Websites break for ordinary reasons: a plugin update goes wrong, someone deletes the wrong folder, or malware gets in through an outdated component. The businesses that recover quickly are the ones with a backup plan they have actually tested.
What needs backing up
- Website files – code, themes, plugins and uploaded images
- Databases – your content, orders, users and settings
- Email – if your mailboxes are on the same hosting account
- Configuration – DNS records, SSL details and important settings
The 3-2-1 rule
Keep 3 copies of your data, on 2 different types of storage, with 1 copy off-site. For a website that usually means the live site, a backup on the hosting server and another copy stored somewhere else entirely.
How often to back up
Match frequency to how often the site changes:
| Site type | Suggested frequency |
|---|---|
| Brochure site that rarely changes | Weekly, plus before every update |
| Blog publishing several times a week | Daily |
| Online store taking orders | Daily or more often, including the database |
Automate it
Manual backups get forgotten. Use automated tools that run on a schedule, keep several versions, and store copies away from the server. Services such as CodeGuard for websites or Acronis for wider infrastructure are designed for this.
Test your restores
A backup is only useful if you can restore it. Every few months:
- Restore a recent backup to a staging location
- Check that pages, images and forms work
- Note how long it took and any missing pieces
- Update your plan based on what you learn
Combine backups with prevention
Backups are your safety net. Keep software updated, use strong passwords, run your site on HTTPS and scan for malware to reduce how often you need them.
When something goes wrong
- Stay calm and stop changes – do not keep editing a broken or compromised site.
- Identify the last good backup – choose a point before the problem started.
- Restore to staging first if possible, and confirm the site works.
- Fix the cause – update the plugin, change passwords or remove the malicious code.
- Restore to production and keep a note of what happened for next time.
Having these steps written down in advance means anyone on the team can follow them under pressure.
Frequently asked questions
Are my hosting provider's backups enough?
They help, but keep at least one copy that you control and that is stored off the hosting server. That protects you if the account itself is compromised.