Website backups: what they are and why they matter

What can go wrong?

Backups are only top of mind when something has already gone wrong. Here are the scenarios where having one is the difference between a quick recovery and starting from scratch:

• A plugin update conflicts with your theme or another plugin, breaking the site
• A security breach results in malicious code being injected into your files or database
• A team member accidentally deletes content, pages, or settings
• Your hosting provider experiences a server failure or data loss event
• A WordPress core update causes unexpected compatibility issues

None of these are edge cases. Most website owners will encounter at least one of them at some point. The question is not whether something will go wrong, but whether you are prepared when it does.

What a backup should include

A complete website backup covers two things.

1. Files: everything that makes up your website including themes, plugins, uploaded images, and documents. Without these, your site has no visual design or functionality.
2. Database: the content layer of your site. Every page, post, form submission, product, and configuration setting is stored here. A file backup without a database backup is largely useless in a restore scenario.

Any backup solution worth relying on captures both, together, at the same point in time.

Hosting backups vs plugin-based backups

There are two main approaches to backing up a WordPress website, and they are not equal.

• Plugin-based backups (tools like UpdraftPlus or similar) are installed directly on your website and run from within WordPress. They are a popular option for self-managed sites but come with a practical downside: because they run on the same server as your website, they consume server resources during the backup process. On shared or lower-tier hosting this can cause noticeable slowdowns while the backup runs. More importantly, if the server itself has a problem, those backups may be affected too. It is a bit like keeping your spare house key under your own doormat.
• Hosting-level backups are taken at the server level, independently of your website. They do not run through WordPress at all, so they have no impact on your site’s performance and are not affected by anything going wrong within the site itself. This makes them the more reliable option, and the one we would always recommend as the primary backup method.

Most reputable managed hosting providers include server-level backups as part of their offering. If you are unsure whether your hosting includes this, it is worth checking, or asking your developer or host directly.

How often should backups run?

For most small business websites, daily backups are the right default. This means that in a worst-case scenario, you lose at most one day’s worth of changes rather than weeks or months.

For higher-traffic sites, eCommerce stores, or sites updated very frequently, more frequent backups may be worth considering. If you are on a hosting package with us and are unsure what is included, just ask.

Backups should also be retained for a reasonable period. Thirty days is considered best practice, as it gives you enough window to catch a slow-developing problem such as a malware infection that went unnoticed for a while. What your hosting plan actually includes will vary: some entry-level plans retain backups for 7 days as standard, while many managed and higher-tier plans retain 30 days or more. If backup retention matters to you, check exactly what your current plan includes, or ask your host directly.

Where backups are stored

A backup stored in the same location as your website is significantly less useful than one stored elsewhere. If the server fails, both the live site and the backup could be lost together.

Good backup setups store copies offsite, in a separate data centre or a cloud storage service. This is another area where hosting-level backups typically have an advantage, as the hosting provider manages offsite storage as part of their infrastructure.

If you are managing your own backups via a plugin, make sure those backups are being sent somewhere separate from your web server.

Who is responsible for your backups?

This depends on how your website is hosted and maintained, and it is worth being clear on.

If your website is on managed hosting: whether through Arkay Digital or another managed provider – your host should be taking server-level backups as part of the service. You do not need to configure anything yourself. What you should do is confirm this is in place. Ask your host or maintainer: are daily backups running, where are they stored, and how are restores handled? A reputable managed host will be able to answer this clearly.

If you manage your own hosting: through a general-purpose provider or a platform where backup configuration is your responsibility – you need to take a more active role. Check what your host provides by default, understand where those backups are stored, and ensure you have a method in place for the database as well as the files.

In either case, the one thing every website owner should do is know the answer to: if my website disappeared today, who would I call, and how quickly could it be restored?

Testing that backups actually work

A backup that has never been tested is an assumption, not a safety net. It is entirely possible for a backup process to appear to be running while silently failing: creating corrupted files, missing the database, or storing backups to a location that no longer exists.

For sites on managed hosting, your provider or maintainer should be periodically verifying that backups are healthy and that a restore is achievable. This is something you can reasonably ask about when reviewing your hosting or maintenance arrangement.

If you manage your own hosting and backups, aim to test a restore at least once a year, ideally on a staging or test environment rather than your live site. The restore process itself also takes practice; a data crisis is not the moment to be figuring out how it works for the first time.

A note on eCommerce and data-heavy sites

If your website processes orders, stores customer data, or handles bookings or registrations, the stakes around backups are higher. Data loss in these contexts is not just an inconvenience: it can affect customers directly and may carry implications under GDPR, particularly if transaction or personal data cannot be recovered.

For most small business eCommerce sites, daily backups with a solid retention period will cover the bases. For higher-volume stores where orders are coming in throughout the day, it is worth discussing with your host whether more frequent backup intervals make sense for your specific setup.

Your backup checklist

1. Confirm backups are running – ask your host or maintainer to confirm daily backups are in place and where they are stored
2. Check offsite storage – backups should not live on the same server as your website
3. Know your retention period – check what your hosting plan actually includes; 7 days is common on entry-level plans, 30 days or more on managed and higher-tier plans
4. Know who to call – if something goes wrong, you should know immediately who handles a restore and roughly how long it takes
5. Test periodically – if you manage your own backups, verify a restore works at least once a year
6. Consider your risk level – eCommerce sites and sites with regular user data should review whether daily backups are sufficient for their volume

Need help?

If you are unsure whether your website is being backed up properly, or you would like to discuss what is included in your current hosting or maintenance package, get in touch. We also offer monthly maintenance packages that include regular backups and uptime monitoring as standard.