Most businesses do not think about website backups until something breaks. A plugin update goes wrong. Someone deletes the wrong page. The hosting account has a problem. Or the site gets compromised and nobody is sure what was there before. That is when the question comes: "Can we just restore it?" And the answer depends entirely on whether anyone set up proper backups and tested whether they actually work.
This guide covers what a complete website backup includes, how to automate it, where to store it, how often to run it and how to test that a restore actually works. If you want the full picture of what happens after a website launches, our web design pillar guide covers everything from maintenance to ongoing performance. This article focuses specifically on backups and recovery.
The Straight Answer: A Good Website Backup Needs Four Things
Complete. It includes everything needed to restore the site: files and database, not just one or the other.
Automatic. It does not depend entirely on someone remembering to run it.
Stored separately. It is not only kept on the same server as the website.
Restorable. It has been tested or there is a documented restoration process that works.
A backup is not just a saved copy of your website. It is a recovery plan for getting the business back online.
The Australian Cyber Security Centre at cyber.gov.au recommends regular backups as a way to recover information after it is damaged, lost, stolen or affected by a cyber incident. Their guidance also recommends automatic backups where possible to reduce the risk of relying on someone's memory.
What Does a Website Backup Actually Include?
Website files
Depending on the platform, these include images, videos, themes, plugins, custom code, uploaded documents, configuration files, fonts, scripts and template files. For WordPress, the files live on the server and contain everything that makes the site look and function the way it does.
Website database
For WordPress, the database contains pages, posts, user accounts, comments, menus, settings, plugin settings and depending on the setup, form submissions, WooCommerce orders, customer data and booking records. WordPress confirms that a complete typical backup requires both the database and files. Backing up only one may leave the business without enough information to restore the site fully.
Connected systems may need separate backups
A website backup does not automatically include data stored in a CRM, external booking platform, email marketing system, accounting software, payment gateway or third party membership platform. A website backup protects the website. It does not protect every platform connected to it.
A WordPress export file is not a complete backup
WordPress's built in Export tool can export posts, pages, comments and selected content. But it is not the same as a full copy of the website installation, files, plugins, themes and server configuration.
Method | Best For | Advantages | Limitations |
|---|---|---|---|
Hosting backup | Full account recovery | Works outside WordPress. Often included. | Retention and restore access vary by host. |
WordPress plugin backup | Scheduled site backups | Flexible remote storage. User control. | Relies on correct setup and monitoring. |
Manual backup | Before major changes | Creates a known restore point. | Easy to forget. Inconsistent. |
Managed cloud backup | High value sites, ecommerce | Monitoring, easy restores, real time options. | Ongoing cost. Plan dependent features. |
WordPress export | Content transfer between sites | Simple content export. | Not a complete backup. Missing files and config. |
What Can Cause a Business Website to Need a Backup?
Backups are not only for dramatic cyber incidents. They are often used to recover from ordinary maintenance mistakes.
A failed update. A plugin, theme or WordPress core update can introduce compatibility conflicts, broken layouts, PHP errors or failed forms. WordPress recommends backing up before updates so the previous version can be restored.
Human error. Deleting the wrong page, overwriting content, changing the wrong setting, importing the wrong database or accidentally resetting the site.
Hacking or malware. A clean backup helps recovery, provided it was created before the compromise and the entry point is fixed. For the full security picture, see our guide on how to secure a WordPress website.
Hosting or server failure. Server failure, corrupted storage, suspended hosting or damaged databases.
A redesign or migration goes wrong. Backups are critical before launching a redesigned site, moving hosting, changing platforms or replacing a theme. Our website redesign checklist includes backup steps for every stage of the project.
An integration breaks. Forms stop delivering, checkout stops accepting orders, booking records disappear or membership access changes.
What a Good Website Backup Strategy Looks Like
Use the 3 2 1 principle as a starting point
Cyber.gov.au has referenced the 3 2 1 backup strategy: maintain 3 copies of important data, store them across 2 different storage types or systems and keep 1 copy off site. For a website, that translates to the live website itself, a hosting level or local backup and an independently stored off site backup. This is a useful planning model, not a rigid technical requirement for every simple site.
