Why backups are your safety net

How website and data backups protect your business when everything else fails — and what a good backup strategy looks like.

A backup is a copy of your website and its data, stored separately from your live site. If something goes wrong — a hack, a bad update, an accidental deletion, or a server failure — a good backup means you can restore your site quickly instead of starting over.

Backups are not glamorous. They are also the difference between a bad day and a business disaster.

Quick summary

Backups protect you from hacks, human mistakes, bad updates, and server failures. A good backup strategy means: automatic daily backups, stored off-site (not just on the same server as your site), with at least 30 days of history, checked monthly and restore-tested quarterly.

Why backups are a security measure

Most people think of backups as protection against accidental deletion. They are also — critically — your recovery plan for:

A hacked or malware-infected website. Restoring a clean backup from before the hack is the fastest recovery option. Without a backup, cleanup takes much longer and may not be complete.
Ransomware. If your files are encrypted by ransomware, a clean backup lets you restore without paying.
A bad plugin or theme update. Updates sometimes break sites. A backup means you can roll back in minutes.
Human error. Someone deleted the wrong page, overwrote important content, or made a change they can't undo.

What a good backup strategy looks like

A backup that works

Runs automatically — not just when you remember
Runs every day (or more frequently for high-traffic/e-commerce sites)
Stores the backup off-site — not just on the same server
Keeps at least 30 days of history so you can restore to different points
Includes both your website files and your database
Can be restored with minimal technical knowledge

A backup that lets you down

Only exists on the same server as your site (a server failure takes out both)
Is months old
Only backs up files — not the database (which holds all your content)
Has never been tested
Requires manual triggering and gets forgotten

What needs to be backed up

For a WordPress website, a complete backup includes two things:

Your website files — the WordPress core files, theme files, plugin files, and uploaded media (images, documents, etc.)
Your database — all your content: pages, posts, settings, user accounts, orders (if you have a store), and form submissions

Losing either one without the other makes restoration much harder or impossible. Make sure both are included.

Where your backups should be stored

Off-site storage means a copy exists somewhere separate from your web server. This protects you against:

Server failures (the whole server going down takes local backups with it)
Ransomware that encrypts the server's files
Hacks that delete or corrupt your backups as well as your site

Good backup storage locations include:

Your hosting provider's separate backup infrastructure — but check, because hosts differ. Flywheel says its nightly backups sit "offsite on a different set of servers than your live site", and WP Engine says its nightly backups are kept "on a separate server from your WordPress install". Kinsta's own documentation says the opposite: "Each backup is stored on the same host machine as your site", and off-site copies are a paid external backups add-on.
A cloud storage service like Amazon S3, Google Cloud Storage, or Dropbox
A dedicated backup plugin that pushes to cloud storage

What your hosting provider likely includes

Most managed WordPress hosting plans include backups. Here is what to look for:

Host	Typical backup frequency	Retention	Storage location
Flywheel	Nightly	30 days, then deleted	Off-site, on different servers
WP Engine	Nightly	Its support docs say 30 days; its plans page says no less than 30 and no longer than 60	Separate server from your install
Kinsta	Daily	14 days on most plans, 20 or 30 days on larger ones	Same host machine as your site; off-site copies are a paid add-on
Shared/cPanel hosting	Varies — check with your host	Varies	Often on-server — verify

These change, so treat the table as a prompt to check rather than a guarantee. Log into your hosting dashboard, find the backup section, and confirm what's actually configured for your site.

Testing your backups

A backup that has never been tested is a backup you can't rely on. First, confirm the backups are running at all — see verifying your backups are working for the monthly check. Then test a restore once a quarter, which is the cadence we run for care plan clients:

Run a test restore. Ask us to do a test restore to your staging environment, or trigger one yourself in your hosting control panel.

Verify that the restored site looks and functions correctly.

Note how long the restore took — so you know what to expect in an emergency.

Backups for e-commerce and forms

If your site processes orders or form submissions, consider how frequently critical data is captured:

Orders: An e-commerce site should have backups at least daily — ideally more frequently at peak times. Between backups, any new orders and their data could be lost in a restore.
Form submissions: Check whether your forms store submissions in the WordPress database (most do). If not, check that submissions are being emailed to you as a secondary record.

Common questions

My host says they take backups — is that enough?

It depends on the host. Check: how often? How many days of history? Where are they stored? Can you actually restore from them yourself? Managed WordPress hosts (Flywheel, WP Engine, Kinsta) generally run automatic nightly or daily backups you can restore from the dashboard, but the retention window and whether the copy sits off your server both vary by host and plan. Budget shared hosting may have weaker options. Ask your host specifically.

Should I also use a backup plugin?

A backup plugin (like UpdraftPlus) adds an extra copy in a different location — which is always a good idea. If your host's backups are solid, a plugin backup is belt-and-suspenders protection. If your host's backups are limited, a plugin may be essential.

How long does a restore take?

It depends on the size of your site, and hosts do not promise the same thing. Kinsta says a restore "may take a couple of minutes"; WP Engine says its automated restore "can take anywhere from a few minutes to several hours". Hosts also warn the site can be offline while a restore runs — Flywheel says visitors may briefly see a 403 error page. A full restore — a large site, or one being rebuilt rather than rolled back — takes considerably longer; see Restoring from a backup for what to expect. Having everything in order means a bad day becomes a manageable inconvenience rather than a crisis.

Do backups protect me from a hack?

They are your recovery option, not your prevention. If your site is hacked, a clean pre-hack backup lets you restore quickly. But you still need to fix the vulnerability that allowed the hack, or you'll be hacked again. See What to do if your site is hacked.

Need a hand?

If you're stuck, email support@chykalophia.com and we'll help. Include your website address and a screenshot if you can.