Website Backups: What to Back Up and How to Test a Restore
A backup is only useful if it contains everything you need, is kept somewhere a problem cannot reach, and can actually be restored. This guide covers what a website backup should include, where to keep copies, how long to keep them, who should hold them, and how to test a restore without touching the live site. It draws on guidance from CISA, the UK's National Cyber Security Centre (NCSC) and the WordPress documentation, checked on 29 October 2026.
What to back up
A website is more than its pages. The WordPress documentation on WordPress backups explains that a site has two parts that must both be saved. The database holds the posts, pages, comments and settings; the files hold the core software, plugins, themes, uploaded images and documents, and any other code. A database backup alone will not bring back your images or theme, and a file backup alone will not bring back your content.
For a full recovery you also want the pieces that sit outside the site:
- Configuration: the site's configuration file, server settings such as redirects, and a note of the PHP or software versions it runs on. Keep files that contain passwords, such as WordPress's
wp-config.php, in a secure place, not in a shared folder. - DNS records: an export or screenshot of your domain's DNS zone, including the mail records. If you have to move host in a hurry, you will need them. Our guide to domain names and DNS explains what they are.
- Accounts and access: a list, kept somewhere safe, of where the domain, hosting, DNS, email and backups live and who can log in to each.
- Other business data: the NCSC's small organisations guide lists your website alongside emails, invoicing, documents, contacts and customer information as data a business needs to operate. Website form entries and shop orders stored in the site's database are part of that.
Where to keep copies: the 3-2-1 rule
CISA's paper Data Backup Options (written for US-CERT) sets out the 3-2-1 rule:
- 3: keep three copies of any important file, one primary and two backups.
- 2: keep the files on two different media types, to protect against different types of hazards.
- 1: store one copy offsite, outside your home or business facility.
For a website, the live site is the primary copy. A backup on the same server is convenient for quick rollbacks, but it is not your offsite copy: if the server fails, is hacked or the hosting account is closed, it goes too. At least one copy should be on separate storage, such as a cloud storage account or a different provider. WordPress gives the same advice: one copy on the server, one in cloud storage and one on a local computer.
The NCSC adds two practical points: protect online backup accounts with two-step verification, and do not leave an external backup drive connected when it is not in use, because some malware also affects devices connected to an infected computer.
Backups and ransomware
Ransomware encrypts or deletes data and demands payment to restore it. CISA's #StopRansomware Guide recommends that organisations "maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario". It explains why offline matters: "many ransomware variants attempt to find and subsequently delete or encrypt accessible backups to make restoration impossible unless the ransom is paid."
For a website, "offline" in practice means a copy that the website, its hosting account and the people who log in to them cannot change or delete. Options include a separate storage account with its own login, storage that blocks deletion for a set period, or a copy downloaded to a drive kept disconnected. The NCSC's principles for ransomware-resistant cloud backups describe the features to look for in a backup service: backups that cannot be altered or deleted once created, with retention periods you set in advance, the ability to restore an older version even if recent ones are corrupted, and alerts when someone makes significant changes.
How often, and how long to keep them
The WordPress documentation suggests weekly backups for smaller sites with few changes and daily backups for busy ones, and always a backup before an update. The real test is how much work, or how many orders, you could afford to lose.
On retention, WordPress suggests keeping at least three to five recent backups. A hack is not always spotted the same day, and if every backup was taken after the problem started, none of them helps. A mix of recent daily copies and older weekly or monthly ones gives you a clean point to go back to. Remember that backups of customer data are still personal data under privacy law, so do not keep them for longer than you need.
Who holds the backups: your host or you
Most hosts back up their servers, but the WordPress documentation warns that it "takes time to request a copy of your site from their backups", and tells site owners to learn to back up and restore their own sites. Before relying on a host's backups, ask how often they run, how many are kept, where they are stored, whether you can restore one yourself, and whether there is a charge. Our guide to web hosting lists more questions to ask.
The safest setup is a host backup plus at least one independent copy in an account your business owns. If an agency or freelancer manages backups for you, make sure the storage is in your name, or that you can get a copy on request, so a change of supplier does not leave you without your history. For sites on our managed server, our website maintenance care includes daily backups of files, databases and email, and the backups belong to you.
How to test a restore
CISA and the NCSC both make the same point: a backup is not proven until it has been restored. The NCSC says it is important to know how to restore a backup and to check it contains all your important data, and the WordPress documentation recommends backing up automatic backups with a manual one now and then to make sure the process works.
Test on a staging copy, never on the live site:
- Set up a separate, private location, such as a staging subdomain or a local copy, blocked from search engines and the public. WordPress has documentation on running a development copy.
- Take the most recent backup from the offsite copy, not the one on the live server, because that is the one you would rely on in a real emergency.
- Restore it the way the WordPress guide describes: files first, then import the database, and update the configuration if the database details differ.
- Time how long it takes, and write down each step, login and password location as you go.
- Make sure the staging copy does not send emails to customers, take payments or run scheduled jobs.
Do this at least a few times a year and after any big change to the site or the backup setup.
What to check after a restore
- The home page and key pages load, with images, styles and menus intact.
- Recent content is there: the latest posts, products, orders or form entries you expect from the backup date.
- You can log in to the admin area, and plugins or extensions work.
- Forms, search and checkout work (with test payments only).
- No links point to the live domain by mistake, and the copy is hidden from search engines.
In a real recovery after a hack, also follow the steps in our website security guide: restore from a backup taken before the problem started, change passwords and update everything before going live again.
Frequently asked questions
What should a website backup include?
Both the files (software, plugins, themes, uploads) and the database (content, settings, orders and form entries). Keep a copy of the configuration and your DNS records as well, so you can rebuild on a new host if you have to.
Are my host's backups enough?
Usually not on their own. They may take time to request, and they share the fate of your hosting account. Keep at least one independent copy in storage your business owns.
What is the 3-2-1 backup rule?
CISA describes it as three copies of important files (one primary and two backups), on two different media types, with one copy stored offsite.
How do backups protect against ransomware?
Only if attackers cannot reach them. CISA recommends offline, encrypted backups that are tested regularly, because ransomware often tries to find and delete or encrypt accessible backups.
How often should I test a restore?
A few times a year and after any big change to the site or the backup setup. Restore to a private staging copy, never over the live site, and check the content, logins and forms.
Want someone to look after this for you? Our website maintenance service covers backups, updates and restores. See all our services, or email info@creahive.com.