The uncomfortable truth: It's not a question of if you'll need your backups, but when. Hacks, hardware failures, human error, and hosting issues happen to everyone eventually.
Relying only on hosting backups
Hosting backups can fail, get corrupted, or disappear if your account is suspended. You need copies you control.
Never testing restores
A backup file that won't restore is just wasted storage. Many businesses discover this during an actual emergency.
Keeping backups in one location
If your backups are on the same server as your site, they'll both be gone when that server fails.
Manual backup processes
Human memory is unreliable. If backups require manual action, they eventually stop happening.
Not backing up everything
Files without database, or database without files, or forgetting emails and DNS settings.
Discovering you never tested Plan B...via GIPHY
The 3-2-1 Backup Rule
Used by IT professionals worldwide. Simple, effective, and battle-tested.
copies of your data
Your live site, a local backup, and a cloud backup. If one fails, you have two more.
Example: Production server + external hard drive + Google Drive
different storage types
Don't put all backups on the same type of media. Hard drives fail differently than cloud storage.
Example: Physical drive + cloud service, or NAS + external SSD
off-site copy
At least one backup should be geographically separate. Protects against fire, theft, and local disasters.
Example: Cloud storage in a different region, or a drive at another location
Practical minimum: If 3-2-1 feels overwhelming, start with 2-1: two copies with one off-site. It's better than one copy stored in the same place as your site.
Complete Backup Checklist
0/8 itemsPosts, pages, users, settings, orders—your site's brain
Themes, plugins, uploads, custom code
Images, videos, PDFs—often large and hard to recreate
.htaccess, wp-config.php, environment variables
If using webmail, your emails need separate backup
Screenshot or export your DNS settings
If using custom certificates (most hosts auto-renew)
Admin passwords, FTP, database passwords in a password manager
Commonly forgotten: DNS records and email data. When your site is down, you might not remember your exact DNS configuration. Screenshot it now while everything works.
Hosting Provider Backups
Most quality hosts include automatic daily backups. Enable them in your control panel.
- One-click setup
- Included in hosting cost
- Automatic and consistent
- Same location as site
- Limited retention
- Gone if account suspended
Best for: Primary backup layer—enable but don't rely on exclusively
Plugin/Extension Backups
WordPress plugins like UpdraftPlus or Duplicator. Similar options exist for other platforms.
- Cloud storage integration
- Scheduled backups
- Easy restores
- Can slow site during backup
- Plugin conflicts
- Requires maintenance
Best for: Off-site copies to Dropbox, Google Drive, or S3
cPanel/Plesk Backups
Use built-in control panel tools to create and download full account backups.
- Complete backup including email
- Downloadable
- No extra tools needed
- Often manual process
- Large file sizes
- Requires storage space
Best for: Monthly full backups downloaded to local storage
Custom Scripts
Automated scripts using mysqldump and rsync, scheduled via cron.
- Full control
- No plugin overhead
- Can push to any destination
- Requires technical knowledge
- Maintenance overhead
- Error handling needed
Best for: Developers who want precise control over backup process
Recommended combination
Enable hosting backups (layer 1) + plugin backup to cloud storage (layer 2) + monthly manual download (layer 3). This gives you redundancy with minimal effort.
How to Test Your Backups
Schedule this quarterly. Mark your calendar. A 30-minute test now saves days of panic later.
Create a staging environment
Set up a test subdomain (test.yoursite.com) or use a local development environment. Never test restores on your live site.
Download your latest backup
Get both database and files. Verify the files are complete and not corrupted (check file sizes).
Restore to staging
Import the database, upload files, update configuration to point to test domain. Document each step.
Test core functionality
Check homepage loads, test login, verify images appear, test forms, check a few different pages.
Document and improve
Note what went wrong, update your restore documentation, fix any issues you discovered.
- • Restore completes without errors
- • All pages load correctly
- • Images and media appear
- • Login and forms work
- • Recent content is present
- • Database import errors
- • Missing images (broken icons)
- • White screen after restore
- • Old content (backup not recent)
- • Can\'t log in
Disaster Recovery Plan Template
Print this. Save it somewhere accessible when your site is down.
Immediate Response (First 15 Minutes)
- Don't panic—check if site is actually down (use downforeveryoneorjustme.com)
- Document what happened (screenshot errors, note the time)
- Check hosting status page for provider outages
- Contact hosting support if it's on their end
Assessment (15-30 Minutes)
- Determine the scope: full site down, database corrupted, hacked, or just errors?
- Check when your last backup was created
- Assess what data might be lost since last backup
- Decide: quick fix vs. full restore
Recovery Steps
- Restore from most recent clean backup
- Test site on staging first if time permits
- Update passwords if hacked (all accounts)
- Re-add any content created since backup
- Scan for malware if breach suspected
Post-Recovery
- Document what went wrong and how you fixed it
- Improve backups to prevent/reduce future impact
- Update security if breach occurred
- Communicate with affected users if necessary
- Schedule follow-up check in 24-48 hours
Store this plan externally
If your site is down, you might not be able to access docs stored on it. Keep a copy in Google Docs, your password manager notes, or printed in your desk.
Backup Mistakes That Destroy Businesses
Only backing up files OR database
Consequence: You can't restore a functioning site with only half the pieces
Fix: Always backup both files and database together. Verify both are in your backup.
Not checking backup completion
Consequence: Backups fail silently. Empty or truncated files won't restore.
Fix: Check backup file sizes. A database backup that's 0KB failed. Set up email alerts.
Keeping only one backup version
Consequence: If corruption or hack was in that backup, you have nothing clean to restore
Fix: Keep 7-30 days of daily backups. Allows you to go back before the problem started.
Storing backups on the same server
Consequence: Server failure or hack takes out your site AND backups
Fix: Always have at least one copy stored elsewhere (cloud storage, local download).
No documentation of restore process
Consequence: Under stress, you'll forget critical steps or make mistakes
Fix: Write down every step while doing a test restore. Keep docs accessible.
Backing up too infrequently
Consequence: Lose days or weeks of content, orders, and customer data
Fix: Match backup frequency to how often content changes. E-commerce: daily minimum.