Why backups matter more than most owners realise

A website backup is insurance for scenarios you cannot fully prevent. Your site can be hacked despite good security practices. A software update can break something unexpectedly. A developer can make a change that corrupts the database. Your hosting provider can have a hardware failure. Without a backup, any of these events can mean starting over from scratch — rebuilding a site that took time and money to create.

The businesses that recover from these events quickly and cheaply are the ones with current, tested backups. The businesses that spend weeks and thousands of dollars recovering are the ones that assumed someone else was handling it.

What a website backup actually contains

A complete website backup has two parts that must both be present to be useful.

The files: Everything in your website’s folder on the server — your theme files, plugin files, uploaded images, configuration files. For a WordPress site, this is typically the contents of the public_html or www folder.

The database: WordPress stores all your content — pages, posts, settings, user accounts, comments — in a MySQL database. The database is separate from the files. A backup of only the files, without the database, cannot restore your site to a working state. A backup of only the database, without the files, similarly cannot.

Any backup solution you use must capture both. Ask your provider or developer specifically whether both files and database are included.

What your hosting provider backs up

Most Canadian web hosts include some form of automated backup, but the details vary significantly and the terms are often buried in documentation few people read.

Common patterns:

  • Daily backups kept for 7–30 days. Many shared hosting plans include this. It sounds reassuring, but a hack that has been present for six weeks without detection gives you nothing useful to restore to.
  • Backups stored on the same server. If the server has a hardware failure, the backups go with it. This is more common than most people expect.
  • Backups available but not guaranteed. Some hosts include backup tools as a courtesy feature rather than a service guarantee. The fine print may say they are not responsible if backups fail or are incomplete.
  • Restore requires a support ticket. On shared hosting, restoring from a backup typically means contacting support and waiting. This is not a problem until it is an urgent one.

The point is not that hosting backups are useless — they are better than nothing, and for minor incidents they work fine. The point is that relying solely on hosting backups, without understanding what they actually cover, is a meaningful risk.

What makes a backup actually useful

A backup is useful if it meets these criteria:

  • It is recent enough to matter. For most Canadian small business websites, a daily backup is adequate. An e-commerce site processing orders needs more frequent backups — potentially hourly — because a day’s worth of order data has real business value.
  • It includes both files and database. As described above, you need both to restore a functioning site.
  • It is stored somewhere other than the same server. The backup needs to be in a different location — cloud storage, a different server, or downloaded to your computer — so that a server failure does not destroy the backup along with the site.
  • You can restore from it yourself. If restoring requires opening a support ticket and waiting 24 hours, that matters when your site is down and clients are noticing.
  • It has been tested. A backup that has never been restored is a backup you do not actually know works.

WordPress backup options

For WordPress sites, several good backup plugins exist that handle both files and database.

UpdraftPlus (free tier available) is the most widely used WordPress backup plugin. It can schedule automatic backups and send them to remote storage — Google Drive, Dropbox, Amazon S3, and others. The free version handles most small business needs.

All-in-One WP Migration is useful for creating a single portable backup file that can be used to restore or migrate a site. It is less suitable for scheduled automated backups but very convenient for one-off snapshots before making major changes.

If you use managed WordPress hosting, the host typically handles backups as part of the service — including remote storage and easy restore. Confirm exactly what is included, how long backups are retained, and whether you can restore yourself or need to contact support.

How to test a backup

Testing a backup means actually restoring it to a working website and confirming the result looks and functions correctly. Here is a practical approach that does not require technical expertise.

  1. Download a backup copy to your computer. Whatever system you use, download a recent backup locally. This also confirms the backup exists and is downloadable — more than many owners ever check.
  2. Ask your host or developer to do a test restore to a staging environment. Many managed hosts offer staging — a private copy of your site where you can restore and test without affecting the live site. If your host offers this, use it once a year to verify the restore process works.
  3. At minimum, open the backup files. If you have a backup archive (usually a zip file), open it and confirm it contains what you expect — PHP files, a database export file (usually a .sql file), and your uploaded images. An archive that opens but is empty, or is missing the database, is not a usable backup.

Most people never test their backups until they need them. By then it is too late to discover the backup process was misconfigured, the files were incomplete, or the stored credentials for remote storage had expired. A brief annual check prevents this.

Why offsite storage matters

A backup stored only on your web server is vulnerable to the same risks as your site. Server hardware failures, hosting provider issues, and even ransomware attacks that target the server can affect backups stored in the same location as the site.

Offsite means storing backup copies in a genuinely separate location: a cloud storage service like Backblaze, Google Drive, or Amazon S3; a different hosting provider’s storage; or downloaded to a computer in your office. For a small business website, one offsite copy is usually adequate. The goal is that no single point of failure — your hosting provider having an outage, for example — destroys both your site and your ability to restore it.

If you use a backup plugin like UpdraftPlus, configuring it to send backups to Google Drive or Dropbox takes about fifteen minutes and costs nothing beyond the storage you likely already have. There is little reason not to do this.