Website Backup Services: What "Backed Up" Should Mean

"We have backups" is one of the least verified claims in web hosting, and website backup services vary enormously in what they capture, where they store it, and whether anyone has ever restored one. The definition that should anchor every conversation: a backup is a copy you have successfully restored at least once. Until the restore has happened, you have a file that might be a backup.

This guide sets the standard a real arrangement meets: what gets copied, how often, where the copies live, what it costs, and the quarterly test that turns the whole thing from paperwork into protection.

What should website backup services actually include?

Six things. Automated daily backups, because manual backups stop happening within a month of setup. Both the files and the database, since a site needs both to exist and plenty of "backups" capture only one. At least 30 days of retention. An offsite copy held somewhere other than the hosting account. A documented restore procedure with a known time-to-recover. And failure alerts, because backup jobs die quietly: a cron stops, storage fills up, credentials expire, and nobody notices for months.

That last item filters providers fast. Ask any backup service one question: how do you find out when a backup fails? A real operation has a specific answer. A box-ticking one describes the schedule instead.

How often should backups run?

Match the frequency to how fast the site changes. A brochure site edited a few times a year survives on weekly backups, though daily costs nearly nothing and removes the judgment call. A site with a blog, forms, and lead data should back up daily. An online store should back up its database hourly, because every backup gap is an order gap.

Retention is the underrated number. Thirty days minimum, because compromises and corruption are often discovered late. With 7 days of history, a hack found in week three means every retained copy already includes the attacker's files, and your backup service has faithfully preserved the problem.

The restore test: the step everyone skips

Once a quarter, take a recent backup and restore it into a staging environment. Confirm the site loads, the database connects, and the content is current. Time the whole exercise.

This one habit catches nearly every backup failure mode before it matters: the job that silently stopped in March, the archive that captures files but not the database, the export that cannot actually be imported, the restore that takes two days when you assumed two hours. That last number is the one that matters most, because when you finally need a restore, the site is down and every hour has a price. Teams that test quarterly restore calmly. Teams that never tested learn their real recovery time during the outage.

Where should backup copies live?

Follow the 3-2-1 rule: three copies of your data, on two different kinds of storage, with one copy offsite. For a website that translates simply: the live site, a backup at the host, and a backup somewhere entirely separate, a cloud storage bucket or a backup vendor's infrastructure.

The rule exists because failures cluster. A backup folder on the same server dies with the server, and attackers who gain access routinely delete or encrypt the backups they find, a pattern ransomware guidance has warned about for years. Same logic, smaller scale: a billing dispute that suspends your hosting account suspends your host-side backups with it. One copy must sit where neither your server nor your hosting relationship can reach it.

What do website backup services cost?

Standalone backup tools and plugins with offsite storage: $2 to $10 a month. Host-provided backup add-ons: $2 to $5 a month, with the caveats from the next section. Backup handling inside a general care plan: included in typical $50 to $150 monthly maintenance plans, which is how most small businesses sensibly buy it, since backups alone rarely justify a separate vendor relationship.

The price differences here are trivial against the stakes. What separates arrangements is not the $8 a month but whether retention is 30 days, whether a copy is offsite, and whether anyone tests restores. Wider budget context sits in our maintenance cost guide.

Are host backups enough on their own?

As one layer, they are good: convenient, integrated, often free. As the only layer, they concentrate risk in exactly the place you already carry it. The host's backups live with the host, so a server failure, an account suspension, a billing dispute, or a compromise of your hosting credentials can take the site and its safety net down together.

There are operational caveats too. Host restores often work all-or-nothing, rolling back the entire account when you needed one site or one table. Retention is commonly 7 days or less unless you pay attention. The honest verdict: host backups make an excellent second copy and a poor only copy. Keep one copy you control, outside the account.

How WebsiteOS handles backups

Daily automated backups with an offsite copy, 30-day retention, and a quarterly restore test with the result written down. The completed runs and checks land in the same task log as every other piece of work on the site, so "we have backups" is a claim you can verify by scrolling rather than a line in a sales page. It is included in the flat monthly price, not sold as an add-on.

Backups are one workstream of four in a sound security posture, alongside patching, monitoring, and access control. How the other three work, and the schedule that keeps all four honest, is covered in our security maintenance guide.