Most business owners only think about website backups after something goes wrong. A plugin update breaks the site, a hosting account is closed or someone deletes the wrong page. By then it is too late to start. A working backup turns a disaster into an inconvenience.
This article explains what a website backup should include and where to keep it. It also covers the step many people skip, which is checking that the backup actually restores. The advice draws on guidance from Australian and New Zealand government cyber security agencies.
What a website backup actually is
The Australian Cyber Security Centre describes a backup as a digital copy of your most important information. For a website, that information usually sits in two main places. The files hold your theme, plugins, images and uploaded documents. The database holds your pages, posts, settings, users and often form entries or orders.
A useful backup needs both parts from the same moment. If the files come from Monday and the database from Friday, the restored site may not work. The Australian Signals Directorate’s Essential Eight guidance on regular backups makes a similar point, saying backups should be synchronised so systems can be restored to a common point in time. Settings matter too, because that guidance covers data, applications and settings together.
Why hosting backups are not the whole answer
Many hosting plans include automatic backups, and they are worth having. But they usually live with the same provider as the website itself. If the account is suspended, hacked or closed, those copies may go with it. It makes sense to keep at least one copy somewhere you control.
Before relying on your host, ask a few plain questions. How often are backups taken, and how long are they kept? Can you download a copy yourself, or only ask support to restore one? If some of the wording in your plan is unclear, these web hosting terms explained in plain English are a good starting point.
How often to back up
There is no single right schedule. New Zealand’s National Cyber Security Centre, which now includes CERT NZ, suggests basing backup frequency on how much data you could afford to recreate. The Australian Cyber Security Centre’s small business guidance similarly ties frequency to how many days of work you could afford to lose. A brochure site that changes once a month needs far less than an online shop taking orders every hour.
The Australian Cyber Security Centre recommends backing up regularly and setting up automatic backups for peace of mind. Automatic schedules can usually be set in a backup plugin or hosting panel. Even so, someone should check now and then that they are still running. The New Zealand guidance recommends sending alerts about failed backups to the people responsible for them.
Where to keep your copies
New Zealand’s cyber security guidance recommends what it calls a 3 2 1 1 approach. That means three copies of your data, on two different formats, with one stored off site and one stored offline. An offline copy matters because malware on a connected device cannot reach it. For a small business website, this could be the live site plus a hosting backup. Add a copy in separate cloud storage and an occasional download kept on a drive that is unplugged.
The Australian Cyber Security Centre’s guidance for small businesses suggests disconnecting the backup device after use and keeping it somewhere secure, such as a safe. It also suggests considering disk encryption for backup storage. That matters because a website backup often contains customer names, contact details and order history. Treat it with the same care as the live site.
Protecting backups from being changed or deleted
Attackers and simple mistakes can both wipe out backups. The Essential Eight guidance says unprivileged accounts should be prevented from modifying and deleting backups. It also says they should not be able to access backups that belong to other accounts. For a small business, that means only one or two trusted people should control the backup settings.
Use a strong password and multifactor authentication on the accounts that hold your backups. The Australian Cyber Security Centre recommends connecting backup software with administrator credentials protected by multifactor authentication. If a staff member or contractor leaves, remove their access to the hosting panel and the backup storage. Old logins left open are an easy way in.
Testing that a backup restores
A backup you have never restored is really just a hope. The New Zealand guidance recommends restoring a single file often and a full system restoration every couple of months. The Australian Cyber Security Centre says restore tests should cover the whole backup, because some problems only show up in a full test. The Essential Eight guidance also calls for testing the restoration of data, applications and settings.
For a website, the safest way to test is on a staging copy or a spare domain, not the live site. Restore the files and database there, then click through the key pages. Check that images load, forms send and any shop checkout still works. Write down how long the whole process took, because that tells you how long your site could be down in a real emergency.
What to include beyond the website itself
Some important business data lives outside the website files. Email newsletter lists are a good example, especially if they sit inside another company’s platform. If you have worked hard on growing your subscriber list, export a copy regularly and store it with your other backups. Keep a record of your domain registrar, hosting login and DNS settings in a secure place too.
Large media files need a plan of their own. Original video files are often too big for normal website backups, so they are often stored elsewhere. If you edit your own clips with open source tools for video production, keep the source files on a separate drive or cloud folder. That way a website failure does not take your raw footage with it.
Backups on a WordPress site
On a WordPress site, a lot can be managed without a developer. That includes backups, which plugins and hosting tools can run on a schedule. If you are weighing up the benefits of a WordPress website for your small business, factor in who will look after updates and backups each month. Updates and backups go hand in hand, so take a fresh backup before every major update.
Frequently asked questions
How often should I back up my business website?
Base it on how much work you could afford to lose. A site that rarely changes may only need weekly or monthly copies. A shop or booking site that changes daily needs daily backups or more.
Are my web host’s backups enough?
They are a useful layer but should not be your only copy. If the hosting account is lost or compromised, those backups may be affected too. Keep at least one copy somewhere separate that you control.
How do I know a backup works?
The only way to know is to restore it. Do a small restore often and a full test restore on a staging site every few months. Check pages, images, forms and checkout after each test.
Should backups be encrypted?
Australian government guidance suggests considering disk encryption for backup storage. Website backups often hold customer details, so encryption adds a sensible layer of protection. Keep the encryption key or password somewhere safe and separate.