How to Back Up a Website and What a Good Backup Includes

Websites break in ordinary ways. An update goes wrong. A plugin conflicts with another. Someone deletes a page by mistake. A hosting account is compromised, suspended or simply closed. When it happens, a good backup turns a crisis into an inconvenience.

The trouble is that many site owners have backups they have never examined. Here is what a complete website backup includes and how to set up a routine you can trust.

What a complete website backup includes

Most websites are made of several parts, and a backup needs all of them.

• Site files. For self-hosted sites, this includes the content management system, themes, plugins or extensions, custom code and uploaded media such as images and documents.
• The database. This is where most dynamic content lives: pages and posts, settings, user accounts, form submissions, comments, and for online stores, products and orders. A file backup without the database is often useless.
• Configuration. Settings files that connect the site to its database and services. These often contain passwords and keys, so they need careful handling.
• Records you keep outside the site. Your domain registrar, DNS records, email settings and any connected services. These are not in the site backup, so write them down or export them separately.

If your site is on a hosted website builder, you may not have direct access to files and databases. In that case, learn what the platform's export and version history features include and keep regular exports of your content, media and customer data.

How often to back up

Match frequency to how often your site changes and how much you could stand to lose:

• Brochure sites that rarely change: weekly backups and an extra one before any update or redesign.
• Blogs and active content sites: daily backups.
• Online stores, membership sites and anything taking orders or registrations: daily at minimum, and more often for the database if orders arrive constantly.

Always take a fresh backup before installing updates, changing themes or making significant edits.

Where to store website backups

Hosting companies often include backups, and they are useful for quick restores. But relying on them alone is risky. If the hosting account itself is lost, compromised or canceled, those backups may go with it.

Keep at least one copy somewhere independent of your host:

• A cloud storage or backup account you control, separate from your hosting login.
• A downloaded copy on your own computer or drive, refreshed regularly.

This follows the 3-2-1 backup rule: multiple copies, different storage, one offsite.

Handle backups as sensitive data

A website backup can contain everything an attacker would want: user accounts, customer details, form submissions and passwords to connected services.

• Never leave backup files in a publicly reachable web folder. A forgotten archive file sitting on the server can sometimes be downloaded by anyone who guesses its name.
• Encrypt backups stored offsite and protect the storage account with two-factor authentication.
• Delete old backups you no longer need, following your retention plan.
• Limit who can access backups, just as you limit who can administer the site.

Test the restore

A backup that cannot be restored is not a backup. At least once or twice a year, restore your site to a test location, sometimes called a staging site, and confirm:

• Pages load and look correct.
• Images and downloads work.
• Logins, forms and checkout function.
• Recent content is present, showing the backup is current.

Our guide to testing a backup restore explains how to turn this into a simple routine.

A practical backup routine for site owners

1. Confirm what your host backs up, how often and for how long.
2. Set up automatic backups of files and database to a separate location you control.
3. Take a manual backup before every update or significant change.
4. Check weekly that backups are completing.
5. Restore to a test location at least twice a year.
6. Keep an up-to-date record of your domain, DNS and email settings.

Backups fit into a broader maintenance rhythm. If you want help, contact us and tell us about your site.

Frequently asked questions

Is my hosting company's backup enough?

It is a helpful first layer, but keep at least one copy elsewhere. If the hosting account is lost, compromised or closed, host-stored backups may be unavailable when you need them.

What is the difference between a file backup and a database backup?

Files include your site's software, design and uploaded media. The database holds content, settings, users and orders. Most sites need both to restore fully.

How long should I keep website backups?

Keep enough history to recover from problems you might discover late, such as a hidden infection or an accidental deletion. Many sites keep several weeks of daily backups plus monthly copies for longer.