A website backup strategy is your plan for creating, storing, and restoring copies of your website’s files and database — ensuring that no matter what goes wrong (hacking, server failure, accidental deletion, botched update, or hosting provider failure), you can restore your website to a working state within hours instead of days or weeks. CodeGuard’s 2023 data shows that 60% of small businesses that experience a catastrophic data loss shut down within six months, yet only 35% of small business websites have a reliable backup system in place.
You assume your website is safe because your hosting provider “handles backups.” But have you ever actually tested a restore? Do you know how far back your backups go? Can you confirm they are stored somewhere other than the same server as your website? For most business owners, the answer to all three questions is no. When something goes wrong — and eventually it will — you discover that your “backup” is an untested assumption that may or may not save your business.
This guide covers the complete website backup strategy for small businesses — what to back up, how often, where to store backups, which tools to use, and how to test your restoration process so you know it works before you need it.
Why Do You Need Your Own Backup Strategy?
You need your own backup strategy because relying solely on your hosting provider’s backups is a single point of failure — if the hosting company experiences a data center issue, gets hacked, or has a billing dispute, your backups could disappear along with your website. Multiple businesses lost their websites permanently in the 2021 OVH data center fire that destroyed servers including some backup systems stored in the same facility. Your backups must be independent of your hosting provider.
The scenarios that require a backup are more common than most business owners realize. A 2023 Acronis survey found that 75% of businesses experienced at least one data loss event in the past year. The most common causes: hardware failure (40%), human error like accidental deletion (29%), software corruption from failed updates (15%), and cyberattacks (13%). Each of these is preventable from being a catastrophe — if you have a working backup.
What You Need to Back Up
A complete website backup includes all of these components — missing any one can prevent full restoration:
- Website files: All files on your server — WordPress core files, theme files, plugin files, uploaded media (images, PDFs, videos), and any custom code. This is everything in your web hosting file system, typically accessible via FTP or your hosting file manager
- Database: Your MySQL database contains all your content — blog posts, pages, settings, user accounts, form submissions, and WooCommerce orders if applicable. The database is the brain of your website. Files without the database are useless, and vice versa. Both must be backed up together
- Email: If your hosting provider also handles your email, ensure email data is included in your backup or backed up separately. Losing years of business email correspondence can be as damaging as losing your website
- Configuration files: wp-config.php, .htaccess, and any custom server configuration files. These files control how your website connects to its database and how the server handles requests. Without them, restoration requires manual reconfiguration
- DNS records: Document your domain’s DNS settings (available from your domain registrar). If you need to rebuild your hosting environment from scratch, correct DNS records are essential for pointing your domain to the new server
How Often Should You Back Up Your Website?
You should back up your website daily if you update content, receive form submissions, process orders, or have any dynamic data that changes regularly — which includes virtually every business website. Weekly backups are acceptable only for completely static brochure sites that rarely change. The backup frequency should match your tolerance for data loss: if losing one day of data is acceptable, back up daily. If losing even one hour of orders is unacceptable (e-commerce), back up hourly.
In addition to scheduled backups, always create a manual backup before making significant changes — plugin updates, theme changes, WordPress core updates, or any modification to your site’s code or structure. This “before change” backup ensures you can immediately roll back if the change causes problems, without losing any data created between your last scheduled backup and the change.
Backup Schedule Recommendations
Match your backup frequency to your website’s activity level:
- E-commerce sites (hourly): Every order, customer account, and inventory change needs protection. Losing a day of orders means lost revenue and customer fulfillment failures. Use real-time or hourly backup services like BlogVault or Jetpack Backup
- Active business sites with forms and blog (daily): Contact form submissions, new blog posts, comment moderation, and content updates should be backed up nightly. This covers most small business websites. Schedule backups during low-traffic hours (2-4 AM)
- Brochure sites with rare updates (weekly): If your site only changes when you actively make updates, weekly backups are sufficient. But still create manual backups before any changes. Even static sites need protection against hacking and server failures
- Retention policy: Keep daily backups for 30 days, weekly backups for 3 months, and monthly backups for 1 year. This retention policy ensures you can restore from any point within the past year. Some malware infections sit dormant for weeks before being detected — long retention catches these delayed discoveries
Where Should You Store Website Backups?
