A routine you can keep
| When | What |
|---|---|
| Weekly (or daily for busy shops) | Download the data and uploads ZIP, and the database export if there is one. |
| Before every update | Take a full backup of the application folder and data. |
| Monthly | Copy the latest backup to a second place, such as a cloud drive or external disk. |
| Every three months | Test a restore (see below). |
Name files with the date, for example shop-data-2026-10-24.zip, and keep several weeks of copies rather than only the latest. If a problem goes unnoticed for a few days, an older backup may be the only clean one.
Test your restore
A backup you have never restored is a hope, not a plan. Every few months:
- Create a test folder or subdomain on your hosting.
- Upload the application and your backed-up data into it.
- Open it, sign in and check that recent sales, customers and images are there.
- Delete the test copy afterwards.
Applications that can run in any folder make this easy, because the restored copy works without configuration changes.
Protect the backups themselves
- Backups contain customer details and business records. Store them in a private location, and use a password-protected drive or encrypted cloud storage where you can.
- Never leave backup ZIPs in your website's public folders, where anyone who guesses the file name could download them.
- Limit who has access to the backup location.
Write it down
Put the routine on one page: where backups go, who makes them, how often, and how to restore. If the person who usually does it is away, someone else should be able to follow it.
Applies to everything we sell
All of our products are self-hosted, so this routine applies to each of them. Most store their data in files or SQLite and need no database server, which makes backups a matter of copying folders; each product page lists exactly what it uses. For installation steps, see How to install a PHP web app on cPanel.