Keep at least one backup off site
Off site means the backup is stored separately from the live website environment. Possible destinations include dedicated backup cloud services, Google Drive, Dropbox, Amazon S3 or a separate managed platform. The weak setup: website and backup both stored in the same hosting account. The better setup: the host keeps backups and an independent WordPress backup is also sent to separate cloud storage.
Keep more than one point in time
A single backup can be dangerous. What if it was created after malware appeared? What if the website error went unnoticed for two weeks? What if important content had already been deleted? Maintain a retention window with multiple restore points. A common structure is 7 daily backups, 4 weekly backups and 3 monthly backups, adjusted for website value, change frequency and storage capacity.
Monitor whether backups are actually completing
A failed automated backup is still a failed backup. Check success and failure notifications, available storage, the latest backup date, file and database inclusion and backup size anomalies. Automation removes the need to remember every backup, but it does not remove the need to monitor the backup system.
Are Your Hosting Provider's Backups Enough?
Hosting backups can be very useful. They run outside WordPress, may restore the whole hosting account and often include simple restore controls. But you need to understand what is actually included.
Ask the hosting provider:
How frequently is the site backed up?
Are files and databases both included?
How long are backups retained?
Are backups stored on separate infrastructure?
Can I restore the site myself or do I need to contact support?
Is there a restore fee?
What happens if the whole hosting account is deleted?
An independent backup gives the business another recovery path if the hosting account is compromised, the host backup is unavailable, the required restore point has expired or the business moves to another provider. For a comparison of hosting options and what they include, see our Australian WordPress hosting guide.
WordPress Backup Plugins to Consider
Plugin features, pricing and compatibility should be verified before installation. These are practical starting points, not affiliate recommendations.
Plugin | Best For | Backup Type | Off Site Storage | Main Watch Out |
|---|---|---|---|---|
UpdraftPlus | Standard small business sites | Scheduled and manual | Multiple providers (Drive, Dropbox, S3) | Configure and test properly. Free vs paid differs. |
Jetpack VaultPress | Ecommerce and active sites | Daily or real time (plan dependent) | Managed Jetpack cloud | Paid only. Does not auto send to third party storage. |
Solid Backups | Managed business or agency use | Cloud managed | Product dependent | Confirm current product version and features. |
Do not install several backup plugins at once. Multiple plugins can duplicate storage, increase server load, create overlapping schedules and make troubleshooting harder. Choose one primary plugin, then combine it with hosting level or independent infrastructure where appropriate.
How Often Should You Back Up Your Website?
The frequency should match how much data the business can afford to lose. Ask: if the website had to be restored right now, how much recent activity could the business afford to lose?
Website Type | Suggested Starting Frequency | Main Risk if Backup Is Old |
|---|---|---|
Small brochure site | Daily or weekly | Content and configuration loss |
Service business site | Daily | Pages, enquiries and recent updates |
Active content or blog site | Daily or more frequent | Recently published content |
WooCommerce store | Real time or frequent incremental | Orders, customers and inventory |
Booking website | Real time or frequent incremental | Appointments and customer records |
Membership site | Real time or frequent incremental | Accounts, access levels and payments |
How Long Should Website Backups Be Kept?
Frequency and retention are separate decisions. A website can back up daily but only keep one copy, which gives very little historical protection.
A practical retention model might include daily backups for 7 to 14 days, weekly backups for 4 to 8 weeks and monthly backups for 3 to 12 months, plus special pre launch backups retained separately. The exact policy depends on update frequency, data sensitivity, storage cost and how quickly issues are normally detected.
Why You Need to Test Whether the Backup Can Be Restored
A backup may fail because files are incomplete, the database is missing, the archive is corrupted, the cloud connection failed, the backup stopped halfway, credentials have expired or nobody knows how to use it.
The first restoration test should not happen during an emergency.
