Nobody calls us excited about backups. In the last 90 days we've built 1,500+ small business sites, and not one owner has ever opened the conversation with "tell me about your backup strategy." They open with design, with leads, with Google rankings. Backups come up exactly once: after something breaks.
That's the problem with backups. They're insurance. And like all insurance, the people who need it most are the ones who found out the hard way that they didn't have it.
This post is the conversation I wish more owners had before the bad day. What actually goes wrong, what a real backup setup looks like, and the specific questions to ask whoever hosts your site. You can act on all of it without hiring anyone.
What actually destroys websites
When owners imagine losing their site, they picture something dramatic. A hacker in a hoodie. A server room on fire. The reality is more boring and a lot more common.
Somebody updates something
This is the number one cause, by a mile, on sites that run WordPress or similar software. A plugin update conflicts with the theme. A PHP version upgrade breaks an old plugin. An auto-update runs overnight and the site is a white screen by morning. Nobody did anything malicious. Software just moved, and your site didn't move with it.
Somebody deletes something
The second most common cause is human, and it's usually friendly fire. An employee editing a page deletes a section and saves. An owner cleaning up "old files" in the hosting control panel removes a folder the site needed. A well-meaning nephew "fixes" the menu and three pages vanish. Without a backup, the only way back is rebuilding from memory.
The site gets compromised
Hacks on small business sites are almost never targeted. Bots scan the internet for sites running outdated software with known holes, and they break in automatically. Once in, they inject spam links, redirect your visitors to sketchy pharmacies, or quietly host phishing pages under your domain. Google notices, flags your site, and your search traffic falls off a cliff. Cleaning a hacked site without a clean backup is slow, expensive, and you're never fully sure you got it all.
The host has a bad day
Hosting companies lose data. Not often, but it happens: hardware failures, botched migrations, billing mistakes that delete accounts, and occasionally a company simply going out of business. The fine print on most cheap hosting plans makes it clear that backups are your responsibility, not theirs. Owners read that line for the first time after the data is gone.
The relationship ends badly
This one stings because it's preventable. A web designer disappears, a freelancer stops answering emails, an agency relationship goes sour, and it turns out the only copy of the site lived in their account. We wrote about this pattern in our piece on website contract red flags, and "who holds the backups" belongs on that list. If you can't get a copy of your own site today, you don't own a website. You rent one from a person.
What a real backup setup looks like
A real backup setup is not "the host probably does something." It has four properties, and missing any one of them turns your insurance policy into a piece of paper.
Automatic
If a backup depends on a human remembering to run it, it will not exist when you need it. The last manual backup is always from eight months ago, taken right after launch, missing every page, photo, and review you've added since. Backups must run on a schedule with no one touching them.
Frequent enough to match your site
How often should backups run? Ask yourself one question: how much work are you willing to lose? If you update your site quarterly, weekly backups mean you'd lose at most a week of changes, which is probably fine. If your site takes orders or bookings every day, you want daily backups at minimum, because losing a day means losing customer data, not just a paragraph of text.
Stored somewhere else
A backup that lives on the same server as the website is not a backup. It's a copy that dies in the same fire. If the server fails, gets compromised, or the hosting account is closed, the backup goes with it. Real backups are stored off-site, on different infrastructure, ideally with a copy you can download yourself and keep wherever you want.
Actually tested
Here's the uncomfortable one. An untested backup is a hope, not a plan. Backup files get corrupted. Backup jobs silently fail for months. Restore processes turn out to be broken exactly once: the first time you need them. A real setup includes restoring the backup somewhere, at least occasionally, to prove the process works end to end. If your host or web company has never once demonstrated a restore, you're trusting a parachute nobody has ever pulled.
Keep more than one
One more property worth having: history. A single rolling backup that overwrites itself nightly has a nasty failure mode. If your site gets hacked on Tuesday and you don't notice until Friday, every backup you have contains the hack. Good setups keep multiple restore points going back weeks, so you can roll back to before the problem started, not just to last night.
The questions to ask your host
You don't need to become a systems administrator. You need ten minutes and five questions. Email them to your host or web company today and keep the answers.
- "Are backups of my site running automatically, and how often?" Vague answers like "we have backup systems" don't count. You want a schedule: nightly, weekly, whatever it is, in writing.
- "Where are the backups stored?" The answer you want is "separate from your hosting server." The answer you don't want is silence, or "on the server."
- "How far back can I restore?" One night? Seven days? Thirty? Remember the hacked-on-Tuesday problem. More history is better.
- "How do I get a full copy of my own site, today?" This is the ownership test. A good provider can hand you your files and content without drama. If the answer involves friction, fees, or excuses, that tells you everything.
- "If my site went down right now, how long until it's restored, and who does it?" You're listening for a process, not a promise. "Open a ticket and we'll see" means you're on your own on a Saturday. Downtime is not an abstract risk; we walked through what an outage actually costs a service business in what a down website costs you.
One bonus question if your site runs on a platform like WordPress: "Who is responsible for software updates?" Because as we covered above, failed updates are the top reason restores happen in the first place. If the answer is "you are" and you didn't know that, your risk just changed.
What this costs, honestly
Here's the good news: backups are cheap. This is not a place where doing it right requires real money.
- If you're on a website builder (Wix, Squarespace, and similar), the platform handles infrastructure backups, though your ability to restore old versions of your own content varies. Know what your plan includes.
- If you're on WordPress with cheap hosting, a reputable backup plugin with off-site storage runs free to around $100 per year. That's the whole cost of not losing your site.
- If someone manages your site for you, backups should be included, full stop. A maintenance plan that doesn't include automatic, off-site, restorable backups isn't a maintenance plan. We broke down what that monthly fee should cover in what website maintenance actually costs.
Compare any of those numbers to rebuilding a site from scratch, losing your search rankings while the site is down or compromised, and the leads that called a competitor in the meantime. The U.S. Small Business Administration's guidance on cybersecurity for small businesses puts data backup on the same shelf as locking your doors at night, and that's the right way to think about it. Boring, cheap, and non-negotiable.
Google's own engineers make a related point about resilience in their web.dev guidance: a reliable site isn't one where nothing ever goes wrong, it's one that recovers fast when something does. For a small business, backups are most of what "recovers fast" means.
The 15-minute version
If you do nothing else after reading this, do these three things this week:
- Send the five questions above to your host or web company. Their answers go in a folder you can find later.
- Download one full copy of your site right now, however your platform allows, and store it in your own cloud storage. Even a stale copy beats nothing.
- Put a quarterly reminder on your calendar to confirm backups are still running. Backup jobs fail silently. A two-minute check four times a year catches it.
That's it. No new software to learn, no monthly chore. Just the difference between a bad morning and a lost month.
Want a site where this is just handled?
We build done-with-you websites live on a call with you: first draft in 24 hours, live in 7 days, guaranteed. Backups, hosting, and updates are part of the package, not a checklist you have to manage, and quarterly content refreshes are included from $100/mo. Tiers start at $500, with pay-in-4 and Klarna available. We're veteran-owned, based in Wilmington NC, and we've built 1,500+ small business sites in the last 90 days.
Book a call or see pricing. And if you keep the site you have, at least send your host those five questions. That part's free.