You should store backups in at least two locations that are independent of your hosting provider — following the 3-2-1 backup rule: 3 copies of your data, on 2 different storage types, with 1 copy off-site. Storing backups on the same server as your website defeats the purpose entirely — if the server fails, you lose both your site and your backups. Off-site, independent storage is non-negotiable for any business that depends on its website.
Cloud storage services are the most practical off-site backup destination for small businesses — affordable, automatically accessible, and geographically distributed across multiple data centers. The monthly cost is minimal relative to the protection provided: storing a year of daily website backups typically costs $2-$10/month on cloud storage, compared to the $3,000-$10,000+ cost of rebuilding a website from scratch after data loss.
Backup Storage Options and Tools
Implement one of these backup solutions based on your needs and budget:
- UpdraftPlus (WordPress, free + premium from $70/year): The most popular WordPress backup plugin. Schedules automatic backups of files and database, stores to Google Drive, Dropbox, Amazon S3, or other cloud services. The free version handles basic scheduling; premium adds incremental backups and more storage destinations
- BlogVault ($89/year): WordPress-specific backup service with real-time backups, off-site storage on their own servers, one-click restore, and staging environment. Ideal for business-critical sites where downtime means lost revenue. Backups run without impacting site performance
- Jetpack Backup (from $48/year): Automattic’s backup service with real-time backup for every change, 30-day archive, and one-click restore. Integrates natively with WordPress since it is built by the WordPress.com team. Good option for sites already using Jetpack
- Cloud storage destinations: Google Drive (15GB free), Dropbox (2GB free), Amazon S3 (pay per GB, approximately $0.02/GB/month). Configure your backup plugin to send copies to at least one cloud service. Google Drive is the most practical free option for small business websites
- Hosting provider backups (supplement, not primary): Many managed hosts include daily backups — use these as a convenience layer but do not rely on them as your only backup. Professional WordPress maintenance includes independent backup management as a core service
A backup strategy is insurance — you hope you never need it, but when you do, it is the difference between a minor inconvenience and a business-threatening disaster. The businesses that survive data loss incidents are the ones that prepared before the incident happened. If you want help implementing a reliable backup strategy as part of a comprehensive WordPress maintenance plan, schedule a free consultation with Spilt Media.
Frequently Asked Questions
How do I test that my backups actually work?
Test your backup by performing a full restoration to a staging environment or subdomain quarterly. Download your most recent backup, set up a fresh WordPress installation on a test environment, restore the backup, and verify that the site functions correctly — all pages load, forms work, images display, and the database is intact. An untested backup is not a backup — it is an assumption. Testing takes 30-60 minutes and confirms your recovery process works when you need it.
Does my hosting provider’s backup replace the need for my own?
No. Hosting provider backups are a convenience, not a complete strategy. They are stored on infrastructure you do not control, may have limited retention (often just 7-14 days), and may not be guaranteed in the hosting terms of service. Many shared hosting providers explicitly state that backups are provided as a courtesy and are not guaranteed. Your own backup to independent cloud storage ensures you maintain control regardless of what happens with your hosting provider.
How long does it take to restore a website from backup?
A full website restoration from a modern backup plugin takes 10-30 minutes for most small business websites. Larger sites with extensive media libraries or databases may take 1-2 hours. One-click restore features in tools like BlogVault and Jetpack can complete the process in under 10 minutes. The restoration time is negligible compared to the alternative — rebuilding a website from scratch takes weeks and costs thousands of dollars.
What should I do if I discover my website was hacked weeks ago?
This is exactly why long-term backup retention matters. If you discover a hack that occurred weeks ago, you need to restore from a backup created before the compromise — which means you need backups going back at least 30-60 days. Restore from the most recent clean backup, update all software and passwords, install security measures, and scan for any remaining malware. Without historical backups, you may need professional malware removal services ($500-$2,000).
How much storage space do website backups require?
A typical small business WordPress website backup (files + database) is 500MB-3GB depending on the size of your media library. With daily backups retained for 30 days, you need approximately 15-90GB of storage. Google Drive’s free 15GB covers smaller sites; larger sites may need a paid Google One plan ($20/year for 100GB) or Amazon S3 (approximately $1-$2/month for 50-100GB). The cost is trivial — pennies per day for complete data protection.