Test website restoration before an incident

Define what must be recoverable

Inventory code, content, databases, uploads, media, application settings and scheduled jobs. Some elements live with the host, others in a CMS, separate storage or a third-party service. Distinguish what can be rebuilt from what would be lost permanently.

Set an acceptable recovery point for each set: a brochure site updated monthly and a service receiving daily enquiries have different needs. Record copy frequency, location, retention and who can initiate a restoration.

• Inventory of necessary content and data.
• Acceptable recovery point for each set.
• Copy locations and accountable people.

Separate copies, exports and restoration

An editorial export may retrieve text but omit themes, settings, users or media. Files alone may omit the database. Ask the provider exactly what its service covers and what remains your responsibility. WordPress documentation recommends backing up before plugin updates; the exact method depends on the architecture.

Protect copies according to the context and limit who can read or replace them. Document restoration prerequisites without publishing credentials, keys or access details in a shared guide.

Identify dependencies before selecting the newest archive. In NIST’s classic model, a full backup covers the selected scope, an incremental contains changes since the previous backup and a differential changes since the last full backup. In this exercise F0 is the starting full copy; I1, I2 and I3 are successive incrementals. Finding I3 alone cannot reconstruct that scope at the third point.

The differential branch is an alternative strategy: D3 accumulates changes since F0, so this model uses F0 and D3 without intermediate differentials. These are teaching dependencies, not archives available on this site. Deduplicated, synthetic or snapshot-based tools may behave differently; check the provider’s contract. Retention must preserve what retained restore points require, and authorised people must be able to access the necessary keys.

Scroll the table horizontally to read every column. With a keyboard, focus the table area and use the arrow keys.

Rehearse in an isolated environment

Choose a copy and restore it away from the public website. Time the steps instead of assuming the written procedure is complete. Check pages, media, links, required permissions, the form in test mode and functions that rely on external services.

Compare restored data with the initial inventory. Record absent items, the latest change present and settings that need rebuilding. A successful exercise should be repeatable by another authorised person within the time the organisation considers acceptable.

Fictional rehearsal in an isolated environment: the expected backup contains 120 articles and 200 identified media items. Restoration finds 120 articles and 200 media items, but M200 is missing and X200, absent from the expected inventory, replaces it. Equal counts conceal a mismatch: only 199 expected media identifiers are present. Compare identifier sets before inspecting the affected files and links.

The table separates four checks. Even if articles, test roles and the contact journey pass, the media mismatch prevents acceptance of the complete rehearsal. The three roles are fictional profiles checked against a defined permissions matrix. The form uses a test enquiry and a neutralized email sink; no real delivery is required to check the planned chain in this environment.

• Copy and environment used.
• Observed duration and manual steps.
• Pages, data and functions actually checked.

Scroll the table horizontally to read every column. With a keyboard, focus the table area and use the arrow keys.

• Cybermalveillance.gouv.fr : Sauvegardes

  Cybermalveillance.gouv.fr, consulted 22 October 2026: testing backups. The volumes, identifiers and results are fictional.

Fix the plan and schedule the next exercise

Update the procedure after each rehearsal: contacts, operation order, dependencies and exit checks. Repeat after a migration, provider change or significant application update. The maintenance guide puts restoration checks into regular site operations.

During a real incident, preserve useful diagnostic information and coordinate recovery with the responsible people. A restoration test reduces uncertainty; it does not guarantee zero loss or a third party’s availability.

Decide in a concrete situation

Fictional example: the database is recovered but media are missing and accounts fail. Define restored service before testing: data, files, access and essential functions need examination together.

Record backup point, isolated environment, steps and journey result. Retain missing elements and observed time; archive size does not establish that operations can resume.

• Protect and test a website staging environment

  Separate access control from indexing, prevent real messages and transactions, use synthetic data and verify the production transition.

Measure acceptable loss and recovery time separately

Define both the maximum age of data you can afford to lose and the acceptable interruption. A daily copy does not guarantee fast recovery: domain control, access, secrets or dependencies may be missing. Measure both gaps during a restore exercise.

Calculate the gap between the backup point and service recovery

Fictional exercise on the same day and in the same time zone: last usable backup at 02:00, incident at 10:30, verified service at 12:00. Assume that no log or other mechanism recovers changes made after the copy.

Scroll the table horizontally to read every column. With a keyboard, focus the table area and use the arrow keys.

• NIST · Recovery Point Objective

  NIST defines RPO by the data recovery point and RTO by the recovery duration tolerable for business activity. These figures are teaching assumptions, not hosting guarantees.