Web · 5 min read · October 2026
A backup you have never restored is a hope
Websites break. An update goes wrong, a plugin conflicts, a hacker gets in, a host has an outage, or someone deletes the wrong page. When it happens, the only question that matters is: how quickly can you get the site back as it was? The answer depends entirely on backups made before the problem.
Here is what a proper website backup includes, how often to make one, where to keep copies, and the step almost everyone skips: testing that the backup actually works.
01
What a backup must include
For a WordPress site, a complete backup has two parts: the files (theme, plugins, uploaded images and documents) and the database (pages, posts, settings, users, form entries). A backup of only one is not enough to restore the site. For a static site, the files are everything, plus a copy of the domain and DNS settings.
Also keep a record of where the domain, hosting and email are registered, and who has the logins. Those are not backed up by any plugin.
02
How often
Match the frequency to how often the site changes. A brochure site updated once a month needs a weekly backup and one before every change. A busy online store or a site with daily blog posts and bookings needs daily backups, sometimes more. Always take a backup immediately before updating WordPress, the theme or plugins.
03
Where to keep copies
A backup stored only on the same server as the website is not much use if the server fails or the account is hacked or suspended. Keep at least one copy somewhere else: cloud storage such as Google Drive or Dropbox, or a separate backup service. Many backup plugins can send copies off-site automatically.
A common rule is three copies, on two different types of storage, with one off-site.
Make sure off-site backups are in an account you control, not only your developer's.
04
Host backups are a bonus, not a plan
Many hosts take automatic backups, which is helpful. But check how often, how long they are kept and whether restoring costs extra. Some keep only a few days, so a problem noticed after a week cannot be undone. Treat host backups as one layer, and keep your own as well.
05
Test the restore
A backup has never been proven until it has been restored. Files can be incomplete, databases corrupted, or the backup may have silently stopped weeks ago. At least twice a year, restore a backup to a test location, such as a staging site or a subfolder, and check that the pages, images and forms work. It takes an hour and tells you whether your safety net is real.
06
Keep several versions
If a site is hacked, the hack may have happened weeks before anyone noticed. A backup from yesterday may contain the same problem. Keep a range of versions: daily for the last week or two, weekly for a month or two, and a monthly copy for several months. That gives you a clean point to return to.
07
Write down the recovery steps
In an emergency, nobody wants to work out the process from scratch. Write a short recovery note: where backups are stored, how to access them, which plugin or tool restores them, and who to call. Keep it somewhere outside the website, such as a shared document or a printed page in the office.
The cost of no backup
Rebuilding a website from scratch after losing it can cost as much as building it the first time, plus the lost enquiries while it is down. A reliable backup routine costs a small yearly fee for a plugin or service and an hour of testing.
Back up automatically, store it elsewhere, and test it twice a year.
If someone maintains your website for you, ask them three questions: how often is it backed up, where are the copies, and when was a restore last tested?
Backup checklist
- Complete. Files and database, or all files for a static site.
- Automatic. Daily or weekly depending on how often the site changes.
- Off-site. At least one copy outside the hosting account, in your name.
- Versions. Daily, weekly and monthly copies kept.
- Tested. A restore checked at least twice a year.
If any line on this list is a question mark for your site, that is the one to fix first.
Quick answers
How often should I back up my website?
At least weekly for a site that rarely changes, daily for busy sites and online stores, and always immediately before updates.
Are my hosting company's backups enough?
They help, but check how often they run, how long they are kept and whether restoring costs extra. Keep your own off-site copies as well.
How do I know my website backup works?
Restore it to a test location at least twice a year and check that pages, images and forms work. An untested backup may be incomplete.
Related reading
Backups that have actually been tested.
Every WordPress site I build launches with automatic off-site backups in your name, and a restore tested before handover. Ask me to check your current backups.