How often should a small business back up its website?

Most sites that collect bookings, leads or orders should back up daily, automatically. A simple brochure site that rarely changes can manage with weekly backups, as long as you also take a fresh backup before any edit or update. The right frequency depends on how much data you could afford to lose: with nightly backups, you could lose up to about a day of changes.

Does my web host back up my website automatically?

Many hosts do, but details vary widely. Some keep daily backups for 7 days, some longer, and some charge extra for daily backups on cheaper plans. Log in to your hosting panel, check the frequency and retention period, and confirm you can download a copy. Even with good host backups, keep at least one copy stored somewhere else that you control.

Where should I store website backups?

Store at least one copy away from your hosting provider, such as a separate cloud storage account you own, and protect it with a strong password and two-factor login. An encrypted offline drive adds another layer. Avoid keeping your only backup on the same server as the site, because a hack, failure or account problem could affect both at once.

How long should I keep website backups?

Keep enough history to go back before a problem started. CISA advises being able to roll back data at least seven days, but hacks can stay hidden longer, so many businesses keep daily backups for a few weeks plus weekly or monthly copies for several months. Longer retention costs a little more storage but gives far more options during a recovery.

Do I need to back up my business email?

Usually yes, separately. Email normally runs on a different service from the website, so a website backup will not restore deleted messages. Check what your email provider retains and for how long. For important mailboxes, use the provider's export tools or a dedicated backup service, and save your email DNS records so mail can be reconnected quickly after a change.

How do I restore my website from a backup?

Most hosting panels and backup tools offer a restore button for files and database. Choose a backup dated before the problem, restore to a staging copy first if possible, check pages and forms, then restore live. After a hack, also change all passwords and fix the cause, or the attacker may return. If you are unsure, get help before overwriting the live site.

Speed & Security

Website Backup Guide for Small Businesses: What to Back Up, How Often and How to Restore

By ITCM Team · Updated November 2026

A website backup is a copy of everything needed to rebuild your site: the files, the database, and the settings around it such as email and DNS records. Most small businesses rely on whatever their host does, then discover during a hack or a bad update that the backups only go back a week, sit on the same server, or have never been tested. The safe approach is the 3-2-1 rule recommended by CISA: three copies, on two types of storage, with one kept off-site. Back up at least daily if your site takes bookings or orders, and test a restore regularly.

Key takeaways

Back up files, database, email and a record of your domain and DNS settings, not just the pages.
Follow the 3-2-1 rule: three copies, two storage types, one copy off-site.
Host backups are useful but often kept for only about 7 days and stored with the same provider.
CISA advises being able to roll back data at least seven days and testing recovery on a schedule.
A backup you have never restored is a hope, not a plan.
Daily automated backups suit most sites that take bookings, leads or orders.

What should a small business website backup include?

A complete backup lets you rebuild the site on any server, not just the one it lives on today. That means more than a copy of the pages you see.

Website files: code, theme, plugins (on WordPress), images and uploaded documents.
Database: pages, blog posts, bookings, form entries, customer accounts and settings.
Email: mailboxes are usually separate from the website and need their own backup or export.
Domain and DNS records: a saved list of A, CNAME, MX, SPF, DKIM and DMARC records, plus registrar login details kept safe.
Configuration: environment settings, SSL setup notes, redirects and any API keys stored securely.
Access list: who has admin, hosting and registrar access, so you can recover accounts.

Why back up your DNS records and email separately?

If your site is hacked, your host account is closed or you change providers, the DNS records are what connect your domain to your website and email. Losing them can stop email for days while someone reconstructs SPF, DKIM and DMARC. A simple export or screenshot of the DNS zone, updated after every change, avoids that. Our DNS guide for business owners explains what each record does.

Email is a separate service from the website in most setups. Restoring a website backup will not bring back deleted emails, so check what your email provider keeps and whether you need an export or a third-party backup for important mailboxes.

What is the 3-2-1 backup rule?

The US Cybersecurity and Infrastructure Security Agency (CISA) recommends that small businesses keep 3 copies of important files, on 2 different types of storage, with 1 copy stored off-site. For a website, that could look like the live site, a nightly backup at your host, and a weekly copy in separate cloud storage you control.

CISA also recommends protecting backups with encryption and offline copies, and being able to roll data back at least seven days, because an infection can go unnoticed for days. Some guides extend this to 3-2-1-1-0: one immutable or offline copy and zero errors when you test a restore.

Copy	Example for a small business site	Protects against
1. Live site	Your website on the hosting server	Normal daily use
2. Host backup	Daily automatic backup in the hosting panel	Bad updates, accidental deletions
3. Off-site copy	Weekly download to separate cloud storage you control	Host failure, account lockout, ransomware
Extra: offline copy	Monthly copy on an encrypted drive kept offline	Attacks that reach connected backups

How often should I back up my website?

Match the frequency to how often the site changes and how much data you can afford to lose. Planners call this the Recovery Point Objective: nightly backups mean you could lose up to about a day of changes.

Brochure site that rarely changes: weekly, plus a backup before every edit or update.
Site with bookings, leads or a blog: daily automated backups.
Online shop or member area with constant orders: daily at minimum, often more frequent database backups.
Before any plugin, theme or core update: always take a fresh backup.

Are my hosting company's backups enough?

