A website backup is a saved copy of everything that makes your site work: its database, files and settings, stored somewhere separate from the live site. The one thing that matters more than having a backup is knowing it actually restores. Follow the 3-2-1 rule, keep at least one offline copy, and test a restore before you need one for real.
TL;DR:
- Backup copies should include the database dump, media files, codebase, and environment settings to ensure a complete restore for WordPress or Drupal sites.
- Keeping at least three copies on two different media types with one offline prevents total data loss during hardware failures, attacks, or accidental deletions.
- Combining multiple backup methods, such as hosting snapshots, cloud backups, and manual exports, increases redundancy and aligns with the 3-2-1 rule.
- Regularly testing restore procedures in a development environment ensures backups are usable, with quarterly restores being a practical minimum.
- Outsourcing backup management through a managed hosting plan simplifies regular backups, monitoring, and restore processes for small businesses.
Table of Contents
- 1. What a full backup actually includes
- 2. Why backups matter: real threats to small business sites
- 3. Backup strategies that work: 3-2-1 and offline copies
- 4. Common backup methods: snapshots, cloud, plugins and manual exports
- 5. How often you should back up and for how long
- 6. How to restore a backup and test that it works
- 7. A practical backup checklist for small businesses
- 8. Why tested restores matter more than green dashboard ticks
- Letting a managed hosting plan carry the backup burden
- Where to check the official guidance yourself
- Sources
- FAQ
1. What a full backup actually includes
A backup that only covers half your site will let you down at the worst possible moment. For most dynamic websites, especially anything built on WordPress or Drupal, a working backup needs several distinct parts, not just a single file.
- Database dump: your posts, pages, products and settings all live here, usually as a
.sqlfile. - Uploads and media: images, PDFs and other files in your uploads or files directory.
- Codebase snapshot: your theme, plugins and custom code, ideally tagged in Git or archived as a full folder copy.
- Configuration and environment details: settings files, PHP version, database version and any environment variables the site depends on.
Official Drupal instructions recommend exporting the database and keeping a codebase snapshot together, because restoring one without the other rarely produces a working site. A backup missing your uploads folder or your configuration files might look complete in a dashboard while being unusable in practice.
2. Why backups matter: real threats to small business sites
Backups protect you against far more than a single disaster scenario. Ransomware is one obvious threat, and it often specifically targets any backup it can reach: if your backup sits on a connected drive or synced folder, an attacker or a piece of malware can encrypt that too. Keeping at least one copy separate from your live environment reduces that risk considerably, which is why the NCSC’s guidance on backing up critical data treats independence between copies as a requirement, not a nice-to-have.
Beyond attacks, the everyday failures are just as damaging: an accidental deletion, a plugin update that breaks the site, or a hosting server that fails outright.
A synced cloud folder is not a backup. Files that automatically mirror across devices will carry corruption, accidental deletions or ransomware straight into every copy, leaving you without a clean version to recover.
For a small business, any of these events can mean lost orders, hours of downtime and customers who assume your site has closed for good.
3. Backup strategies that work: 3-2-1 and offline copies
The most widely recommended approach is the 3-2-1 rule: keep three copies of your data, on two different types of storage, with one copy off-site. It works because no single failure, whether that is a hard drive dying, a server room fire or a ransomware attack, can reach every copy at once.
The NCSC’s blog on offline backups adds an important refinement: at least one of those copies should be offline or logically separated, with limited authorised clients and protected credentials, so malware that compromises your live site cannot also overwrite your backup.
- Three copies, two media types, one off-site: the baseline every small business should meet.
- One offline or access-restricted copy: the part that stops ransomware spreading into your backups.
- Extra retention or separation: worth adding once your site handles payments, bookings or sensitive customer data.
More separation between copies means better resilience, but it also means more to manage. A single freelance site owner might manage this with two cloud accounts and a monthly download; a business handling transactions daily may need a dedicated offline archive and a documented recovery process.
4. Common backup methods: snapshots, cloud, plugins and manual exports
Most small businesses combine more than one of these methods rather than relying on a single mechanism, and that layering is deliberate rather than excessive.
- Hosting snapshots: fast to set up because your host manages them, but check how long copies are retained and whether they count as a genuinely separate copy under the 3-2-1 rule.
- Cloud backups: convenient and usually automated, though the NCSC is clear that convenience is not the same as recoverability. Secure the account with multi-factor authentication and limit which devices or apps can access it.
- CMS plugins: WordPress and Drupal both support backup plugins that are easy for non-developers to set up, though many retain only a limited number of versions and can miss server-level configuration. A curated list of Drupal backup plugins is a useful starting point if you are choosing between options.
- Manual or command-line exports: tools like
drush sql:dumpormysqldump, paired with atararchive of files, give developers a reproducible, fully documented backup. Drupal’s own backup documentation demonstrates exactly this workflow.
None of these methods is sufficient by itself. A hosting snapshot that lives on the same server as your live site fails the moment that server does, and a plugin backup stored only in the plugin’s own dashboard is one bad update away from being unreachable. Layering at least two of these methods, with one stored somewhere genuinely independent, is what actually delivers on the 3-2-1 principle rather than just ticking a box.
