A website backup is only useful if it is recent, complete, separate from the live site, and restorable. This practical website backup strategy helps small businesses decide what to back up, how often to run each backup, how to estimate storage and retention needs, and how to perform a restore drill before an outage, failed update, or security incident makes recovery urgent.
Overview
For a small business, the website may support lead generation, bookings, ecommerce, customer support, or basic credibility. Losing it can create more than a technical inconvenience: forms may stop working, product information may disappear, and staff may need to rebuild content from memory. A sensible backup plan reduces that risk without requiring unlimited storage or complicated infrastructure.
Start by separating the website into four recovery components:
- Files: application files, themes, plugins, templates, uploaded documents, and other site assets.
- Database: pages, posts, products, orders, user records, settings, and form submissions stored in a database.
- Media: images, videos, PDFs, and other uploads. These may be stored separately from the database even when the website displays them together.
- Configuration: DNS records, environment variables, server settings, scheduled jobs, SSL configuration, and email-related settings where applicable.
A backup that contains only the database may omit the files needed to run the site. A file archive without the database may preserve images and code but lose recent content. Treat these components as a recovery set and document where each one is stored.
The right question is not simply “How often should I back up my website?” It is “How much recent work could the business afford to lose?” If losing one day of orders or enquiries would be unacceptable, daily backups may not be enough for the most active data. If the site changes only a few times each month, a less frequent full backup combined with event-based backups may be reasonable.
| Backup type | What it captures | Useful for | Planning note |
|---|---|---|---|
| Full | A complete copy of selected files, media, database, and configuration | Major failures, migrations, and straightforward restores | Usually requires more storage and time |
| Incremental | Changes made since a previous backup | Reducing daily transfer and storage requirements | Restoration may depend on a chain of earlier backups |
| Database | Structured content and transactional data | Frequently changing content, orders, and submissions | Does not replace file and media backups |
| Off-site | A copy stored away from the hosting account or server | Hosting failure, account compromise, or accidental deletion | Check access, encryption, retention, and restore procedures |
How to estimate your backup plan
Use a simple planning model based on recovery objectives rather than a provider’s default schedule. Two measures are useful:
- Recovery point objective (RPO): the maximum amount of recent work the business is prepared to lose.
- Recovery time objective (RTO): the target time for restoring a usable website.
These are planning targets, not guarantees. Your actual result depends on backup size, connection speed, hosting access, staff availability, database compatibility, and the complexity of the website.
To estimate storage, use this worksheet:
- Measure the current size of website files and media.
- Record the database size separately.
- Estimate the average amount of new or changed data between backups.
- Choose the number of daily, weekly, and monthly restore points to retain.
- Add working room for temporary restore files, logs, compressed archives, and future growth.
A practical planning formula is:
Estimated storage = full backup size × number of full copies + average change size × number of incremental copies + temporary restore space.
This is an estimate, not a billing quote. Compression, deduplication, provider packaging, and excluded folders can change the actual amount of storage used. Review the provider’s definitions carefully: “backup included” may refer to frequency, retention, storage location, or restoration support, and those are not interchangeable.
Use the 3-2-1 model as a baseline:
- 3 copies: keep the live website plus at least two backup copies.
- 2 storage types or locations: avoid relying on one account, server, or storage path.
- 1 off-site copy: maintain a copy that is separate from the primary hosting environment.
For a small business, the plan can remain simple: an automated hosting backup, a separately stored export, and a documented manual or scheduled copy of critical data. The important distinction is independence. If someone can delete the live site and every backup from the same account, the arrangement is not meaningfully resilient.
Inputs and assumptions
Before selecting a schedule, write down the assumptions that drive it. This makes the plan easier to review when the business changes.
Change frequency
Classify the site as low, moderate, or high change. A brochure site updated occasionally may need backups around planned edits and on a recurring schedule. A site receiving daily enquiries, bookings, orders, or user-generated content needs more frequent database protection. Back up immediately before redesigns, plugin or theme updates, migrations, DNS changes, and other high-impact work.
