“Yes, we’ve got backups” is one of the least reliable sentences in small business. When we take over a site and ask to see them, we often find a plugin that stopped running months ago, a zip file stored on the same server as the site, or a host’s backup that only goes back two days. Each of those counts as a backup right up until the moment you need one.
A good backup setup answers five questions. If you can answer all five for your own site, you’re in better shape than most.
1. Where is it stored?
Somewhere other than the server your website runs on. This is the one that matters most.
If your backups sit in a folder on the same hosting account, they share the site’s fate. A hacked account, a server failure, an expired hosting bill or a host going out of business takes the backups with it. Hackers know where common backup plugins store their files, and some deliberately delete or infect them.
Offsite means a separate storage service: a cloud bucket, a dedicated backup service, or your host’s backup system if it stores copies on different infrastructure. Ideally it uses a separate login too, so one stolen password doesn’t open both.
2. How often does it run?
Often enough that you’d be comfortable losing everything since the last one. That depends on how often your site changes.
| Type of site | What changes | Sensible frequency |
|---|---|---|
| Brochure site, edited a few times a year | Occasional page edits | Weekly, plus before any update or edit session |
| Service business with a blog or news | New posts, form entries | Daily |
| Site that stores enquiries or bookings in the database | Form entries every day | Daily database at minimum |
| WooCommerce shop | Orders, stock, customers | Database several times a day, or near real-time; files daily |
The files (themes, plugins, uploaded images) change less often than the database (pages, posts, orders, form entries, settings). Good backup tools let you schedule them separately, which keeps storage costs sensible.
Always take a fresh backup immediately before updates or major changes, whatever your schedule. That’s the copy you’ll reach for if an update goes wrong, and our routine for that is in WordPress updates: core, plugins and themes in the right order.
3. How many copies are kept?
More than one, and going back further than you’d think.
If you only keep last night’s backup, a problem you don’t notice for three days means every backup you have contains the problem. This is especially true of hacks, which often sit quietly for a week or more before the obvious symptoms appear. We explain why that matters for restoring in your WordPress site has been hacked: the first hour.
For most small business sites, we aim for something like:
- Daily copies kept for 2 to 4 weeks
- Weekly copies kept for 2 to 3 months
- A monthly copy kept for longer, for the “when did that page change?” questions
It’s also worth keeping a copy of the site at launch, and before any redesign, somewhere separate and permanent.
4. Does it include everything?
A complete WordPress backup has two parts: the database, and the files (the wp-content folder at minimum, which holds your themes, plugins and media uploads). A backup of only one is half a backup.
Check it also catches anything unusual about your setup: custom files in the site root, a separate folder of downloads, or anything your developer has added outside the standard structure. And remember what isn’t part of the website backup at all. Email accounts, DNS records and your domain registration all live elsewhere, usually with your business email and DNS provider. Know where those are kept and who can get to them.
5. Have you ever restored one?
This is the question almost nobody can answer yes to, and it’s the one that matters on the bad day.
A backup you’ve never restored is a hope, not a plan. Files get corrupted. Backup jobs fail silently. Archives turn out to be missing the database. Restore tools turn out to need a login nobody has.
A test restore that takes under an hour:
- Pick a backup from about a week ago, not last night’s.
- Restore it to a staging site or a temporary subdomain, never over the live site. (If you don’t have one, read WordPress staging sites explained.)
- Log in and click through the key pages: homepage, services, contact, and the shop or booking pages if you have them.
- Check that images load, menus work and recent content from that date is there.
- Note how long it took and anything that tripped you up.
- Delete the test copy, or block it from search engines if you keep it.
Do this when you set backups up, and again every three to six months. Put it in the calendar like any other maintenance job.
The 3-2-1 idea, in plain terms
You’ll see backup people mention “3-2-1”: three copies of your data, on two different types of storage, with one offsite. For a small business website, a practical version is the live site, plus your host’s backups, plus an independent offsite copy that your host can’t touch. If any one of those fails, you’ve still got two.
WordPress’s own Hardening WordPress guide puts regular backups among the basics for the same reason. Security measures reduce the odds of something going wrong. Backups decide how bad it is when something does.
What your host’s backups are (and aren’t)
Many hosts include backups, and good ones are useful. But ask three things before relying on them. How long are they kept? Can you restore one yourself, or do you need to raise a ticket? Is there a fee per restore? A host that keeps seven days of backups and charges for each restore is a safety net, not a strategy.
We like having both: host-level backups for speed, and an independent offsite copy for the day something goes badly wrong with the host itself.
Your backup scorecard
Fill this in for your own site:
- Backups are stored offsite: yes / no / not sure
- They run at a frequency that matches how often the site changes: yes / no
- At least two weeks of copies are kept: yes / no
- Both files and database are included: yes / no
- A test restore has been done in the last six months: yes / no
Any “no” or “not sure” is worth fixing before you need it. Anything you can’t answer at all means it’s time to ask your developer or host directly.
Scored a few “not sure” answers? We can check your current setup or sit with you through a first test restore, and our contact page is the quickest way to book that. And if your host’s answers to the questions above were vague, our hosting and care plans page explains how hosting and backups work with us.