5. How often you should back up and for how long
How often you back up should depend on how much data you can afford to lose, not on a fixed schedule copied from another business. If your site takes orders or bookings, losing a day’s data could mean losing real revenue, so daily backups make sense. A brochure site that rarely changes might only need weekly backups.
A sensible starting retention policy keeps daily backups for several days, weekly backups for several weeks, and monthly backups for longer periods, giving you options if a problem is not spotted immediately. Check your host’s or plugin’s retention settings directly, since some quietly delete older backups sooner than you would expect, and confirm you actually retain access to restore them.
- Match frequency to acceptable loss: daily for transactional sites, weekly for static ones.
- Keep layered retention: recent daily copies, a month of weekly copies, and older monthly copies.
- Never rely on a single rolling backup that overwrites itself with no history behind it.
6. How to restore a backup and test that it works
A backup only proves its worth when you can restore it, and the only way to know that is to practise the process before you need it. Drupal’s official guidance is explicit that restores should be tested in a development environment, since the process overwrites your existing database.
- Prepare a clean environment, whether that is a staging site or a local install, matching your live PHP and database versions.
- Restore the codebase first, including themes, plugins and any custom code.
- Import the database dump into the new environment.
- Restore uploaded files and media to their correct paths.
- Check configuration files, such as
settings.php, and confirm file permissions are correct. - Load the site, test key pages and forms, and confirm nothing is missing.
Once restored, run a short smoke test: check the homepage, a product or contact page, and any form that submits data. Record what worked and what did not, and fix any gap in your backup process immediately rather than at the next crisis.
Before any major update, create a manual restore point and write down the exact rollback steps. Scheduled monthly website updates are a natural moment to build this habit in, since you are already touching the site.
7. A practical backup checklist for small businesses
Getting backups right does not require a technical background, just a short list followed consistently.
- List everything that needs backing up: database, uploads, code and configuration, and note exactly where each one lives.
- Automate scheduled backups so you are not relying on memory, and confirm at least one copy lands somewhere off-site.
- Restrict and protect backup access, using multi-factor authentication and limiting how many people or apps can reach your backup storage.
- Test a restore every few months and keep a written record of what you did and how long it took.
Pro Tip: Set a recurring reminder to test one restore every quarter, even a quick one; it takes an hour and it is the only way to know your backups actually work.
If this list feels like one more job competing for your time, a pay-monthly hosting and maintenance plan can take the operational load off your hands entirely, which is worth weighing against the hours a DIY approach demands, as covered in our comparison of DIY and professional websites.
8. Why tested restores matter more than green dashboard ticks
A backup dashboard showing a green tick tells you a job ran, not that your site would actually come back if you needed it to. In practice, plenty of “backups” turn out to be missing uploads, configuration files or a matching codebase version, and you only discover that gap during a real emergency.
My advice is to start simple: automate one reliable backup method, add a second independent copy, and keep at least one of them offline. Test a full restore once a quarter rather than trusting notifications. For non-technical owners, handing this over to a managed service is often the more realistic choice than maintaining the discipline alone.
— Mark Jones
Letting a managed hosting plan carry the backup burden
If backups feel like one more technical job on a growing list, No Worry Websites’ hosting and maintenance plans are built to take that off your plate entirely. Pay-monthly website plans typically include a domain, SSL certificate, and green hosting, along with monthly changes managed by support staff rather than left to clients.
A managed plan typically covers:
- Scheduled backups run and monitored on your behalf, rather than left to a plugin you have to check yourself.
- Direct access to the person managing your site if you ever need a restore explained or actioned.
- Ongoing monthly updates handled for you, reducing the number of moments where something could break unexpectedly.
Compare the available options on the pay-monthly website plans page and see which fits a business your size.
Where to check the official guidance yourself
For the technical detail behind this advice, the NCSC’s small organisations guide to backing up data and your CMS’s own backup documentation are the most reliable places to start. Always follow your platform vendor’s specific restore instructions.
Sources
FAQ
What is the 3/2/1 rule for backing up?
The 3-2-1 rule means keeping three copies of your data, stored on two different types of media, with at least one copy kept off-site. It is recommended by the NCSC because it protects against hardware failure, theft, fire and ransomware all at once, rather than any single point of failure.
What are the three main types of backups?
For websites, the main categories are hosting snapshots, cloud or plugin-based backups, and manual command-line exports. Each has different strengths, and combining at least two, with one stored independently from your live server, gives you far better protection than relying on just one.
What is a disadvantage of an off-site backup?
An off-site backup can be slower to access in an emergency, particularly if it needs downloading before a restore can begin, and it depends on your provider’s own security and retention policies. The NCSC notes that convenience does not guarantee recoverability, so it is worth confirming exactly how restore access works before you need it.
How can I restore my website from a backup?
Restoring involves preparing a clean environment, reinstating your codebase, importing your database, restoring uploaded files, and checking configuration settings before testing the site fully. Drupal’s official documentation recommends testing this process in a development environment first, since a real restore overwrites your live database.