Test on staging, not on the live website
A safe restoration test involves creating a staging environment, selecting a recent backup, restoring files and database, checking the homepage and key service pages, submitting forms, testing logins, testing checkout or bookings and confirming images, downloads, tracking and integrations.
Record the restoration result
Document the backup date, test date, who completed the test, time taken, problems found, missing information and next scheduled test. This creates an audit trail that proves the recovery process works.
Decide how quickly the website needs to be restored
Ask two plain English questions: How much recent data could we afford to lose? How long could the website remain unavailable? A brochure site may tolerate several hours of downtime. A store running paid campaigns may need much faster recovery. A booking website may not be able to lose the day's appointments.
When You Should Create an Extra Manual Backup
Create a fresh, labelled backup before:
WordPress core updates
Major plugin or theme updates
PHP version changes
Website redesign launch
Hosting migration
Domain migration
Database cleanup
Bulk product imports
Mass URL changes
Installing an unfamiliar plugin
Editing important code
Changing checkout or booking systems
Label each backup clearly: "Before WooCommerce update, 17 July 2026" or "Before hosting migration". If you are planning a migration, our website migration SEO checklist includes backup steps at every critical stage. Use our website launch checklist tool to make sure backups are confirmed before any major cutover.
Who Is Responsible for Backing Up the Website?
Possible owners include the business owner, web agency, developer, hosting provider, IT provider or maintenance provider. The business should be able to answer:
Who checks that backups run?
Who receives failure alerts?
Who can actually restore the website?
Who has access to the off site storage account?
Is restoration included in the maintenance plan?
How quickly can the site be recovered?
What happens if the existing provider disappears?
Does the business itself have access to the backup account?
If nobody can answer these questions clearly, that is the gap to fix first. Factor backup management into your ongoing website maintenance costs. If you are budgeting for a new website project, use our website cost estimator to understand how maintenance and backup fit into the total investment. Backup costs are one of the website expenses businesses often miss until something actually goes wrong.
"The developer probably handles it" is not a backup strategy.
What to Do if the Website Is Already Broken
Step 1: Stop making random changes
Avoid deleting files, installing several repair plugins, overwriting the database or updating everything at once. Random changes can make the problem worse and destroy evidence of what went wrong.
Step 2: Identify what happened
Determine whether the cause was a failed update, human error, malware, hosting failure, database issue, domain or DNS problem, expired licence or integration failure.
Step 3: Choose the correct restore point
The newest backup is not always the best backup. Select one from before the failed update, before the compromise, before the content deletion or before the broken migration.
Step 4: Preserve recent business data
Be careful with WooCommerce orders, bookings, memberships and customer accounts. Restoring the whole database to an older point may overwrite valid recent transactions.
Step 5: Restore and test
After restoration, check forms, phone links, checkout, bookings, logins, tracking, emails and mobile pages. Then fix the original cause so the problem does not recur.
Website Backup Checklist
Setup
Backup system selected and configured
Files and database both included
Automatic schedule enabled
Off site destination connected and tested
Hosting backups confirmed and understood
Retention period documented
Failure alerts enabled
Backup owner assigned
Access and security
Backup account owned by the business (not only a third party)
Strong unique password on backup account
2FA enabled on backup and storage accounts
Access limited to people who need it
Recovery details documented
Ongoing maintenance
Most recent backup date checked regularly
Storage capacity reviewed
Backup failure alerts checked
Backup plugin or service kept updated
Unused old backups removed per retention policy
Manual backup created before every major change
Restoration
Staging restoration completed at least quarterly
Forms tested after restore
Logins tested after restore
Checkout or bookings tested after restore (if applicable)
Restoration time recorded
Emergency contacts documented
Latest restoration test date recorded
For a broader health check beyond just backups, our DIY website audit covers clarity, speed, mobile, CTAs, trust and tracking alongside security and maintenance basics.
Common Website Backup Mistakes
Assuming the host handles everything. Hosting backups are useful, but retention, access and restore speed vary. Understand what is actually included.
Keeping the only backup on the live server. If the server is compromised or fails, the backup goes with it.
Backing up files but not the database. Both are needed for a complete restore. Files alone will not bring back pages, settings or customer data.
