A website backup is a complete copy of your site’s files, database and, ideally, email, saved so you can put everything back if something goes wrong. Without one, a bad update, a hacked plugin or an accidental delete can cost you days of work or the whole site.
Backups are cheap insurance, but only if they are recent, stored safely and actually restorable. This guide explains what to back up, how often, the 3-2-1 rule, and exactly how to restore a site, a single file or a database when you need to.
What a website backup should include
Your website is not one thing. It is several parts that work together, and a useful backup captures all of them.
| Part | What it contains | Why it matters |
|---|---|---|
| Files | Theme, plugins, images, uploads, configuration files such as wp-config.php | Your design, media and code live here |
| Database | Posts, pages, products, orders, users, settings | Most of your content and every customer order |
| Mailboxes and messages on your domain | Business records, quotes and conversations | |
| Settings notes | DNS records, PHP version, cron jobs, API keys | Speeds up rebuilding if you move hosts |
A common mistake is backing up files only. For WordPress, WooCommerce and most modern sites, the database is where the important content lives. A files-only backup restores an empty shell.
How often should you back up your website?
The right frequency depends on how much you could afford to lose. Ask yourself: if the site broke right now, how much recent work or how many orders would I need to redo?
- Brochure sites that rarely change: daily backups are more than enough, plus a manual backup before you edit.
- Blogs and content sites: daily backups, so you never lose more than a day of posts and comments.
- Online stores and membership sites: daily at minimum. If you take many orders per day, add more frequent database backups.
Retention matters too. Keep several days or weeks of backups, not just the latest one. Malware and data problems are sometimes discovered days after they start, and you need a clean copy from before that point.
The 3-2-1 backup rule, explained
The 3-2-1 rule is a simple, widely used standard for protecting important data:
- 3 copies of your data: the live site plus two backups.
- 2 different storage types or systems, so one failure cannot destroy everything.
- 1 copy off-site, away from the server your site runs on.
For a small business website, a practical version looks like this: your live site, your host’s automatic daily backups, and an occasional downloaded copy stored on your computer or in cloud storage such as Google Drive or Dropbox. Download a fresh copy monthly and before any big change.
Automatic host backups vs backup plugins
There are two main ways to back up a website. Many site owners use both.
| Automatic host backups | Backup plugins | |
|---|---|---|
| Setup | None, runs on the server | Install and configure inside your site |
| Works if site is broken or hacked | Yes, restores from outside the site | Often not, if you cannot log in |
| Server load | Handled at server level | Can slow the site while running |
| Includes email | Often, depending on host | No |
| Off-site copy | Depends on host | Can send to your own cloud storage |
Whichever method you use, check where the backups are stored. A backup kept only inside your website folder can be deleted by the same hack or mistake that breaks the site, so copies should live outside the site itself.
Host backups are the stronger foundation because they work even when WordPress itself will not load. A plugin is a useful extra for sending a copy to your own cloud storage. Avoid running several backup plugins at once, as they can slow your site and fill your disk.
How to restore a website backup
Restoring is where backups prove their worth. Read these steps now, so you are not learning them during an emergency.
Restoring the whole site
- Work out when the problem started, then choose a backup from before that time.
- If the site is an online store, note any orders placed since that backup, because a full restore will remove them.
- Restore both files and database from the same date so they match.
- Clear any caching plugin and your browser cache, then test the homepage, a few key pages, forms and checkout.
- If the cause was a hack, change all passwords and update everything before going back to normal.
Restoring a single file or folder
If you deleted an image or broke one theme file, you rarely need a full restore. Browse the backup, pick the file or folder, and restore just that item. This leaves recent content and orders untouched.
Restoring only the database
Restore the database alone when content or settings broke but files are fine, for example after a bad bulk edit or a plugin that changed settings. Remember that everything written to the database since the backup, such as new orders and comments, will be rolled back.
Restoring email
If someone deleted important messages, restore the mailbox or specific folders from a backup made before the deletion. Check how long your host keeps email backups.
Test your website backup before you need it
A backup you have never restored is a hope, not a plan. Corrupted archives, missing databases and incomplete copies are usually discovered at the worst moment.
Every few months:
- Restore a single file to confirm the process works.
- Restore a full copy to a staging site and click through it. Our guide to using a WordPress staging site shows how.
- Open your downloaded off-site copy and check that both the files and the database export are inside.
What to do before updates and big changes
Most broken websites are broken by their owners, usually during an update. Build this short routine into every change:
- Take a fresh backup right before you start, even if a daily one ran last night.
- Test risky changes on staging first, especially major WordPress, theme or WooCommerce updates.
- Update one thing at a time, so you know what caused any problem.
- Check the site straight away: homepage, forms, login and checkout.
- Roll back quickly if something breaks, then investigate on staging.
Backups are one part of a wider plan. Pair them with the steps in our WordPress security checklist to reduce the chance you will ever need them.
How HostRiser protects your site
Every HostRiser plan includes automatic daily backups with one-click self-restore from the control panel at cp.hostriser.com. You can restore a whole site, single files, a database or email yourself, without opening a support ticket. Rise and Summit also include staging sites for testing updates safely. Learn more about what is included on our WordPress hosting page.
Frequently asked questions
How often should I back up my website?
Most small business sites should be backed up at least daily. If your site changes many times a day, such as a busy online store, consider more frequent database backups.
What should a website backup include?
A complete backup includes your website files, your database, and your email if it is hosted with your website. Configuration such as DNS records is also worth keeping a note of.
Are my host’s backups enough on their own?
Host backups are a strong first layer, but following the 3-2-1 rule means also keeping an occasional copy somewhere else, such as a download stored on your own computer or cloud storage.
Do I need a WordPress backup plugin if my host backs up daily?
Not necessarily. Daily host backups cover most needs, but a plugin can be useful for taking an extra off-site copy or scheduling backups to your own cloud storage.
How do I know my backups actually work?
Test a restore. Every few months, restore a single file or a copy of your site to a staging area and check that it loads correctly.
Want backups you can restore in one click? Compare our hosting plans, or let us move your site for free.
Last updated October 12, 2026
