Every website needs backups. Almost every website owner believes they have them. The uncomfortable truth: a backup you’ve never restored is a rumor, not a backup.
Here’s what actually matters, in plain terms.
The 3-2-1 rule, adapted for websites
- 3 copies of your data (your production site counts as one)
- 2 different media (e.g., server storage and cloud storage)
- 1 copy off-site (so a hacked host doesn’t take everything down with it)
For a typical business website, that means: daily database and file backups, stored both on the server and in cloud storage you can log into yourself.
Frequency: daily files, and database before any change
- Files (uploads, themes, plugins): daily
- Database: daily, plus a fresh backup immediately before any major update
- Before any change — every update, migration, or plugin install — a point-in-time backup so you can roll back in minutes
The part everyone skips: restoring
Once a month, restore a backup to a staging environment and verify:
- The site opens and images load
- Forms work and the database is current
- Login and admin areas function
If that sounds like effort — it is. That’s why “backup verification” is a line item in proper maintenance plans rather than a checkbox.
How long to keep backups
| Type | Retention |
|---|---|
| Daily backups | 30 days |
| Weekly snapshots | 3 months |
| Monthly snapshots | 12 months |
| Pre-change snapshots | until the next major update |
What backups do NOT protect you from
- A hacked site. If malware is in your files, restoring the infected backup restores the malware. You need clean backups plus cleanup — see how small business sites get hacked.
- Never logging in. Backups that nobody checks age badly — the storage fills up, cron jobs die, and the last working backup is from February.
The test: can you answer these three questions?
- Where is the last backup stored, and who can access it?
- What’s the recovery time if the host vanishes tonight?
- When was the last time a backup was actually restored and verified?
If you can’t answer all three, your backups are a hope, not a plan. Request a free audit and we’ll check your backup setup as part of it.