How Often Should a Small Business Back Up Its Website?

Back up your website at least as often as it changes. For most small business sites that means a full backup every day, with extra backups before updates or major edits. Online shops, booking systems and sites with customer accounts change constantly and may need backups every few hours. Keep copies away from your hosting, and test that you can restore them.

The right schedule comes down to one question: how much work, or how many orders, could you afford to lose?

Start with how much you could afford to lose

Think about the worst moment for your site to fail, just before the next backup runs. Everything since the last backup is gone.

• A brochure site updated once a month loses almost nothing with a daily backup.
• A blog published to several times a week could lose a post or two.
• A shop or booking site could lose a day of orders, bookings and customer accounts, which may be impossible to recreate.

Security professionals call this your recovery point: the most recent moment you could restore to. The more painful it would be to lose a day, the more often you need backups.

A simple backup schedule by type of site

Two extra rules apply to every site:

• Back up before every update to the platform, plugins or code.
• Back up before any big change, such as a redesign, migration or bulk content import.

What a website backup must include

A complete backup has two parts:

• Files: the code, themes, plugins, configuration and uploaded media such as images and documents.
• Database: pages, posts, products, orders, users, settings and form submissions.

WordPress's own security guidance says to back up your data regularly, including your MySQL databases, and to keep a set of regularly timed snapshots in a trusted location. Many failed restores happen because someone backed up the files but not the database, or the reverse.

Also keep a note of things that aren't in the backup but are needed to rebuild: server settings, scheduled tasks, DNS records and where licences and passwords are stored.

Where to store backups: the 3-2-1 rule

The US Cybersecurity and Infrastructure Security Agency (CISA) describes the 3-2-1 rule as a trusted guideline for business backups: 3 copies of important files, on 2 different types of storage, with 1 copy stored off-site.

For a website, that usually means:

1. The live site on your hosting.
2. A backup on the hosting provider's separate backup system.
3. An off-site copy in independent cloud storage that the hosting account can't delete.

The third copy matters most. If the hosting account is hacked, suspended or closed, backups stored only inside it can disappear with it. CISA also recommends protecting backups with physical security, encryption and offline copies.

How long to keep backups

Keep more than just the latest copy. Hacks and data problems are often discovered days or weeks after they start, by which time recent backups are already affected.

A common pattern:

• daily backups kept for 14 to 30 days
• weekly backups kept for a few months
• monthly backups kept for a year

Adjust it to your storage costs and any legal requirements for keeping records in your industry and country.

Test your backups

A backup you have never restored is a hope, not a plan. CISA advises businesses to perform scheduled recovery tests to verify backup integrity and make sure the team can restore data both fully and partially.

For a website:

• Restore a recent backup to a staging site at least quarterly.
• Check pages, images, logins, forms and, for shops, recent orders.
• Time how long it takes, so you know what to expect in a real emergency.
• Write down the steps, so someone other than the original developer could do it.

Automate it

Manual backups get forgotten, usually just before they are needed. Choose a backup method that runs automatically and alerts you if it fails. Good options include your host's automated backups combined with an independent backup tool or service that copies to separate cloud storage.

Who is responsible for your backups?

In many small businesses, nobody is quite sure. The web designer assumes the host does it, the host assumes the owner does it, and the owner assumes it's all handled. Write it down:

• Who sets up and monitors the backups, and who is alerted if one fails?
• Where are they stored, and who has the login?
• Who can restore them, and how quickly can they respond?
• What happens if you change developer or host: do the backups go with you?

If an agency or freelancer manages your site, ask for this in writing and make sure you have independent access to at least one backup copy.

What to do on the day you need a backup

When something goes wrong, stay calm and work in order:

1. Work out when the problem started, so you restore a backup from before it, not after.
2. Keep a copy of the current, broken site before restoring, in case you need it to investigate a hack or recover recent data.
3. Restore to a staging copy first if time allows, and check it.
4. Restore the live site, then change passwords and apply updates if a hack was the cause.
5. Recover anything added since the backup, such as orders or form submissions, from emails or payment provider records.

Common backup mistakes

• Only backing up inside the hosting account, so a hack or suspension removes everything.
• Backing up files but not the database, or the reverse.
• Keeping only one recent copy, which may already contain the problem.
• Never testing a restore.
• Relying on the developer's personal backups without access yourself.
• Not backing up before updates, the most common moment for a site to break.

Frequently asked questions

If you'd like backups that are automatic, stored off-site and regularly test-restored, our cybersecurity and backups service takes care of it, and our managed maintenance plans include backups before every update.