Why backups are your safety net
How website and data backups protect your business when everything else fails — and what a good backup strategy looks like.
A backup is a copy of your website and its data, stored separately from your live site. If something goes wrong — a hack, a bad update, an accidental deletion, or a server failure — a good backup means you can restore your site quickly instead of starting over.
Backups are not glamorous. They are also the difference between a bad day and a business disaster.
Quick summary
Backups protect you from hacks, human mistakes, bad updates, and server failures. A good backup strategy means: automatic daily backups, stored off-site (not just on the same server as your site), with at least 30 days of history. Test your backup restore process before you need it.
Why backups are a security measure
Most people think of backups as protection against accidental deletion. They are also — critically — your recovery plan for:
- A hacked or malware-infected website. Restoring a clean backup from before the hack is the fastest recovery option. Without a backup, cleanup takes much longer and may not be complete.
- Ransomware. If your files are encrypted by ransomware, a clean backup lets you restore without paying.
- A bad plugin or theme update. Updates sometimes break sites. A backup means you can roll back in minutes.
- Human error. Someone deleted the wrong page, overwrote important content, or made a change they can't undo.
What a good backup strategy looks like
A backup that works
- Runs automatically — not just when you remember
- Runs every day (or more frequently for high-traffic/e-commerce sites)
- Stores the backup off-site — not just on the same server
- Keeps at least 30 days of history so you can restore to different points
- Includes both your website files and your database
- Can be restored with minimal technical knowledge
A backup that lets you down
- Only exists on the same server as your site (a server failure takes out both)
- Is months old
- Only backs up files — not the database (which holds all your content)
- Has never been tested
- Requires manual triggering and gets forgotten
What needs to be backed up
For a WordPress website, a complete backup includes two things:
- Your website files — the WordPress core files, theme files, plugin files, and uploaded media (images, documents, etc.)
- Your database — all your content: pages, posts, settings, user accounts, orders (if you have a store), and form submissions
Losing either one without the other makes restoration much harder or impossible. Make sure both are included.
Where your backups should be stored
Off-site storage means a copy exists somewhere separate from your web server. This protects you against:
- Server failures (the whole server going down takes local backups with it)
- Ransomware that encrypts the server's files
- Hacks that delete or corrupt your backups as well as your site
Good backup storage locations include:
- Your hosting provider's separate backup infrastructure (most managed hosts handle this)
- A cloud storage service like Amazon S3, Google Cloud Storage, or Dropbox
- A dedicated backup plugin that pushes to cloud storage
What your hosting provider likely includes
Most managed WordPress hosting plans include backups. Here is what to look for:
| Host | Typical backup frequency | Retention | Storage location |
|---|---|---|---|
| Flywheel | Daily | 30 days | Off-server |
| WP Engine | Daily | 40 days; 60 days on some plans | Off-server |
| Kinsta | Daily | 14 days (longer on higher plans) | Off-server |
| Shared/cPanel hosting | Varies — check with your host | Varies | Often on-server — verify |
Log into your hosting dashboard and find the backup section to confirm what's configured for your site.
Testing your backups
A backup that has never been tested is a backup you can't rely on. At least once a year (and ideally more often), test a restore:
Ask us to do a test restore to your staging environment, or trigger one yourself in your hosting control panel.
Verify that the restored site looks and functions correctly.
Note how long the restore took — so you know what to expect in an emergency.
Backups for e-commerce and forms
If your site processes orders or form submissions, consider how frequently critical data is captured:
- Orders: An e-commerce site should have backups at least daily — ideally more frequently at peak times. Between backups, any new orders and their data could be lost in a restore.
- Form submissions: Check whether your forms store submissions in the WordPress database (most do). If not, check that submissions are being emailed to you as a secondary record.
Common questions
Related guides
- What to do if your site is hacked
- Malware & your website explained
- Securing your WordPress site
- How backups work (Website Care)
- Restoring your site from a backup
Need a hand?