Backing up your website: how often and where to store it

Your website is gone. Hacked, overwritten, the server is broken, or you broke something yourself. It can happen to anyone, and it happens fast. Then you want to get back to how it was, quickly. That only works if you have a good backup. But many business owners don't make backups properly, or don't make them at all. They wait until it's too late.

A website backup is more than saving one file in a folder somewhere. You need your files, but also your database. You need to update them regularly. And most important: you must store your backup somewhere other than on your server. If that server fails, a backup on the same server won't help you.

We'll show you how to make a reliable backup, how often to do it, where to store it, and how to test it before you need it.

What a complete website backup contains

A website has two parts: files and a database. Many people forget this. They think they have everything once they've downloaded the files.

The files are what you see: HTML, CSS, JavaScript, images, WordPress plugins and themes. That is about 30 to 50 percent of what you need. The database holds all your content: articles, pages, settings, users, comments, shop data. In WordPress, this is stored in a MySQL or MariaDB database.

So a complete backup contains:

• All files and folders (the full wwwroot or public_html folder)
• The full database (usually exported as an SQL file)
• Optionally, your email configuration and DNS settings

If you only have files and no database, you can't restore your site. You have two puzzle pieces that don't fit without each other.

How to make a backup

There are three ways:

1. Automatic backups through your hosting

This is the easiest way. If you use a good hosting company, they make an automatic backup of your site every day. You don't have to do it yourself. At Netslim, we back up everything daily: files and database. We store these backups on separate backup servers, not in the same place where your site runs. They are safe there.

Always check what your hosting provider does for you. Many cheap hosts don't make backups at all. Ask before you depend on them.

2. Manual backups through your control panel

Most hosting providers give you access to a control panel (at Netslim, Plesk) where you can make backups yourself. You do this with a button in the panel. You can then choose what to back up: files, database, or everything. Keep the downloaded file on your own computer or in the cloud (Dropbox, Google Drive, OneDrive).

This helps most when you are about to make big changes, just before you update a plugin, or before you redesign your site.

3. Backup plugins ( only)

With plugins like BackWPup or UpdraftPlus, you make backups straight from WordPress. These plugins can even send them to your Google Drive or Dropbox. This works, but it is slower than using your hosting provider, because the backup runs through your website. On large sites this can cause problems.

Use this only as an addition, not as your only backup.

How often should you make a backup

That depends on how often you change your site.

• If you add content daily (news site, blog, webshop): daily. Daily automatic backups are then essential.
• If you change things weekly (office, services): weekly, preferably automatic. Also make a manual backup before you make big changes.
• If you rarely change things (static business site): monthly is enough. But do make an extra backup when you are about to update or change your site.

The right measure is: how much work would you lose if you had to restore your site today? This loss is described by the RTO (Recovery Time Objective) and RPO (Recovery Point Objective). For most businesses, anything from more than a day ago is something they could still miss, but they want everything from today back. So daily is the safest.

Automatic backups are better than manual ones, because you don't forget them. And you don't have to think about whether you need to do one or not.

Why a backup on the same server is not enough

Many cheap hosting companies do make backups, but they store them on the same server where your site runs. If that server crashes, gets hacked or goes down, both your site and your backups are gone.

This can happen:

• The server gets infected with malware. All files, including the backups on that server, are encrypted or deleted.
• The hardware fails. A hard drive breaks and all data is gone.
• A hack where an attacker deletes everything: site and backups.
• A human error at your host: someone accidentally deletes the wrong folder.

Backups must be on a different system, in a different data center, or with a different company. This is called “offsite” backup.

A good backup strategy works like this:

• Automatic daily backups, stored on separate backup servers in the same data center (fast recovery)
• At least one backup that is sent every week or month to a completely different data center (protection against catastrophic server problems)
• Optional: an extra manual backup that you keep yourself on your computer or in your own cloud drive

Test a backup before you need it

The worst surprise is when you think you have a backup, but it is damaged, incomplete or can't be restored. Test this before things really go wrong.

Here's how:

• Download a backup to your computer
• Unzip the file and check that all folders and files are in it
• Check that the database export (SQL file) is not empty or damaged
• If you can and dare: try to restore it on a test server. Then you know for sure that it works.

You don't need to do this every week, but at least twice a year is useful. And certainly if you are about to do something big with your site.

Where is the best place to store backups

This depends on your risk and how quickly you need to be back online.

• Standard: Automatic backups on separate servers of your hosting provider. This is fast and normally included.
• Extra security: An automatic weekly backup to another data center or cloud service (Amazon S3, Google Cloud Storage, Microsoft Azure).
• Local backup: A manual download to your own computer or NAS (Network Attached Storage) once a month. This helps against ransomware on the server.

For most small businesses and websites, this is enough: automatic daily backups from your hosting, plus downloading one yourself once a month as an extra precaution.

Backups and restoring: what it costs

This varies, but many hosting companies do not charge for making backups. Downloading your own backup is free. Restoring a backup can be free, or your host charges a small fee if you ask them to do something complicated.

Note: if your site has been hacked, you do not want to simply restore an old backup. The virus is still in it. You first have to clean up the infection, and only then restore. This is more complicated and can cost money. A good host will help with this, but it is material for a separate article.

What to do now

Check today whether your host makes automatic backups. Log in to your control panel and look for a backup option. Ask your hosting provider whether backups are included, how often they are made, and on which servers they are stored.

If you don't have automatic backups, make one today. Download it to your computer and check that all files are in it.

With Netslim web hosting we make automatic backups of your site every day: files and database. We store them on separate backup servers, not in the same place where your site runs. You can restore them yourself via your control panel. That gives you peace of mind.

Frequently asked questions

Can I restore my website if I don't have a backup?

Sometimes, but it is more complicated and more expensive. If your hosting provider keeps backups (even if you didn't make one yourself), they can often help. But if your server fails completely or gets hacked, there is little left to do. You lose your site. That is why making a backup is essential, before you need it.

How long should I keep backups?

That depends on what you need. For emergencies, keep at least one backup that is a few days old, and one that is a month old. For large sites, keep daily backups for at least three months in a row. You can usually delete older backups, unless regulations require you to archive everything.

Is a backup in the cloud safe?

Yes, usually safer than on your own server. Cloud providers like Google Drive, Dropbox and Microsoft Azure have better security and redundancy than most small hosting companies. Make sure your login details are strong and that you turn on two-factor authentication on your cloud account.

What backup frequency do I need for a web shop?

For a web shop, daily is the minimum. Otherwise you lose orders, customer data and payments. Even better is to make backups several times a day, especially if you have a lot of traffic peaks. Many e-commerce hosts offer that as standard.

Can I restore a backup myself, or does it have to go through my host?

That depends on your knowledge and what you have. With WordPress, you can restore some backups through plugins. For the database and all files together, it is better to leave it to your host. One mistake and your site stops working.