Storage capacity says little about what happens after a failed update or a lost database. For online store hosting, you need to know who responds, which data is available and how the store can safely resume taking orders.
The questions below are our practical recommendations for comparing and agreeing services. CISA’s guidance supports keeping separate backups and regularly testing recovery. These are assessment criteria, not a standard guarantee for every hosting package.
Make update ownership explicit
Record who updates the server, runtime, application and dependencies. These may be different parties. Agree who assesses security advisories, contacts the owner, applies the update and checks the store afterwards.
Ask how routine maintenance is scheduled and how an urgent advisory is handled. A general uptime promise does not identify who patches a vulnerable runtime. Choose arrangements that suit your store’s business impact, availability and support needs.
A React and Node.js solution still needs maintenance. Node.js, for example, has its own security reporting and release support process. Assess versions, dependencies and responsibilities when choosing a new technology too.
Ask exactly what the backup contains
A store contains more than visible product pages. Recovery may need the database, uploads, application version and configuration. Establish which components the backup includes and which can be safely retrieved from another source.
CISA recommends offline, encrypted backups of critical data and regular tests of availability and integrity in a recovery scenario. The purpose is to prevent a problem in the active environment from also destroying every recovery option.
Our recommendation is to ask where copies are stored, who can access them, how long they are retained and how missing or failed backups are handled. Agree who can recover access and keys if the normal administration environment is unavailable.
Make the restore test demonstrate something
Request a test in a separate environment using an agreed recovery point and checklist. Record which copy was used, what was retrieved, how long it took and which components failed. A successful backup notification is a different result from a working restored store.
Our recommended checklist includes product data, images, sign-in, order history and the relationship between order and payment status. Check how the application starts when the original server is unavailable. This reveals dependencies before an incident forces you to discover them.
Prevent the test environment from emailing real customers, changing stock or performing payment actions. Agree beforehand which data and integrations the test will use and what happens to the test environment afterwards.
Agree acceptable data loss and recovery time
How many recent orders could you afford to lose when returning to a backup? How long can the store remain unavailable? “We back up daily” is insufficient if orders from the last few hours are essential.
Our recommendation is to express these limits in plain language and explain how the backup schedule and recovery procedure meet them. Also document how orders and payments received after the recovery point will be reconciled. Measure a test instead of presenting a target time as a proven result.
Compare the complete proposal
Alongside the monthly price, compare maintenance, retention, support, recovery charges and access to your data. Ask what you receive when leaving and what assistance is needed to move elsewhere. This makes proposals comparable on substance.
Discuss with TovieIT which store, functions and business limits you need to support. A rebuild and hosting proposal should explicitly include maintenance responsibilities and recovery arrangements. The suitable proposal follows from your store and the agreed service scope.
Sources checked:
Sources & verification
The links below lead to the original documentation. Versions and advice may change; ask your host to check your own setup.
- CISA and MS-ISAC: StopRansomware Guide
- Node.js: Security Reporting
- NIST: Protecting Data from Ransomware and Other Data Loss Events
Updated:
About this publication. TovieIT builds and hosts websites. This guide is our own publication; general information is not an individual security assessment.