Website backups are the cheapest protection a small business can have. If your site breaks, is hacked, or your hosting account has a problem, a good backup means you can get going again. Here is what to back up, where to keep it and how to test it, based on advice from the National Cyber Security Centre (NCSC).
The short answer
- Back up everything your business needs to operate: your website, emails, invoices, documents, contacts and customer details (NCSC).
- Keep a copy somewhere separate from your website and your computer, such as online storage, or an external drive that is not left plugged in.
- Test a restore. A backup you have never tried to restore is only a hope.
What a website backup contains
A WordPress site has two parts: the files (theme, plugins and uploaded images) and the database (your pages, posts and settings). A proper backup has both. Ask your host exactly what its backups include.
Where to keep your copies
- Online storage such as iCloud, Google Drive or OneDrive works well if your internet connection is dependable (NCSC).
- An external drive is an option if it is not. Keep it somewhere secure and do not leave it plugged into your computer, because some viruses can spread to attached devices.
- Both gives extra safety if one is lost, stolen or fails.
- Turn on 2-step verification for your online backup accounts.
Your host’s backups are not always enough
Many hosts keep backups, which is useful. But if the hosting account is closed, locked or hacked, those backups may go with it. Keeping your own separate copy means you are never dependent on one company.
How often?
It depends on how often your site changes. A shop or blog that changes daily needs frequent backups. A brochure site that rarely changes needs fewer. Always take a fresh backup before you update plugins, change the design or move host.
A simple routine you can copy
- Before any update or change: take a backup.
- Each month: copy a full backup to your separate online storage or external drive.
- Every few months: try a restore on a test copy, and write down the steps.
- Whenever your login details change: update them in your records.
This routine is our suggestion. NCSC’s advice is to back up regularly and to test your restore.
When backups save you
NCSC says backups help if ransomware locks your files, a device is lost, stolen or breaks, or you move to a new device. For a website they also help after a hack or a plugin update that breaks the site.
Next steps
Check backups when you choose web hosting, and read about the types of hosting. Our website readiness checklist covers more of the basics.
On a self-hosted WordPress site, backups are your job (or your care plan’s). Weighing that up against a website builder? Read WordPress pros and cons.
Not sure whether your own site is backed up and kept safe? Our website health check reviews it and gives you a short, plain-English list of what to fix first.
Official sources
Security advice changes over time, so check the current NCSC guidance. General information, not a guarantee against data loss. Checked on 9 November 2026.
Want a hand with hosting or your website?
Get in touch and we will help, in plain English.