A website backup for small business is the simplest insurance you can buy, and the one most owners only think about after something breaks. A hacked plugin, a bad update, an accidental deletion or a hosting failure can take your site offline or wipe out orders, product pages and customer records in minutes. The answer is a backup plan with three parts: a copy of everything that matters, a schedule that fits how often your business changes, and a restore you have tested before you need it.
What a website backup has to include
Many owners think a backup means "the site is saved somewhere." That is only partly true. A site is made of several parts, and losing any one of them can leave you with a page that loads but does not work.
Files, database and settings
A complete backup covers three things:
- Website files: the code, themes, templates, images and uploaded documents.
- The database: orders, customer accounts, form submissions, blog posts, product listings and bookings. This is the part that changes most often and matters most.
- Configuration: payment gateway keys, email settings, domain records and any environment variables your site depends on. Many owners forget these, and a restore without them can fail quietly.
Third-party connections
Your site also depends on services outside it: the payment provider, the email service, the analytics account and the domain registrar. A backup does not copy these. Keep a written list of every connected service, who owns the login, and where the recovery details are stored. When a site is down, the first question is often "who can log in to the domain account?" and nobody knows.
How often to back up your business website
The right schedule depends on how quickly your data changes. A brochure site that changes twice a year can be backed up less often than an online store taking orders all day.
- Online stores and booking sites: daily database backups at minimum, with file backups at least weekly.
- Lead-generation sites with contact forms: daily, because a lost enquiry is a lost sale.
- Brochure sites with rare edits: weekly, plus a backup before and after every change.
Always take a fresh backup before you install an update, change a theme or add a plugin. Most serious breakages happen right after a change, so a backup taken just before it is the one that saves you.
Where to keep your backup copies
A backup stored on the same server as the live site is not a real backup. If the server fails, is compromised or is suspended, the copy goes with it. Keep at least one copy somewhere separate.
- Check whether your hosting plan includes backups, and find out how long they are kept, whether you can download them yourself and whether restoring is a self-service action or a support ticket.
- Keep a second copy in a different place, such as a separate cloud storage account that your team controls.
- Keep the number of copies you hold reasonable. Older copies that you no longer need are a small risk too, because they contain customer data.
Hosting terms vary a lot. Some providers keep backups for a few days, others for weeks. Read the terms rather than assuming, and write down the answer.
Test the restore before you need it
This is the step most owners skip, and it is the one that matters most. A backup you have never restored is a hope, not a plan. Backups can be incomplete, corrupted or missing the database, and you only discover this when you try to use them under pressure.
Test your restore at least once a quarter:
- Restore the latest backup to a separate test copy of the site, not the live one.
- Check that the pages load, the images appear and the database content is there, such as recent orders or enquiries.
- Log in with an admin account and confirm that forms, payments and emails still work in the test environment.
- Write down how long the process took and who did it. That is your real recovery time, and it is the number to plan around.
If the test fails, you have found the problem on a quiet afternoon instead of during a sales peak.
Decide who holds the keys
A backup plan fails when only one person can access it. Make sure at least two trusted people know where backups are stored and how to restore them. Keep logins for the hosting account, domain registrar and backup storage in a shared password manager, with recovery options tied to a business email rather than a personal phone.
Also remove access when people leave. A former developer who still has hosting admin rights is both a continuity risk and a security risk. For more on protecting the customer information your site collects, see our guide on keeping customer data safe for your business.
When a backup plan is part of a bigger build
If your current site was built without any of this in place, the cheapest time to fix it is during a rebuild or redesign. A well-built site can separate its database, file storage and configuration cleanly, which makes backups and restores faster and less risky. Our team covers this as part of our website development work, including how hosting, backups and updates are set up from the start.
Frequently asked questions
Answers to the most common questions about backing up a business website. If yours is not listed, see our full FAQ.
Does my web hosting already back up my website?
Many hosting plans include some form of backup, but the terms differ. Check how long backups are kept, whether they include the database, and how quickly you can restore. Do not assume the default is enough for a site that takes orders or enquiries.
How often should a small business back up its website?
Back up daily if your site takes orders, bookings or form submissions, and weekly if it is mostly static. Always take an extra backup before any update, theme change or new plugin. The right frequency depends on how much data you could afford to lose.
Is a backup enough to protect against hacking?
A backup helps you recover from a hack, but it does not stop one. You also need up-to-date software, strong logins, two-factor authentication on admin accounts and removal of unused plugins or accounts. Backups and prevention work best together.
How do I know if my website backup actually works?
Restore the most recent backup to a separate test copy and check that pages, images, orders and forms all work. Do this at least every three months and record how long it takes. A backup that has never been restored should be treated as unproven.
If you are not sure how your current site is backed up or what would happen if it went down tomorrow, talk to us or send a short project brief. We will look at your setup and tell you plainly what is protected and what is not.