Host backups are a good first layer, but rarely enough on their own. Plans differ a lot. For example, Hostinger states that its daily backups for web hosting are kept for 7 days, and on lower-tier plans daily backups are a paid add-on. Other hosts keep 14, 21 or 30 days. Check your plan rather than assuming.

The main weaknesses are retention, location and control. If a hack goes unnoticed for two weeks, a 7-day history may contain only infected copies. If the backups sit with the same provider, an account suspension, billing problem or provider outage can take the site and the backups together. That is why one copy should be stored somewhere you control, as part of a wider website security plan.

How do I test that a backup actually restores?

CISA recommends scheduled recovery tests to confirm backups work, including both full and partial restores. A simple routine for a small business:

Every month, restore one file or one database table to a test location and check it opens.
Every quarter, restore the full site to a staging copy and click through key pages, forms and bookings.
Write down how long the restore took and the steps, so someone else could repeat them.
Check that the backup is not empty, partial or years old: size and date tell you a lot.
After a real incident, restore from a copy dated before the problem started.

Backups for WordPress, custom-coded and website builder sites

How you back up depends on the platform. WordPress needs both files and database, and usually a backup plugin or host tool. Custom-coded sites are typically kept in version control (such as Git), so the code is already stored in more than one place, and the database needs its own scheduled backups. Website builders such as Wix or Squarespace manage the servers for you, but you have limited export options, so keep your own copies of text, images and form data.

Whatever the platform, knowing who owns your website and domain matters as much as the backup itself.

How much does website backup cost?

Costs are usually modest compared with rebuilding a site or losing bookings. Prices vary by host and tool, so treat these as typical patterns rather than quotes. A full picture of ongoing costs is in our website maintenance cost guide.

Host backups: sometimes part of higher-tier plans, otherwise a monthly add-on.
Backup plugins or services: free basic versions exist; paid versions add off-site storage and one-click restore.
Cloud storage for off-site copies: low monthly fees for a typical small business site.
Managed maintenance: backups, updates, restore tests and monitoring handled for you on a monthly plan.

How ITCM handles backups

ITCM's work recovering hacked WordPress sites showed how often the only backups were old, stored on the same server or never tested; the WordPress recovery case study covers cleanup, speed and security hardening. For new projects ITCM builds custom-coded sites, with code kept in version control and the database backed up separately.

The process is demo-first: ITCM builds your website and installable app, you see it finished, and you pay $150 one-time only if you are happy. That covers the website, installable app (PWA), 24/7 online booking, lead management, admin panel and 3 design options. Anything else gets a fixed quote before work begins. Ongoing backups and restore checks can be handled through website maintenance, with an optional care plan from $100/month.

Website backup checklist

List what needs backing up: files, database, email, DNS records, settings.
Turn on automated backups at your host and check how long they are kept.
Keep one copy off-site in storage you control, and one offline if possible.
Back up before every update or major change.
Run a partial restore monthly and a full test restore quarterly.
Store registrar, hosting and backup logins safely with two-factor login.
Review the plan whenever you change host, platform or developer.

Frequently asked questions

How often should a small business back up its website?: Most sites that collect bookings, leads or orders should back up daily, automatically. A simple brochure site that rarely changes can manage with weekly backups, as long as you also take a fresh backup before any edit or update. The right frequency depends on how much data you could afford to lose: with nightly backups, you could lose up to about a day of changes.
Does my web host back up my website automatically?: Many hosts do, but details vary widely. Some keep daily backups for 7 days, some longer, and some charge extra for daily backups on cheaper plans. Log in to your hosting panel, check the frequency and retention period, and confirm you can download a copy. Even with good host backups, keep at least one copy stored somewhere else that you control.
What is the 3-2-1 backup rule?: It is a widely used rule, recommended by CISA for small businesses: keep three copies of your data, on two different types of storage, with one copy off-site. For a website that might mean the live site, a host backup and a separate cloud copy. Many experts now add one offline or immutable copy to protect against ransomware that targets connected backups.
Where should I store website backups?: Store at least one copy away from your hosting provider, such as a separate cloud storage account you own, and protect it with a strong password and two-factor login. An encrypted offline drive adds another layer. Avoid keeping your only backup on the same server as the site, because a hack, failure or account problem could affect both at once.
How long should I keep website backups?: Keep enough history to go back before a problem started. CISA advises being able to roll back data at least seven days, but hacks can stay hidden longer, so many businesses keep daily backups for a few weeks plus weekly or monthly copies for several months. Longer retention costs a little more storage but gives far more options during a recovery.
Do I need to back up my business email?: Usually yes, separately. Email normally runs on a different service from the website, so a website backup will not restore deleted messages. Check what your email provider retains and for how long. For important mailboxes, use the provider's export tools or a dedicated backup service, and save your email DNS records so mail can be reconnected quickly after a change.
How do I restore my website from a backup?: Most hosting panels and backup tools offer a restore button for files and database. Choose a backup dated before the problem, restore to a staging copy first if possible, check pages and forms, then restore live. After a hack, also change all passwords and fix the cause, or the attacker may return. If you are unsure, get help before overwriting the live site.

Get a website + app built for free

We build your website and mobile app first, and you see it finished. If you’re happy, you pay $150 one-time. If you’re not, you pay nothing.

See the $150 offer Free website audit

← All articles