Business impact
List the data that would be hardest to recreate. This may include customer submissions, product records, booking information, invoices, media libraries, or custom configuration. Prioritize those items if storage or restoration time is limited.
Retention
Retention should match the way problems are discovered. Keep enough history to recover from an error that is noticed days or weeks later, not only from a failure that happens immediately. A reasonable starting structure is short-term daily points, several weekly points, and longer-term monthly points, then adjust it to the site’s change rate and storage budget.
Security and access
Backups may contain personal information, customer records, credentials, or unpublished business material. Restrict access, use strong account protection, and avoid placing secrets in plain-text notes. Confirm whether backups are encrypted in transit and at rest according to the provider’s documentation. Keep recovery instructions accessible to an authorized person if the usual administrator is unavailable.
For related operational checks, use the website maintenance schedule and domain, DNS, SSL, and business email checklist.
Worked examples
Example 1: A low-change service website
Assume a consultancy has a small website with occasional page edits, a modest media library, and a contact form. Its main concern is recovering from a bad update or hosting failure. A suitable starting plan could include a recurring full backup, a separate database backup if forms change frequently, an off-site copy, and a pre-update backup before every major change.
The business can estimate storage by measuring one full archive, multiplying it by the desired number of retained full copies, and adding space for database exports and temporary restore work. The schedule should be reviewed after a redesign, a new form system, or a move to a different hosting platform.
Example 2: A site with daily orders or bookings
Assume a small retailer or appointment-based business changes database records throughout the day. A weekly full backup alone could leave too much recent information at risk. The plan should give the database a shorter backup interval than the large media library, while retaining regular full backups and an off-site copy. Before choosing the exact interval, identify the busiest transaction periods and confirm that the hosting platform can restore both the database and associated files consistently.
Example 3: A redesign or hosting migration
For a migration, create a named pre-change backup and do not overwrite it immediately. Keep the original site available until the new version has been tested. Restore a copy in a staging environment, verify pages, forms, media, redirects, DNS-related settings, and business email dependencies, then record the rollback steps. The cloud hosting migration guide can help organize that broader change plan.
Run a restore drill
At least periodically, test the backup rather than checking only that a file exists:
- Choose a recent backup and record its date, size, source, and retention location.
- Restore it into a staging site or isolated environment, not over the live website.
- Confirm that the database imports without errors and that the application connects to it.
- Check representative pages, navigation, images, downloads, forms, user accounts, orders, and scheduled tasks.
- Review configuration, environment variables, SSL behavior, DNS records, redirects, and external integrations.
- Compare the restored content with the expected backup date and note any missing or changed data.
- Record the elapsed time, failed steps, permissions issues, and the person responsible for each recovery task.
A successful restore drill proves more than a successful backup job. It also reveals whether the team knows where the backup is, has the required credentials, understands the restore sequence, and can distinguish website data from DNS and email settings.
When to recalculate and retest
Revisit the website backup strategy whenever its inputs change. Recalculate storage and retention after adding a large media library, ecommerce features, memberships, bookings, forms, or a new content workflow. Review it when hosting pricing, included storage, backup frequency, retention, or restoration procedures change. Provider features should be checked directly rather than assumed from an old plan description.
Run an additional restore test after a hosting migration, major redesign, database change, security incident, plugin or theme replacement, or significant DNS and email change. A quarterly review is a useful default for many small businesses, but a higher-change website may need more frequent testing.
End each review with three decisions: what is protected, what could still be lost, and who can restore it. Update the backup inventory, retention settings, recovery contacts, and step-by-step instructions. If the answers are unclear, the next action is not to buy more storage immediately; first identify the missing component and test a complete recovery path. For broader maintenance planning, compare this process with the website backup and restore guide and the monthly and quarterly maintenance checklist.
