A botched update, the compromised plugin, an accidentally deleted folder, ransomware or a botched migration: websites can go down at the most unexpected moments. At times like these, only one thing matters: do you have a recent, working backup from which you can restore your site in a matter of minutes?

In this guide, we summarise what you need to back up from a website, how often and where, when your hosting provider’s backup is sufficient and when you need to create your own, how to create a backup manually, via the hosting control panel and using a plugin, and how to check that you can actually restore from the backup.

Why does a website go down?

• Human error: accidental deletion, incorrect settings, a botched edit.
• Update: a plugin, theme or system update that breaks the site.
• Hack: the attacker modifies or encrypts files via an outdated plug-in.
• Hardware or service provider failure: a server breakdown, or a service provider that ceases trading overnight.
• Expired service: hosting suspended and subsequently cancelled due to an unpaid invoice.

What should you back up?

A dynamic website (such as WordPress) consists of two parts, and both need to be backed up:

• Files: the website’s code, templates, plugins and uploaded images and documents (typically in the public_html folder on cPanel hosting), as well as configuration files (wp-config.php, .htaccess).
• Database: posts, pages, users, settings, orders. A WordPress site without a database is empty.

If your email is also hosted on the server, you’ll need to perform a backup of your mailboxes as well. For a static website, it’s enough to back up the files.

The 3-2-1 rule

The tried-and-tested backup strategy:

• 3 copies of the data (the live copy and two backups),
• On two different storage locations (for example, the provider’s backup server and your own computer or cloud storage),
• One copy physically located elsewhere from the server.

There is one important point to add here: at least one backup should not be accessible from the website or the hosting account, as a ransomware virus or an attacker could delete or encrypt backups that are accessible on the server.

Video: 3‑2‑1 Backup Rule Explained: Protect Your Data from Disaster (IBM Technology)

Is a backup from your web hosting provider enough?

In most cases, yes, but not in all. On aWh’s hosting plans:

• On cPanel hosting plans, automatic JetBackup backups are created daily and stored in geographically separate locations, from which you can restore a file, a database, a mailbox or the entire account (like this),
• Daily backups are also taken of WordPress hosting accounts,
• Automatic backups are also included with the paid web hosting plans (but not with the free ‘Web Free’ plan),
• Daily backups are taken of KVM VPS servers, and you can also take snapshots.

The provider’s backup protects against hardware failure, most human errors and a hack. You should also have your own backup if:

• The provider’s backup retention period is shorter than the time it takes for a problem (such as a hidden infection) to come to light,
• something happens with the provider (payment issue, closure, account suspension),
• Before making a major change, you want to restore the system to exactly that state,
• as required by law or contract (for example, in the case of an online shop’s billing details).

Make sure you create your own backup at least once a month and before any major changes.

How often?

How often you perform a backup depends on how much data you can afford to lose:

Website	Frequency
An ‘About Us’ page that rarely changes	Weekly, and after every change
Blog, a regularly updated company website	Every day
Online shop, booking system, social media site	Daily, or even hourly from the database

Retention periods are just as important: an infection often only comes to light days or weeks later, so don’t just keep the most recent backup. A tried-and-tested approach is to keep daily backups for a week, weekly backups for a month and monthly backups for a year.

Creating a backup

In cPanel

• Full backup: under the ‘Backup’ menu, the ‘Download a Full Account Backup’ option creates a full account backup (files, databases, emails, settings), which you can download. This can also be restored to another cPanel hosting account. The steps are described in the article on full cPanel account backups.
• Partial backup: the home directory and individual databases can also be downloaded separately from the same location.
• JetBackup: you can browse through the daily automatic backups and restore your data to any point in time.

Manually

1. Files: In File Manager, compress your website folder (e.g. public_html) into a ZIP file and download it, or download it via FTP (or SFTP).
2. Database: in phpMyAdmin, select the database and click the ‘Export’ button to download it as an SQL file.

With a WordPress plugin

UpdraftPlus, BackWPup and Duplicator schedule backups of your files and database, and send the backups directly to external hosting (Google Drive, Dropbox, OneDrive, Amazon S3 or others). This means you have a backup even if something happens to your hosting provider. Our knowledge base article covers backup and restoration for WordPress, whilst our comparison of backup plugins shows which backup method can recover from which types of errors.

Taking a backup of a large website on shared hosting using a plugin can be resource-intensive; schedule it for a period of low traffic.

On a VPS

On a VPS, in addition to the provider’s daily backups and snapshots, it is worth backing up your files and database to another server or object storage, for example using rsync-kel, restic or borg. Our VPS backup guide covers this.

Where should I create a backup?

• The provider’s dedicated backup system: convenient and quick to restore, but tied to the provider.
• Cloud hosting (Google Drive, OneDrive, Dropbox, S3-compatible storage): affordable, independent of the hosting provider, and automatable.
• Your own computer or an external hard drive: simple, but easy to forget, and if that’s all you’ve got, a laptop theft or a hard drive failure will take that away too.

Backups contain personal data (users, orders, emails), so make sure you protect them: use a cloud account protected by a strong password, enable two-factor authentication, and do not store backups in a publicly accessible folder on your website.

Test the restore

The backup is only worth anything if you can actually restore from it. Try it out every few months:

• Restore the backup to a test environment (to a subdomain, a staging copy or your own machine),
• Check that the page loads, that the login works and that the latest content is available,
• Take a look to see how long it took, so you know what to expect in a real-life situation.

Restoration in an emergency

1. Don’t rush into anything: if you’ve been hacked, first find out when it happened, then choose a clean backup from before that time.
2. Make sure to save the current state as well, even if it is faulty: you may need it later (for example, to investigate a hack or to recover orders placed since the backup was taken).
3. Restore the files and the database to the same point in time.
4. After a breach, once you have restored your system, update everything immediately, change all passwords and close the vulnerability through which the attacker gained access; our guide on what to do after a breach covers this.

Summary

Back up your files and database, adjusting the frequency to match how often your website changes, covering several points in time, in accordance with the 3-2-1 rule, and keeping at least one copy separate from your hosting provider. Your provider’s daily backups are a good starting point, but you should also create your own backups monthly and before any major changes, and test the restore process from time to time.

Frequently Asked Questions

How often should I perform a backup?

A website that rarely changes should be backed up weekly and after every change; a blog daily; an online shop daily; and its database as frequently as every hour.

Is it enough just to have a web hosting provider for backup?

For most errors, yes, but it’s worth making your own backup, independent of the provider, every month and before any major changes.

Where should I take a backup of the website?

Back up your data to cloud storage or your own computer, ensuring that at least one copy is not stored on the website server.

How do I know if the backup was successful?

Check that the backup size is reasonable, and restore it to a test environment from time to time. Only a tested backup is reliable.

What is the difference between a file backup and a database backup?

The file backup includes the website’s code, templates and uploaded files, while the database backup includes the content and settings. For a WordPress site, you need both, taken at the same point in time.

How long should I keep my backups?

For at least several weeks, as an infection or error often only comes to light later. A good rule of thumb: daily backups for a week, weekly backups for a month, monthly backups for a year.

• backups
• website security
• wordpress
• guides
• for beginners