CentriWebA website backup is a complete copy of your site, both the files and the database, kept somewhere other than your web host, and it only counts once you have restored it successfully. For most small business sites, a daily automatic backup, a second copy stored elsewhere, and one restore test every quarter is a sound baseline.
What a website backup has to contain
A site is two things. The files are the theme, plugins, images and uploads. The database holds the content: pages, posts, form entries, orders, bookings and settings. WordPress’s developer documentation says you need both to fully restore a typical WordPress site, and that a files backup does not include the database.
This is the most common gap. Some tools copy only the files and some only the database. Ask of any backup, “does this hold both?” If your site is built on something other than WordPress, the same idea applies: find out where the content lives and make sure it is in the copy.
How often to do a website backup
The same WordPress documentation says the right frequency depends on how often the site changes and how much you can afford to lose. It suggests roughly weekly for a small site with few changes and daily for a busy one, and a backup before every upgrade. It also suggests keeping at least three to five recent backups in different locations.
Use this to decide for your own site. Ask: if the site broke right now and I went back to the last backup, what would I lose?
| Type of site | What changes | Backup rhythm to consider |
|---|---|---|
| Brochure site, rarely edited | A page or two a month | Weekly, plus before every update |
| Site with a blog or regular edits | Posts and pages each week | Daily |
| Site taking bookings, orders or form enquiries | New records every day | Daily at minimum; ask whether your system can back up more often |
The last row needs care. If your site stores bookings and orders in its own database, a restore from last night loses today’s records. Many businesses also email or save every enquiry to a CRM, which means a restore costs less. If that is you, the backup matters less for enquiries and more for the site itself.
Where to keep your backups
A backup stored on the same server as the site goes down with it. A hosting failure, a hacked account or a deleted account can take both. Keep at least one copy somewhere else, under a login that is not the hosting login.
The UK’s National Cyber Security Centre, in its small organisations guide, suggests using both an online backup and a storage device for two copies, protecting online backups with two-step verification, and keeping a backup device disconnected when it is not in use, because some viruses spread to connected devices.
A workable setup for a small business:
- Copy one: your host’s automatic backup, if it has one.
- Copy two: a separate backup to cloud storage that you own, set to run automatically.
- Copy three, now and then: a download to your own computer or drive before big changes such as a redesign or a move.
Host backups are useful but you should know their terms: how long they are kept, whether you can download them, and whether you can restore them yourself or have to ask support. Our guide to managed WordPress hosting covers what to ask a host.
Plugin, host or both
There are three common ways to take a website backup, and they suit different people.
- Your host’s backup. Easy, usually automatic, and tied to the same company that runs your site. Good as copy one, but risky as the only copy.
- A backup plugin. On WordPress, a plugin can copy files and database on a schedule and send them to cloud storage you control. You manage the settings, so someone needs to check it keeps running after updates.
- A manual export. Slow, but you hold the file. Useful before a big change.
Check each vendor’s own page for what a plan includes and how long copies are kept, because this changes by product and by plan. A combination of a host backup plus one you control covers most small sites.
Keep backups private
A backup is a full copy of your site, including customer enquiries and, on some sites, customer accounts. Treat it as sensitive. Store it in an account with two-step verification, share it with as few people as possible, and delete old copies you no longer need. Never leave a backup file sitting in a public folder on your own website.
Why a backup you have not restored is a hope
Backups fail quietly. The job stops running after a plugin update. Storage fills up. The backup completes but misses the database. A password changes and the cloud copy stops uploading. You find out when you need it, which is the worst time.
The WordPress documentation suggests checking an automated backup against a manual one once in a while, to confirm the process works. NCSC’s advice is to know how to restore a backup and to check that it holds all your important data. Both come to the same thing: you prove a backup by restoring it.
A restore test you can run this week
You can do this in about an hour with a developer, or with your host’s support, and it does not touch your live site. Never test a restore over the live site.
- Pick the backup. Choose a recent one from your separate copy, not the host’s, if you have both. This also tests that you can get at it.
- Restore it somewhere safe. Use a staging copy or a spare address such as a test subdomain. Many hosts offer staging in their control panel. If yours does not, ask support or your developer.
- Time it. Write down how long it took from starting to a working site.
- Check the site works. Use the list below.
- Write down what you did. Put the steps and who can do them in one page, with where the logins are kept.
- Delete the test copy. A forgotten copy of your site is a security risk and can confuse search engines.
What to check on the restored copy:
- The home page and a handful of inner pages load, with images.
- The most recent post or page you published is there.
- You can log in to the admin area.
- A contact form submits and the notification arrives. On a staging copy this may need switching on, so ask your developer.
- Bookings, orders or member data from the last week are present, if your site holds them.
- Menus, links and the phone number in the footer are correct.
If something is missing, you have just found a gap that would have cost you in a real emergency. Fix the backup, then test again.
What to do if the restore fails
First, do not delete anything on the live site. Check whether the backup is incomplete (files only, no database) or whether the restore method is wrong. Try the other copy. If neither works, ask your host’s support whether they hold a copy you cannot see.
Then change the process as well as the file. Add a second backup method, set a reminder to test again in a month, and write down what went wrong. The checklist in our website security checklist is a good next step, because a hacked site is one of the main reasons people need a restore.
Make it routine
Put three entries in the calendar: a monthly look at the backup log to confirm it ran, a quarterly restore test, and a check after any change of host, plugin set or login. Give each to a named person. A small business does not need a heavy process, only one that is written down and repeated. The other pieces of a reliable setup are in our systems guides.
CentriWeb builds websites on WordPress and runs managed hosting, and looks after the sites it builds. If your site is simple and your host already offers downloadable backups you can restore yourself, the steps above are enough. This article is general information, so check your own host’s terms for what they keep and for how long.