A backup you have never restored is not a backup, it is an assumption. That is easy to write. So I did it: a full restore of a client’s website, on a separate test environment.
Thirty minutes. That is what it took to bring her complete site back, files and database, from the backup to a working website. Measured, not estimated.
Why that number is worth something
Because it answers the only question that matters when things go wrong: how long will my website be down?
Thirty minutes holds under one condition, that the hosting is still there. If the whole environment is gone and a new server is needed, DNS propagation gets added and you are looking at hours, possibly a day. That distinction is something your supplier should tell you before you need it, not after.
What the test turned up
The backup was complete. Every post, page, image and user was in it, down to the oldest files. That is the headline result and it was not a given.
But three other things surfaced that I would not have known without running this.
The restored site did not start on its own. A server configuration file needed adjusting before the site would load at all. During a real recovery that costs time and knowledge you do not want to be figuring out in the moment.
Restoring a backup adds, it does not replace. Anything already on the server that is not in the backup simply stays there. On a hacked site that means the attacker’s files remain, even though you restored properly. The directory has to be emptied first, and that is exactly the step people skip.
And I made a mistake myself. Through a misconfigured setting, the test environment briefly pointed at the client’s live database instead of at the copy. As a result one backup was skipped and her site was briefly hard to reach. I fixed it within the hour, and I told her the same day.
Why I am writing that last part down
Because it is the point. A test that goes flawlessly teaches you nothing. This one tightened my own procedure in three places, and that tightening benefits every client I help afterwards.
The alternative was to keep quiet about it. The client would almost certainly never have noticed. But then I would have done exactly what I criticise in others: telling the good half of the story and leaving out the awkward part.
Everybody looks reliable as long as nothing happens. The difference only becomes visible the moment something does.
The question for your own situation
Do you know how long it takes before your website is running again? And does anybody know, or does that get worked out at the moment it is needed?
If the answer is a number somebody has measured, you are in good hands. If it is an assumption, this is the moment to do something about it. Get in touch if you would like to know where you stand.