Ask a business owner whether their website is backed up and the usual answer is “I think so”. Ask when a backup was last restored and there is a pause. Website backups are one of those things nobody thinks about until the day the site is hacked, a bad update breaks it or someone deletes the wrong page. On that day they are the only thing that matters.
You don’t need to be technical to make sure yours are in order. You need to know what to ask.
What a website backup is
A backup is a complete copy of your website taken at a point in time, kept so the site can be put back the way it was. For a typical WordPress site that means two things:
- The files. The software, the theme, the plugins and everything you have uploaded, such as images and documents.
- The database. Your pages, posts, settings, form entries, customer accounts and orders.
Both are needed. Files without the database give you a website with no content. A database without the files gives you content with nowhere to live.
What can go wrong
- An update to a plugin or theme breaks the layout or a key feature.
- The site is hacked and malicious code is added.
- Someone deletes or overwrites content by mistake.
- The hosting company has a hardware failure.
- A hosting account lapses because a card expired, and the site is removed.
None of these is rare, which is why website backups matter. With a recent, working backup each is an inconvenience. Without one, each can mean rebuilding from scratch.
How often website backups should run
The right frequency depends on how often your site changes. The question to ask is: how much could I afford to lose?
- A brochure site that changes a few times a month is usually fine with a daily or weekly backup.
- A site with a busy blog, forms or bookings should be backed up at least daily.
- An online shop needs more. Losing a day of orders and customer records is serious, so hourly or continuous backups of the database are worth paying for.
It is also sensible to take an extra backup immediately before any update or significant change.
Where the copies should be kept
This is where many set ups fall down. A backup stored on the same server as the website is lost when the server is lost, and can be damaged in the same attack. At least one copy should be kept somewhere separate, such as a different cloud storage service.
A common rule of thumb in IT is to keep three copies of anything important, on two different kinds of storage, with one of them off site. For a small business website the practical version is simple: your host’s backups plus an independent copy elsewhere.
How long to keep them
Problems aren’t always spotted straight away. If malicious code was added three weeks ago and you only keep seven days of backups, every copy you have is infected. Keeping daily backups for a month, and a monthly copy for longer, gives you room to go back far enough.
A backup you have never restored is a hope, not a plan.
Test a restore
Website backups fail quietly. Storage fills up, a plugin stops running, a password changes, and nobody notices because nothing looks wrong. The only real proof is a restore.
Once or twice a year, ask whoever looks after your site to restore the latest backup to a private test copy of the site, not over the live one, and confirm that pages load, images appear and forms work. Ask how long it took. That figure tells you how long you would be offline in a real emergency.
Don’t forget what isn’t on the website
A website backup usually doesn’t include your domain name registration, your email mailboxes or data held in other services such as a booking platform or email marketing tool. Check each has its own protection, and make sure you know who holds the logins.
Questions to ask your host or agency
- Are both the files and the database backed up?
- How often, and at what time?
- Where are the copies stored, and is at least one off the server?
- How many days of backups are kept?
- When was a restore last tested?
- How long would a full restore take, and is there a charge?
- Can I download a copy myself?
Clear answers to all seven mean you are in good shape. Vague answers to any of them are worth following up now, while nothing is wrong.
A note on personal data
Backups contain whatever your site contains, including customer details. They need to be stored securely and not kept for longer than you can justify. If your site handles a lot of personal data, take proper advice on your obligations under UK data protection law.
How we handle it
Regular backups are included in our website maintenance and support plans. If your site has already been compromised, website and system security is where we start.
