Website backup

A backup is only as good as the restore. A copy that is corrupted, incomplete, stored on the same server or never tested may fail exactly when it is needed. A site's backup also has two halves: the files, such as themes, plugins and uploaded images, and the database, which holds the content, users, orders and settings. Missing either half leaves the restore unusable.

Backups are not the same as version control or a staging site. Version control tracks code changes; staging is a test copy; a backup is the safety net for everything, including content created after the last code change. Nor is a file sync service a backup: if files on the site are deleted or encrypted, a sync can faithfully copy the damage.

How it works

A backup system copies the files and exports the database on a schedule, often daily, then compresses the result and sends it to storage. Full backups copy everything each time; incremental backups copy only what changed since the last one, which saves space and time but depends on a chain of earlier copies being intact.

A widely used guideline is the 3-2-1 rule: keep at least three copies of the data, on two different types of storage, with one copy kept off-site. For a website, that typically means the live site, the host's backups and a third copy at a separate provider or storage service the host cannot reach. Retention matters too: keeping several weeks of copies lets you go back to before a problem began, which helps when a hack went unnoticed for days.

Restoring is the other half of the process. Depending on the tool, it means uploading files and importing the database, or pressing a restore button. Testing that process occasionally, ideally onto a staging copy rather than the live site, is the only way to know the backups work.

Example

A tutoring centre's site is hacked through an outdated plugin and starts redirecting visitors to a gambling site. The host's own backups only go back seven days, and the infection is older. The centre also keeps weekly off-site backups for three months, so the developer restores a clean copy from before the infection, updates every plugin, changes all passwords and re-adds the few posts written since.

Afterwards, the owner sets a reminder to download one backup each quarter and ask the developer to restore it onto staging. The first test reveals that the off-site backups were missing the uploads folder, a gap nobody had noticed. It is fixed the same day.

Why it matters for your business

For most small businesses, the website is a sales channel and a record of years of content. Rebuilding one from scratch after a hack or a failed update can cost far more than any backup service. Host backups are convenient but sit with the same company, so an account suspension, billing dispute or host-wide incident can take both the site and its backups. An independent copy, a sensible retention period and an occasional restore test are cheap insurance, and they also make migrations far less stressful. Ransomware and malicious deletions are reasons to keep at least one copy that the website's own logins cannot alter or delete.

Common mistakes

• Relying only on the host's backups, stored on the same company's infrastructure as the live site.
• Backing up the files but not the database, or the reverse.
• Never testing a restore until the day it is needed.
• Keeping backups for only a few days, so an infection discovered late has no clean copy left.

Questions people ask

How often should I back up my website?

Match it to how often the site changes. A brochure site edited monthly can be backed up weekly; a shop or booking site with daily orders needs daily backups, often more frequent for the database. Also take a manual backup before any update or significant change.

Does my web host back up my website?

Many hosts do, but check how often, how long copies are kept, whether restores are free and where the copies are stored. Host backups are useful but not enough on their own, because they share the host's risks. Keep at least one independent copy elsewhere.

How do I check that my backups work?

Restore one. Download a recent backup and restore it onto a staging site or a temporary address, then check pages, images, forms and the admin login. If anything is missing, fix the backup setup before you need it for real.