A good website backup plan copies both files and database, weekly for a small brochure site and daily or more often for online stores, keeps at least 3 copies with 1 stored away from your hosting, and is tested by actually restoring it. Always take a backup before any update.
Key Takeaways
- A complete backup includes the website files and the database; one without the other is not enough.
- Back up weekly for small, rarely changed sites and daily or more for stores and busy sites.
- Follow the 3-2-1 idea: three copies, on two kinds of storage, with one away from your host.
- Take a backup before every update, plugin install or major change.
- Test a restore regularly; an untested backup may not work when you need it.
What Is a Website Backup?
A backup is a copy of everything needed to rebuild your site: the files, such as themes, plugins, images and uploads, and the database, which holds pages, products, orders and settings. If a hack, failed update, server problem or human mistake breaks your site, a recent backup lets you restore it in hours instead of rebuilding for weeks.
Many owners assume their host or developer keeps backups. Sometimes they do, sometimes only on the same server, and sometimes not at all. Check.
How Often Should You Back Up?
WordPress's own backup guidance suggests weekly backups for smaller sites, daily backups for high-activity sites and always backing up before an upgrade. Here is how that translates by site type:
| Site type | Suggested frequency | Why |
|---|---|---|
| Brochure site updated a few times a month | Weekly, plus before every change | Little changes between backups |
| Blog or news site | Daily or after publishing | New content each week |
| Online store | Daily at least; database more often if orders are frequent | Orders and customer data change constantly |
| Booking system or web app | Database several times a day or continuous | Lost bookings or records are hard to recreate |
What Is the 3-2-1 Backup Rule?
The 3-2-1 rule is a widely used rule of thumb: keep at least three copies of your data, on two different kinds of storage, with one copy kept off-site. WordPress's guidance makes a similar point, suggesting at least three to five recent backups stored in different places, such as the host's server, cloud storage and your own computer. For a small business website, a practical version is:
- the live site itself
- automatic backups by your host
- a separate copy in cloud storage you control, such as your own Google Drive or other cloud account
The off-site copy matters most. If the hosting account is hacked, suspended or deleted, backups stored on the same server can be lost with it.
Why Must You Test a Restore?
A backup is only useful if it can be restored. Files can be incomplete, the database can be missing, or the backup plugin may have been failing silently for months. WordPress's guidance recommends occasionally making a manual backup to confirm the automated process works. Better still, every few months restore a backup to a staging copy and check that pages, images, forms and orders all work.
When Else Should You Take a Backup?
- before updating WordPress, themes or plugins
- before installing a new plugin or changing the theme
- before a redesign, migration or hosting move
- before big content imports, such as hundreds of new products
How Long Should You Keep Old Backups?
Keep several recent backups, not just the latest one. Hacks and mistakes are sometimes noticed days or weeks later, and by then the newest backups may contain the problem. A practical pattern for small businesses is daily copies kept for two weeks, weekly copies for two months and monthly copies for a year. Delete older copies that contain customer data you no longer need, in line with your privacy policy.
Who Should Control the Backups?
You should. Store at least one copy in an account in your own name, not only in your developer's account. If you part ways with a developer, you will still have your site. Our guide on who owns your website explains why each account should be yours.
How We Handle Backups
Our maintenance plan at Rs 7,200 a month includes scheduled backups of files and database, an off-site copy in storage you can access, backups before every update and quarterly test restores to staging. Every site we build is handed over with backups configured. See our pricing page, the hacked website guide and the guide to getting your website on Google.
Frequently Asked Questions
How We Researched This Guide
Backup frequency, number of copies, storage locations and manual checks follow WordPress's backup documentation, checked 29 October 2026. The 3-2-1 rule is described as a widely used rule of thumb. The frequency table by site type is our recommendation. The maintenance price is our own.
Sources
- WordPress Developer Resources — WordPress backups
- WordPress Developer Resources — Hardening WordPress
- OWASP — Top 10 web application security risks
- ICANN — Registrants' benefits and responsibilities
- Internet Archive — Wayback Machine
Disclosure: Kamboh Associates sells the web development services discussed here. Other providers' prices are quoted from their own public pages on the dates shown and may have changed. We correct errors as soon as they are reported. First published ; last reviewed .
Keep Reading
Not sure your website is backed up?
Send us a short description of your project and we'll reply within one business day with a written scope, fixed price and timeline.