How Often Should You Back Up a Website?

Imagine opening your website one morning to find it broken — a bad update, a hack, or a hosting failure wiped out weeks of work. Now imagine the fix takes five minutes: you restore yesterday's backup and carry on. The difference between those two mornings is one thing: a backup schedule that matches how often your site actually changes.

There's no single magic number, but there is a simple rule. This guide gives you a practical frequency for your type of site, explains what a complete backup must include, and covers the 3-2-1 rule and restore testing — the two things most site owners skip.

The Short Answer: Match Backups to How Often Your Site Changes

The right backup schedule answers one question: how much work could you afford to redo if you lost everything since the last backup?

• If losing a day of orders would hurt, back up daily (or more).
• If losing a week of blog posts would sting, back up weekly.
• If your site barely changes, monthly may be fine.

Quick-reference frequency table

These are starting points, not laws. The sections below help you fine-tune.

Recommended Backup Frequency by Website Type

Ecommerce and membership sites — daily to real-time

Every order, sign-up, and payment lives in your database. Losing a day of transactions means lost revenue and angry customers asking where their orders went. Daily backups are the minimum here; high-volume stores should use hourly or real-time backups so every transaction is captured. If your host or backup plugin offers real-time backup (Jetpack VaultPress is one well-known example), it's worth considering for a store.

Business sites and active blogs — daily

If you publish content, receive enquiries, or take bookings most days, daily backups protect that steady stream of work. A day's worth of lost enquiries is recoverable; a month's worth usually isn't. Most managed hosts include daily backups — check what yours actually offers before assuming you're covered.

Personal blogs and portfolios — weekly

If you post occasionally and nothing mission-critical changes day to day, weekly backups strike a good balance. You'll never lose more than a week's work, and the storage cost stays low.

Static brochure sites — weekly to monthly

A five-page site that changes twice a year doesn't need daily backups. Weekly is comfortable; monthly is acceptable if truly nothing changes. But still back up — "rarely changes" is not "never breaks."

What Counts as "a Change" Worth Backing Up?

Not all changes are equal. Understanding the two halves of your site helps you set the right schedule:

• Files — pages, images, themes, plugins, code. These change rarely on most sites. Weekly is usually fine for files alone.
• Database — posts, products, prices, orders, comments, user accounts, settings. This changes constantly on active sites and deserves the more frequent schedule.

This is why a store needs daily (or real-time) backups even though its design never changes: the database is where the money lives. Some site owners back up the database daily and files weekly — a reasonable split if storage is tight.

Always Back Up Before These Events (Regardless of Schedule)

Automated schedules handle the routine. But take a manual backup immediately before any high-risk operation, no matter when the last automated one ran:

• Plugin, theme, or core updates — the #1 cause of "it was working five minutes ago"
• Design changes or theme switches
• Migrating to a new host or server
• Bulk content imports, database edits, or staging-to-production pushes

Think of it as a restore point for the exact moment something is most likely to break. It takes two minutes and has saved countless weekends.

What a Complete Backup Must Include

A backup that only covers half your site is a nasty surprise waiting to happen. A complete website backup has two parts:

1. All files — WordPress core, themes, plugins, uploads (images, documents), and any custom code.
2. The full database — every post, page, product, order, user, comment, and setting.

Restore files without the database and you get an empty shell. Restore the database without files and you get content with no design. Both, every time — verify your backup solution covers both before you trust it.

The 3-2-1 Rule: Where to Keep Your Backups

Frequency means nothing if all your copies die together. The widely recommended 3-2-1 rule (endorsed by the U.S. Computer Emergency Readiness Team, among others) is simple:

• 3 copies of your data — your live site plus two backups
• 2 different storage types — e.g., your computer and cloud storage
• 1 copy offsite — somewhere other than your hosting server

Why offsite matters: a backup stored on the same server as your site protects you from mistakes (a bad update, a deleted page) but not from server problems. If the server dies, or the hosting account is suspended over a failed payment, a same-server backup dies with it. At least one copy must live somewhere else — cloud storage like Google Drive, Dropbox, Amazon S3, or Backblaze B2 are common choices.

How Long to Keep Backups (Retention)

One backup is better than none, but a single copy has a blind spot: problems you notice late. A hack or corruption discovered three weeks after it happened can't be fixed with yesterday's backup — you need a copy from before the problem started.

A sensible starting point: keep 30 days of backup history rather than a single rolling copy. That gives you room to roll back past anything you notice within a month. Adjust based on your storage budget and how quickly you'd realistically spot trouble.

Test Your Backups (An Untested Backup Is a Hope, Not a Plan)

Here's the uncomfortable truth: plenty of site owners discover their backups are broken at the exact moment they need them. Corrupted archives, incomplete database dumps, backups that "succeeded" but restore nothing.

Test monthly. Restore a backup into a staging environment (never over your live site) and check:

• Does the restore complete without errors?
• Is the content complete — posts, images, products all present?
• Does the site actually load and function?

A backup you've never restored is a theory. A backup you've restored is a fact.

Automate It — Don't Rely on Memory

Manual backups fail the same way diets fail: good intentions, poor follow-through. Automate:

• Hosting-level backups — many managed hosts include daily backups with one-click restore. Convenient, but check the details: how often, how long they're kept, and whether you can trigger a restore yourself.
• Plugin backups — tools like UpdraftPlus or Jetpack can schedule backups and push them to cloud storage automatically.

And critically: check your host's backup policy before you need it. How often do they back up? What's the retention period? Is restore self-service or does it require a support ticket? Is there a fee? Don't discover the answers during an emergency — this is worth verifying when you're choosing a hosting plan.

Frequently Asked Questions

Is my host's automatic backup enough, or do I need my own too?

It depends on the host's policy — frequency, retention, and whether you control restores. Even with good host backups, keeping your own offsite copy (the 3-2-1 rule) protects you if the hosting account itself becomes unavailable. Two independent backup systems beat one.

What's the difference between a backup and a restore point?

They're closely related: a backup is the stored copy of your data, and a restore point is a backup tied to a specific moment you can roll back to — typically taken right before a risky change. Think of backups as the routine safety net and restore points as deliberate "save points" before doing something dangerous.

Do I need backups if my site is on WordPress.com or Shopify?

Yes. Hosted platforms offer some protection, but it's not foolproof — plugin conflicts, accidental deletions, and account issues can still lose data. Your own backup is an extra layer that you control.

How much storage do backups need?

A typical small business site backup is tens to a few hundred megabytes. Ecommerce sites with many product images can reach gigabytes. Incremental backups (only changed data since the last backup) keep ongoing storage growth manageable — most modern backup tools use them.

Can backups protect against malware?

Yes — with a catch. If your site is infected, restore a backup from before the infection, then fix the vulnerability that let the attacker in. Restoring without fixing the entry point just gets you hacked again. And scan the backup first if possible; a backup taken after infection may contain the malware.

What if I can't afford to lose even an hour of data?

Then you need real-time or near-real-time backups — available through premium backup plugins or managed hosting plans aimed at ecommerce. It's more expensive than daily backups, but for a high-volume store, the cost of an hour of lost orders usually dwarfs the backup cost.

Not sure your current host backs up often enough? Read our guide to choosing a hosting plan and check what backup features to look for — frequency, retention, and restore access — before you commit.