Treating a WordPress export as a complete backup. The export tool creates a content file, not a full website backup with plugins, themes and configuration.
Keeping only the latest restore point. If the latest backup contains the problem, there is nothing clean to restore from.
Never testing a restoration. A backup that cannot be restored is just a file taking up storage space.
Backing up too infrequently for the website type. A weekly backup on a daily ecommerce site means up to a week of lost orders.
Restoring an old database over new orders. Full database restores on ecommerce sites can overwrite valid recent transactions. Use the right recovery method.
Losing access when a provider relationship ends. The business should always retain direct access to the backup account.
What We Recommend at Elev8d
Most businesses do not need the most complicated backup system available. They need automatic backups, complete files and database, off site storage, multiple restore points, failure monitoring, a tested restoration process and a named person responsible.
The mistake is not usually choosing the wrong plugin. The mistake is assuming that because a backup feature exists somewhere, the website can definitely be recovered when something goes wrong. If you are weighing whether WordPress is the right platform for your business, our guide on WordPress pros and cons in 2026 covers how maintenance and backup responsibilities factor into the decision. And if you are migrating from another platform, our guides on moving from Wix to WordPress and moving from Squarespace to WordPress both cover backup steps as part of the migration process.
FAQs
What does a complete WordPress backup include?
Both the database (pages, posts, settings, users, orders, form data) and the files (images, themes, plugins, uploads, configuration). Both are needed for a full restore.
How often should I back up my website?
Daily for most active business websites. Real time or multiple times daily for ecommerce, booking or membership sites. Weekly may be adequate for simple brochure sites that rarely change.
Are hosting backups enough?
They are a useful layer, but retention, restore access and storage separation vary by host. An independent off site backup gives the business a second recovery path.
Is a WordPress export file a full backup?
No. The export tool creates a content file with posts and pages. It does not include plugins, themes, configuration or the full database.
How do I test a WordPress backup?
Restore a recent backup to a staging environment. Check the homepage, service pages, forms, logins and checkout. Record the results and the time taken.
Where should website backups be stored?
Away from the live hosting account. Use separate cloud storage, an independent backup service or a combination of host backup and off site storage.
Can I restore a website after it has been hacked?
Usually, if a clean backup exists from before the compromise. But restoring without fixing the original entry point means the site may be compromised again.
Should I back up before updating WordPress?
Yes. Always. WordPress itself recommends backing up before updates so the previous version can be restored if something goes wrong.
Who is responsible for website backups?
It depends on the arrangement, but someone specific must be named. Whether it is the business owner, a developer or a maintenance provider, responsibility needs to be documented, not assumed.
Can restoring a backup delete recent orders?
Yes. Restoring the full database to an older point can overwrite valid recent orders, bookings and customer records. Use a recovery method appropriate for the site type.
Next Steps: Pick Your Path
No backup system in place? Start with a reputable WordPress backup plugin, connect it to off site storage and enable daily automatic backups.
Backups exist but never tested? Restore a recent backup to staging this week. Check forms, pages and logins. Record the result.
Relying only on hosting backups? Add an independent off site backup as a second layer. Confirm what the host actually retains and how long.
Planning an update, redesign or migration? Create a labelled manual backup before starting. Keep it separate from the automated schedule.
Need ongoing maintenance and backup management? Talk to Elev8d about web development Melbourne with proper backup, monitoring and recovery built into the ongoing maintenance plan.
Sources and Further Reading
Australian Cyber Security Centre - Backup Guidance - Foundational backup guidance including the 3 2 1 principle and automatic backups
WordPress - Backing Up Your Database - Official WordPress documentation on database backups
OAIC - Australian Privacy Principles - Privacy requirements relevant to backup data containing personal information
UpdraftPlus Documentation - Scheduled backup and restoration plugin for WordPress
Jetpack VaultPress Backup - Managed cloud backup for WordPress and WooCommerce
General information only. Rules vary by situation, particularly around data handling, privacy, advertising claims and consumer law. If you are unsure about compliance, get professional advice.
