Nobody thinks about website backups until the day they need one. The site has been hacked, an update has broken everything, someone deleted the wrong page, or the hosting company has gone out of business. At that point there are two kinds of business owner: those who can restore yesterday’s site in an hour, and those who start again from scratch.
This guide explains website backups for small businesses in plain English: what a backup actually contains, how often you need one, where it should live, and how to know it will work. The National Cyber Security Centre lists backing up as the first step in its small business guide for good reason.
What a website backup should include
Most websites have two parts, and a backup needs both.
- Files: the website’s code, theme, plug-ins, and every image, PDF and video you have uploaded.
- Database: the content itself on most content-managed sites, including pages, blog posts, products, orders, bookings, form entries and user accounts.
- Configuration: settings such as redirects, email forwarding and DNS records, which are easy to forget and painful to recreate. At least keep a written or exported copy.
How often to back up
The right frequency depends on how much you would lose between backups. Ask yourself: if the site disappeared right now and came back as it was at the last backup, what would be missing?
| Type of site | What changes | Suggested frequency | Keep versions for |
|---|---|---|---|
| Brochure site updated occasionally | A few pages or posts a month | Daily automatic, plus before any change | At least 30 days |
| Site with contact forms stored on the site | New enquiries daily | Daily | At least 30 days |
| Booking site | Bookings throughout the day | Several times a day, or real-time database backups | 30 to 90 days |
| Online shop | Orders, stock, customer accounts | Several times a day, or real-time | 30 to 90 days |
| Any site before an update or redesign | Everything about to change | Manual backup immediately before | Until the change is proven stable |
Where backups should be stored
A backup stored on the same server as the website is better than nothing, but not by much. If the server fails, the hosting account is suspended or an attacker gets in, the backups go with it. Good practice follows the old 3-2-1 rule: three copies of your data, on two different types of storage, with one copy off-site.
For a small business website, that usually means automatic backups to a separate cloud storage service in a different location from the web server, plus the ability to download a copy yourself. Backups should be encrypted if they contain customer data, because a leaked backup is a data breach like any other.
Why you need several versions, not just the latest
If your site was hacked three weeks ago and nobody noticed, last night’s backup contains the hack. The same goes for a broken plug-in update that quietly corrupted content. That is why a good backup system keeps a history: daily versions for at least a month, ideally with weekly or monthly versions going back further.
This is also your defence against ransomware and malicious deletion. The NCSC advises keeping at least one backup that is not permanently connected to the systems it protects, so an attacker cannot encrypt or delete it too.
Test the restore, and know the limits
The most common backup failure is discovering, on the worst possible day, that the backups were incomplete, corrupted or impossible to restore. The only way to know is to restore one. That does not have to mean overwriting your live site. A good web provider can restore a backup to a temporary copy of the site and check it works.
Ask when this was last done. If the answer is never, ask for it to be done now and then at least once or twice a year.
A backup is a way back, not a shield. It will not stop a hack, fix the weakness that let an attacker in, or bring back enquiries that arrived and were lost between backups. It also will not help if the only copy sits in an account you cannot access, for example hosting set up in a former developer’s name. That is why backups belong alongside updates, security and clear ownership of your accounts, not instead of them.
Backups on website builders and managed platforms
If your site is on a hosted builder, such as Wix, Squarespace or Shopify, the platform handles server-level backups, but that protects the platform rather than your content decisions. Some let you restore earlier versions of pages or the whole site; others offer limited history or none for certain content. Check what your plan includes, and export anything you cannot afford to lose, such as product lists and customer data, on a regular basis.
On self-hosted WordPress and similar systems, backups depend entirely on your host and whoever maintains the site. Some cheap hosting includes backups only as a paid extra, or keeps just a few days.
If you look after the site yourself, a reputable backup plug-in or your host’s own tool can send copies to separate cloud storage automatically. Set it up once, check the first backup arrives in the right place with both files and database, and put a reminder in your calendar to test a restore. The setup takes an hour or so; recovering without it can take weeks.
Questions to ask your web provider
- Are both files and database backed up, and how often?
- Where are the backups stored, and is it a different location from the website?
- How many versions are kept, and for how long?
- Are backups encrypted?
- When was a restore last tested?
- How long would a full restore take, and is it included or charged?
- Can I download a full copy of my site and data if I want to?
Backup checklist
Every Nerdsharks site is backed up daily as part of the plan, so if something goes wrong there is always a recent copy to go back to. If you are not sure what your current provider does, the questions above will tell you quickly.
- Automatic backups of files and database, at least daily.
- More frequent backups for sites that take bookings or orders.
- Stored off-server, in a separate location, encrypted.
- At least 30 days of versions kept.
- A manual backup before every update, redesign or big change.
- A test restore done within the last six months.
- A copy you can download and hold yourself.