# Website backups explained: what to back up, how often and how to check they work

> A plain guide to website backups for small businesses: what a proper backup includes, how often to take one, where to store it, the 3-2-1 rule and how to test a restore before you need it.

- Source: https://nerdsharks.com/blog/website-backups-explained
- Publisher: Nerdsharks (Exeter, Devon, UK)
- Updated: 2026-09-26

**Short answer:** A proper website backup copies both the files and the database, runs automatically at least daily for sites that change often, keeps several versions going back weeks, is stored somewhere separate from the website’s own server, and has been restored successfully at least once as a test. A backup you have never restored is a hope, not a plan.

Published 2026-09-26. 8 min read. Category: Website advice.

Nobody thinks about website backups until the day they need one. The site has been hacked, an update has broken everything, someone deleted the wrong page, or the hosting company has gone out of business. At that point there are two kinds of business owner: those who can restore yesterday’s site in an hour, and those who start again from scratch.

This guide explains website backups for small businesses in plain English: what a backup actually contains, how often you need one, where it should live, and how to know it will work. The National Cyber Security Centre lists backing up as the first step in its small business guide for good reason.

## What a website backup should include

Most websites have two parts, and a backup needs both.

- Files: the website’s code, theme, plug-ins, and every image, PDF and video you have uploaded.
- Database: the content itself on most content-managed sites, including pages, blog posts, products, orders, bookings, form entries and user accounts.
- Configuration: settings such as redirects, email forwarding and DNS records, which are easy to forget and painful to recreate. At least keep a written or exported copy.

> A backup of the files without the database, or the database without the images, will not rebuild your site. Check that yours covers both.

## How often to back up

The right frequency depends on how much you would lose between backups. Ask yourself: if the site disappeared right now and came back as it was at the last backup, what would be missing?

**Suggested backup frequency by type of website**

| Type of site | What changes | Suggested frequency | Keep versions for |
|---|---|---|---|
| Brochure site updated occasionally | A few pages or posts a month | Daily automatic, plus before any change | At least 30 days |
| Site with contact forms stored on the site | New enquiries daily | Daily | At least 30 days |
| Booking site | Bookings throughout the day | Several times a day, or real-time database backups | 30 to 90 days |
| Online shop | Orders, stock, customer accounts | Several times a day, or real-time | 30 to 90 days |
| Any site before an update or redesign | Everything about to change | Manual backup immediately before | Until the change is proven stable |

## Where backups should be stored

A backup stored on the same server as the website is better than nothing, but not by much. If the server fails, the hosting account is suspended or an attacker gets in, the backups go with it. Good practice follows the old 3-2-1 rule: three copies of your data, on two different types of storage, with one copy off-site.

For a small business website, that usually means automatic backups to a separate cloud storage service in a different location from the web server, plus the ability to download a copy yourself. Backups should be encrypted if they contain customer data, because a leaked backup is a data breach like any other.

## Why you need several versions, not just the latest

If your site was hacked three weeks ago and nobody noticed, last night’s backup contains the hack. The same goes for a broken plug-in update that quietly corrupted content. That is why a good backup system keeps a history: daily versions for at least a month, ideally with weekly or monthly versions going back further.

This is also your defence against ransomware and malicious deletion. The NCSC advises keeping at least one backup that is not permanently connected to the systems it protects, so an attacker cannot encrypt or delete it too.

## Test the restore, and know the limits

The most common backup failure is discovering, on the worst possible day, that the backups were incomplete, corrupted or impossible to restore. The only way to know is to restore one. That does not have to mean overwriting your live site. A good web provider can restore a backup to a temporary copy of the site and check it works.

Ask when this was last done. If the answer is never, ask for it to be done now and then at least once or twice a year.

A backup is a way back, not a shield. It will not stop a hack, fix the weakness that let an attacker in, or bring back enquiries that arrived and were lost between backups. It also will not help if the only copy sits in an account you cannot access, for example hosting set up in a former developer’s name. That is why backups belong alongside updates, security and clear ownership of your accounts, not instead of them.

## Backups on website builders and managed platforms

If your site is on a hosted builder, such as Wix, Squarespace or Shopify, the platform handles server-level backups, but that protects the platform rather than your content decisions. Some let you restore earlier versions of pages or the whole site; others offer limited history or none for certain content. Check what your plan includes, and export anything you cannot afford to lose, such as product lists and customer data, on a regular basis.

On self-hosted WordPress and similar systems, backups depend entirely on your host and whoever maintains the site. Some cheap hosting includes backups only as a paid extra, or keeps just a few days.

If you look after the site yourself, a reputable backup plug-in or your host’s own tool can send copies to separate cloud storage automatically. Set it up once, check the first backup arrives in the right place with both files and database, and put a reminder in your calendar to test a restore. The setup takes an hour or so; recovering without it can take weeks.

## Questions to ask your web provider

- Are both files and database backed up, and how often?
- Where are the backups stored, and is it a different location from the website?
- How many versions are kept, and for how long?
- Are backups encrypted?
- When was a restore last tested?
- How long would a full restore take, and is it included or charged?
- Can I download a full copy of my site and data if I want to?

## Backup checklist

Every Nerdsharks site is backed up daily as part of the plan, so if something goes wrong there is always a recent copy to go back to. If you are not sure what your current provider does, the questions above will tell you quickly.

- Automatic backups of files and database, at least daily.
- More frequent backups for sites that take bookings or orders.
- Stored off-server, in a separate location, encrypted.
- At least 30 days of versions kept.
- A manual backup before every update, redesign or big change.
- A test restore done within the last six months.
- A copy you can download and hold yourself.

## Questions

### How often should I back up my website?

Most small business websites should be backed up automatically at least once a day, and immediately before any update or change. Sites that take bookings, orders or store form entries may need backups several times a day, because anything added since the last backup could be lost.

### Does my web hosting include backups?

Many web hosting plans include some backups, but they vary widely in frequency, how long they are kept and whether restores cost extra. Some cheap plans keep only a few days on the same server. Check what your plan includes rather than assuming, and ask for a restore test.

### What is the 3-2-1 backup rule?

The 3-2-1 backup rule means keeping three copies of your data, on two different types of storage, with at least one copy stored off-site. For a website, that usually means the live site, an automatic off-site backup and a copy you can download or hold separately.

### Should I keep my own copy of my website?

Yes. Even if your provider backs up your site, keep your own copy of the things that are hardest to recreate: your text, photos, logo files, product lists and customer records. If you ever change provider or lose access, having your own copy makes moving far quicker and cheaper.

### Can I back up a Wix or Squarespace website?

Hosted builders such as Wix and Squarespace look after the servers, but options for backing up or exporting your own site vary and are often limited. You can usually export some content, such as blog posts or product lists. Check your platform’s help pages and keep your own copies of key content.

## Sources

- Small Business Guide: Cyber Security, National Cyber Security Centre, 2026: https://www.ncsc.gov.uk/collection/small-business-guide