How backups work

A backup is a saved copy of your website. If something ever goes wrong (a bad update, accidental deletion, or a security incident), a backup is how you get your site back. What a backup looks like, and whether you can restore from one at all, depends on what your site is built on. This guide explains how backups work, what we do for WordPress sites on our care plan, and what each of the other platforms offers.

What a backup includes

A complete backup of a WordPress site has two parts:

Your files

Everything that makes your site look and work the way it does:

The WordPress core files
Your theme files (your design)
All your uploaded images and documents
Plugin files
Custom code files

Your database

All the content and settings stored behind the scenes:

Every page and post you've written
Your settings and configuration
User accounts
Customer and order data (if you have a store)
Form submissions (if your form plugin saves them)

Both parts are needed to fully restore a WordPress site. A backup that only has one part is not a complete backup.

On Squarespace, Shopify, Webflow and Wix, you don't manage your site's server files or database, so a backup means whatever the platform saves for you or lets you export. On a custom-coded site, the code and the data are usually kept in different places and backed up differently. The next section covers each one.

Backups by platform

A WordPress backup is a copy of your files and your database. For WordPress sites on our care plan, we take one every day, store it off your server, and can restore it: the rest of this page describes how. If you manage your own WordPress site, start with your host's backups: see If you manage your own backups.

Our care-plan backups cover WordPress sites only at this time.

How often we back up

For WordPress sites on our care plan, we take a backup every day. That means the most you can ever lose is one day's worth of changes.

For high-traffic stores or sites that update frequently, more frequent backups may be appropriate. Talk to your project lead if you think you need more frequent backups.

The server is not a backup

If you have your own hosting, a common misconception is that your host's backups are all you need. Many hosts do keep backups or snapshots, but those are not the same as a managed, verified backup. Server snapshots can be affected by the same problem that damaged your site. We store backups separately.

Where backups are stored

For WordPress sites on our care plan, we store backups in an offsite location, meaning a separate system from your hosting server. This is important because:

If your hosting server has a problem (crash, hack, data loss), your backups are unaffected
Backups can't be deleted by the same attack that targeted your site
We can restore your site even if your hosting account is completely inaccessible

That last point depends on having a full copy of your site's files and database outside the platform. Hosted platforms don't work that way: on Wix, it isn't currently possible to back up your site outside Wix, and Squarespace's export can't be imported into another Squarespace site.

How long backups are kept

For WordPress sites on our care plan, we typically keep daily backups for a rolling period of 30 days, and weekly backups for longer. This means if you realize something went wrong two weeks ago, we can still restore from before that point.

If you need a specific older backup for any reason, contact us and we'll check what's available.

What backups protect against

For a WordPress site on our care plan:

Scenario	Can we restore?
A plugin update breaks the site	Yes, restore to before the update
You accidentally delete a page or post	Yes, restore that content from backup
Your site gets hacked or infected with malware	Yes, restore to a clean version from before the infection
You or a team member makes a mistake	Yes, restore the affected content or the whole site
Your hosting provider has a server failure	Yes, restore from offsite backup to a new location
Ransomware encrypts your files	Yes, restore a clean copy without paying

On other platforms, the answer depends on what the platform can restore: see Backups by platform.

What backups do NOT protect against

Backups are powerful, but they have limits:

A restored site will not include any changes made after the backup was taken
Restoring is not instant. It takes time, especially for large sites
If you've had a long-running security problem, older backups may also be affected
Some platforms can't restore at all, and some restore only part of the site: a Wix restore, for example, only covers your pages and design, not content in Wix apps such as Stores and Blog, or your CMS collections

For security incidents, we always check backups carefully before restoring to make sure we're restoring to a clean version. See Restoring your site from a backup for more.

What a good backup strategy looks like

For WordPress and other sites with their own hosting, whether we run your backups or you manage your own site, this is what to check for:

✓

A backup that works

Runs automatically, not just when you remember
Runs every day (or more frequently for high-traffic/e-commerce sites)
Stores the backup off-site, not just on the same server
Keeps at least 30 days of history so you can restore to different points
Includes both your website files and your database
Can be restored with minimal technical knowledge

A backup that lets you down

Only exists on the same server as your site (a server failure takes out both)
Is months old
Only backs up files, not the database (which holds all your content)
Has never been tested
Requires manual triggering and gets forgotten

On Squarespace, Shopify, Webflow and Wix, you can't choose most of this. What you can do is keep your own copy of anything you couldn't easily recreate, and make one before any big change: an exported CSV on Shopify, a manual backup on Webflow, a duplicate site on Wix, and copies of your content and custom code on Squarespace.

If you manage your own backups

If your WordPress site isn't on our care plan, your host's backups are usually where you start. For where to find them, see Flywheel backups, WP Engine backups or Kinsta backups.

