A website backup is the one safety net most site owners never test until it’s too late. A bad plugin update, a hacked login, a hosting outage, or a botched migration can wipe out years of content, orders, and rankings in minutes — and if your only copy lives on the same server that just failed, there’s nothing left to restore.
Table of Contents
This guide walks through exactly what to back up, how often, where to store copies so they survive a server-level disaster, and which tools actually make this easy, whether you’re running WordPress, a custom-coded site, or an online store.
Quick Answer
Back up your full website — files and database — on an automated schedule, store at least one copy off-site (not on your hosting server), and keep multiple recent versions so you can roll back to a point before something went wrong. For most CMS-based sites, a backup plugin or your host’s built-in backup tool set to run daily (or after every change, for stores) is enough.
What to Back Up — and How Often
Every website backup needs two parts: the files (themes, plugins, media uploads, custom code) and the database (posts, pages, products, orders, user accounts, settings). Backing up only one of these is a common mistake — a files-only backup won’t restore your content, and a database-only backup won’t restore your design or uploaded images.
Backup frequency should match how often your site changes. A blog or brochure site that’s updated a few times a week is usually fine with daily backups. An online store or membership site taking orders and sign-ups around the clock needs much more frequent database backups — often hourly or in real time — since losing even a few hours of transactions is expensive. Most backup tools let you set separate schedules for files versus the database, so you can back up the database more often without re-copying large media files every time.
Keep more than one restore point. If your most recent backup was taken after malware was already injected, restoring it just brings the malware back. A rolling history of several days to a few weeks of backups gives you a clean version to fall back to.
Where to Store Backups (Don’t Rely on Your Host Alone)
The single biggest backup mistake is storing the only copy on the same server as the live site. If that server is hacked, hit with ransomware, or simply has a hardware failure, your backup goes down with it. Follow the classic 3-2-1 approach: keep at least three copies of your data, on two different types of storage, with at least one copy off-site — for example, one copy on your host, one in cloud storage like Google Drive, Dropbox, or Amazon S3, and one downloaded locally.
For WordPress specifically, plugins such as UpdraftPlus, Duplicator, and Jetpack Backup (formerly VaultPress) automate this by running scheduled backups and pushing copies straight to cloud storage or a remote server. Many managed WordPress and other hosts also include automatic daily backups as part of their plan — check your hosting dashboard, since this can save you from needing a plugin at all. For non-CMS or custom sites, a server-level backup tool (like a cPanel backup, a database dump via mysqldump or pg_dump, plus a file archive of your codebase) covers the same ground, or you can rely on version control (like Git) for code combined with a separate database backup routine, since Git alone doesn’t protect uploaded media or database content.
Whatever tool you use, test the restore process at least occasionally. A backup you’ve never restored is a guess, not a safety net — try restoring to a staging site or local environment so you know the process works before you need it in a real emergency.
Tips and Common Mistakes
Automate it. Manual backups get forgotten the moment things get busy — set a schedule and let a plugin or your host handle it.
Back up before every major change. Before a theme switch, plugin update, or migration, trigger a manual backup even if your automated schedule already ran recently.
Encrypt or restrict access to backup files, especially if they include customer data — a backup archive is a full copy of your site, including anything sensitive in the database.
Watch storage limits. Old backups pile up fast; most tools let you set a retention limit so older copies are automatically deleted once you have enough recent restore points.
Don’t assume your host’s backups are enough without checking the details — confirm how often they run, how long copies are kept, and whether restoring is self-service or requires a support ticket.
Explore more: More web development guides.
website backups FAQs
How often should I back up my website?
Daily is a good default for most content sites. E-commerce or membership sites that take orders or sign-ups continuously should back up the database more frequently — hourly or in real time — since losing recent transactions is costly.
Is my web host’s backup enough on its own?
It can be, but check the specifics first: how often it runs, how many versions are kept, and how easy restoring actually is. Many site owners add a second, off-site backup (cloud storage or a plugin) so they’re not solely dependent on the host in a worst-case scenario.
What’s the difference between backing up files and the database?
Files include your theme, plugins, and uploaded media; the database holds your actual content, pages, products, and settings. You need both — restoring only one leaves your site broken or empty.
Can I use Git as my only website backup?
Git is great for versioning code, but it doesn’t capture your database or uploaded media by default, so it shouldn’t be your only backup method for a dynamic site. Pair it with a scheduled database backup.
How do I know my backups actually work?
Restore one. Periodically restore a recent backup to a staging site or local environment to confirm the files and database come back intact — an untested backup might be corrupted or incomplete without you knowing.
Build It With GTStudios
Need help with your website, app, or small-business tech? GTStudios builds web, apps, and software for small businesses. See how GTStudios can help.
Photo: John from USA / CC BY 2.0, via Wikimedia Commons.