“Don’t worry, our host already takes backups.”
That’s the line we hear most often when we ask a new client about their backups. And it’s true — just true enough to be dangerous, which in security terms is the worst kind of true.
Your host probably does back things up. The problem is what those backups are actually for.
Your host’s backups protect your host, not you
This is the key thing to understand. The backups your provider runs exist so they can recover their own infrastructure if a disk fails or a server goes down. The fact that those same backups might also help you recover your website is a side effect, not the point.
And that has some very concrete consequences.
1. They’re usually stored on the same server
This is the most serious flaw, and the most common one. If the backup lives on the same machine as the website, anything that takes down the server takes down the backup with it. Ransomware that encrypts the server encrypts the backups too. A compromised account gives access to both.
A backup that dies along with the original isn’t a backup. It’s just a folder.
2. Retention is short
Seven days is typical, sometimes 30. That sounds like plenty — until the classic scenario happens: you get hacked and don’t notice for three weeks.
By the time you go to restore, every available backup already contains the malicious code. You restore the problem right along with it.
3. Restoring is all-or-nothing
Most hosting panels only let you roll the entire account back to an earlier point. Need to recover just one file, or just the database, or just a page you accidentally deleted? Too bad — you restore everything and lose everything else in between.
If you run a store, that means losing every order placed in the meantime.
4. Sometimes it costs extra, and you find out at the worst possible moment
Several providers include backups but charge to restore them. Others only offer them as a paid add-on. It’s the kind of detail nobody checks when signing up, and it surfaces exactly when stress is highest.
5. Nobody checks that they actually work
This is the hardest one to believe until it happens to you. A backup that’s never been tested isn’t a backup — it’s an assumption.
Some backups have been silently failing for months. Others save the files but not the database, or the other way around. You only find out the day you actually need it.
What a real backup needs to have
Keeping it simple, here’s the reasonable minimum for a small business:
- Off the server. Stored elsewhere, with a different provider. If the house catches fire, the extinguisher can’t be inside it
- Automatic and frequent. Daily at minimum — more often if you run a store taking orders
- With enough retention. At least 30 days, so you can go back further than the moment you noticed the problem
- Complete. Files and database. One without the other is useless
- Encrypted. It holds your customers’ data
- Selectively restorable. You should be able to recover only what you need
- Tested. Check every so often that restoring actually works
The five-minute test you can run today
You don’t have to take our word for it. Log into your hosting panel and find the backups section. Answer these four questions:
- How old is the oldest available backup?
- Where is it stored — on this server, or somewhere else?
- Does it include the database, or just files?
- Can you restore just part of it, or is it all-or-nothing?
If any of those answers made you uneasy, you already know where to start.
And if you can’t find anything
It happens more often than you’d think. Plenty of businesses discover at this exact moment that they’ve gone years without a real backup of their site.
The fix doesn’t have to be expensive. There are free plugins that back up to external storage, and setting one up properly takes about half an hour. What matters isn’t the tool — it’s making sure the points above are actually covered, and that someone checks on it now and then.
If you’d rather not deal with this yourself, it’s one of the things we handle for our WordPress maintenance clients: daily, encrypted, off-server backups. But even if you don’t work with us, check this today. It’s one of the few things that, on the day you actually need it, leaves no room for improvising.
Prefer to have us take care of it? Get in touch with our team and tell us what your website needs — we’ll get back to you within 24 hours.
Want to apply this in your business? See how we do it in WordPress maintenance and security (WP Shield), or tell us about your case and we will reply within 24-48 working hours.