Off-site storage means a copy exists somewhere separate from your web server. This protects you against:

Server failures (the whole server going down takes local backups with it)
Ransomware that encrypts the server's files
Hacks that delete or corrupt your backups as well as your site

Good backup storage locations include:

Your hosting provider's separate backup infrastructure, but check, because hosts differ. Flywheel says its nightly backups sit "offsite on a different set of servers than your live site", and WP Engine says its nightly backups are kept "on a separate server from your WordPress install". Kinsta's own documentation says the opposite: "Each backup is stored on the same host machine as your site", and off-site copies are a paid external backups add-on.
A cloud storage service like Amazon S3, Google Cloud Storage, or Dropbox
A dedicated backup plugin that pushes to cloud storage

What your hosting provider likely includes

Most managed WordPress hosting plans include backups. Here is what to look for:

Host	Typical backup frequency	Retention	Storage location
Flywheel	Nightly	30 days, then deleted	Off-site, on different servers
WP Engine	Nightly	Its support docs say 30 days; its plans page says no less than 30 and no longer than 60	Separate server from your install
Kinsta	Daily	14 days on most plans, 20 or 30 days on larger ones	Same host machine as your site; off-site copies are a paid add-on
Shared/cPanel hosting	Varies: check with your host	Varies	Often on-server: verify

These change, so treat the table as a prompt to check rather than a guarantee. Log into your hosting dashboard, find the backup section, and confirm what's actually configured for your site.

Testing your backups

A backup that has never been tested is a backup you can't rely on. First, confirm the backups are running at all. See verifying your backups are working for the monthly check. Then, on WordPress, test a restore once a quarter, which is the cadence we run for WordPress care plan clients:

Run a test restore. Ask us to do a test restore to your staging environment, or trigger one yourself in your hosting control panel.

Verify that the restored site looks and functions correctly.

Note how long the restore took, so you know what to expect in an emergency.

On other platforms, test what you can. On Webflow, you can preview a backup before restoring it. On Squarespace there is no restore to test, and on Shopify there is none unless you use a backup app; check that your own copies and exports open and are complete. On a custom-coded site, ask your developer how they would restore your data, not just the code.

Backups for e-commerce and forms

If your site processes orders or form submissions, consider how frequently critical data is captured:

Orders: An e-commerce site should have backups at least daily, ideally more frequently at peak times. Between backups, any new orders and their data could be lost in a restore. On Shopify, an order export is a record rather than something you can restore: orders can't be imported back through the Shopify admin.
Form submissions: On WordPress, check whether your forms store submissions in the WordPress database (most do). On any platform, check that submissions are also being emailed to you as a secondary record.

Common questions

Do I need to do anything to make backups happen?

If your WordPress site is on our care plan, no. Backups run automatically as part of your care plan. You don't need to remember to trigger them.

If you manage your own site, this is the one thing worth checking yourself: backups fail quietly, and a monthly glance catches it. See verifying your backups are working. Squarespace and Shopify don't keep a backup you can restore your site from (Squarespace does keep deleted pages and blog posts for 30 days), so keeping your own copies is up to you. Our care-plan backups cover WordPress sites only at this time.

Can I download my own backup?

For WordPress sites on our care plan, yes, on request. If you'd like a copy of your backup for your own records, contact us and we'll provide one. On Wix, it isn't currently possible to back up your site outside Wix, though you can export your contacts to a CSV file. On Shopify, you can export your own CSV files and download your theme.

Are backups encrypted?

Yes, for the backups we take of WordPress sites on our care plan. They are stored with encryption to protect your data and your customers' data.

What if I'm not on WordPress?

Each platform's tools differ, and some can't restore at all. See Backups by platform for what Squarespace, Shopify, Webflow, Wix and custom-coded sites offer. Our care-plan backups cover WordPress sites only at this time.

I accidentally deleted something: can you restore it?

On a WordPress site on our care plan, yes. Contact us as soon as possible and let us know what was deleted and roughly when. The sooner you tell us, the easier it is to pinpoint the right backup to restore from.

On other platforms, it depends on what was deleted. Squarespace can restore deleted pages and blog posts for 30 days, but not sections or blocks deleted after you've left the editor. Deleted Shopify products can't be restored, only re-imported from a CSV export. Webflow can restore an earlier version of the whole site. Wix can restore an earlier version of your site's pages and design, but not content in Wix apps such as Stores and Blog, so a deleted product or blog post won't come back from Site History. For CMS collections, Wix says you can use CMS backups to restore earlier versions of your collections, and each item has its own item history. A restore also undoes most changes made since. Contact us either way, and as soon as possible.

My host says they take backups, is that enough?

This applies if you pay a separate host, as most WordPress sites do. It depends on the host. Check: how often? How many days of history? Where are they stored? Can you actually restore from them yourself? Managed WordPress hosts (Flywheel, WP Engine, Kinsta) generally run automatic nightly or daily backups you can restore from the dashboard, but the retention window and whether the copy sits off your server both vary by host and plan. Budget shared hosting may have weaker options. Ask your host specifically.

Should I also use a backup plugin?

On WordPress, a backup plugin (like UpdraftPlus) adds an extra copy in a different location, which is always a good idea. See backup plugins explained. If your host's backups are solid, a plugin backup is belt-and-suspenders protection. If your host's backups are limited, a plugin may be essential. On Shopify, the nearest equivalent is a backup app.

How long does a restore take?

On WordPress, it depends on the size of your site, and hosts do not promise the same thing. Kinsta says a restore "may take a couple of minutes"; WP Engine says its automated restore "can take anywhere from a few minutes to several hours". Hosts also warn the site can be offline while a restore runs: Flywheel says visitors may briefly see a 403 error page. A full restore (a large site, or one being rebuilt rather than rolled back) takes considerably longer; see Restoring your site from a backup for what to expect. Having everything in order means a bad day becomes a manageable inconvenience rather than a crisis.

Do backups protect me from a hack?

They are your recovery option, not your prevention. If your site is hacked, a clean pre-hack backup lets you restore quickly, where your platform has one. But you still need to fix the vulnerability that allowed the hack, or you'll be hacked again. See What to do if your site is hacked.