Website Backups: How to Know You Can Actually Recover

A backup is not a recovery plan by itself. It is a source you hope to restore from when a website breaks, an update fails, a server is damaged or malware changes files. The important question is simple: can the business recover the right version of the site within the time it can afford?

Many small businesses only discover backup gaps during a stressful incident. This guide helps website owners ask practical questions before that moment arrives.

Know what your website is made of

A useful backup must include the parts needed to restore the working site. For WordPress, that usually means files and database content. For Laravel, Shopify-connected systems or custom applications, the backup picture may include code, uploaded files, environment settings, database records and external service configuration.

Do not assume a hosting backup includes everything. Some providers back up files but not custom email. Some plugin backups miss server-level configuration. Some database exports omit large tables or run too rarely for an active site.

Write down which backup covers files, which covers the database and which person knows how to restore each one.

Keep at least one backup away from the live account

The FTC's small business cybersecurity guidance recommends backing up important files regularly. For websites, location matters as much as frequency. A backup stored only inside the same compromised hosting account can be deleted or changed along with the live site.

Use an off-site destination controlled by the business or a trusted provider. Limit who can delete backups. If possible, keep versions so one corrupted backup does not replace every clean restore point.

For high-value sites, separate backup administration from normal website editing accounts.

Test restores before you need them

A backup that has never been restored is an assumption. Restore testing confirms whether the files are complete, the database imports correctly and the website works afterward. It also reveals how long recovery might take.

Use a staging location or controlled test environment. Check the homepage, forms, login, search, checkout, media library, redirects and any admin workflow the team uses. Record what worked and what failed.

NIST's small business quick-start resources are designed to help small organizations begin practical risk management. Restore testing fits that mindset: it turns a security promise into evidence.

Plan for malware separately from broken updates

If an update breaks the site, a recent backup may be the fastest recovery path. If the site is hacked, a backup needs more caution. Restoring a copy from after the compromise may bring the malware back. Restoring a clean copy without closing the entry point can lead to reinfection.

Before restoring during a security incident, preserve evidence where possible: suspicious URLs, scanner reports, file paths, admin users and timing. Then decide whether the backup is part of cleanup, not a substitute for investigation.

For WordPress malware, review users, plugins, themes, uploads, database content and passwords after recovery.

Set a recovery target the business understands

Two questions make backup planning concrete. How much recent data can you afford to lose? How long can the site be unavailable? A blog might tolerate a slower restore. An enquiry-driven site may need quote requests preserved. An online store may need tighter recovery for orders and customer records.

Translate those answers into backup frequency and restore priority. If quote requests are important, confirm whether they live in email, database records, a CRM or all three.

A backup plan should support the business workflow, not only satisfy a checkbox.

Backup review checklist

• Files, database, uploads and configuration are covered.
• At least one backup copy is separate from the live hosting account.
• Backup frequency matches the value of new content, orders or enquiries.
• Restore testing has been completed recently.
• Someone knows who can approve downtime and data loss.
• Security incidents have a cleanup plan beyond simple restore.

For a wider plan, combine backups with our hacked website warning signs guide and website security layers article.

Editorial note: this article was prepared with AI assistance and reviewed against FTC and NIST small business guidance. It is general educational guidance and should be adapted to your platform, hosting and legal obligations.