Why a website backup needs to be separate from the live site
A copy stored inside the same hosting account as your website can be useful for everyday mistakes, but it should not be your only recovery option. A serious hosting failure, compromised account or destructive attack can affect both the production site and copies that are reachable through the same environment.
The National Cyber Security Centre advises organisations to make regular backups, keep independent copies and know how to restore them. Its ransomware guidance also warns that attackers may deliberately target backup infrastructure to make recovery harder.
That is why our care plans use daily off-server backups. The backup is kept away from the live web server rather than depending entirely on the same installation that might need recovering.
What a complete WordPress backup should contain
A WordPress website has two major parts: its files and its database. You normally need both for a complete recovery.
The files include WordPress itself, plugins, themes, uploaded images and documents, configuration files and other code stored on the server. The database contains content and settings such as pages, posts and much of the information created or configured through WordPress.
WordPress's own documentation makes an important distinction here: copying the website directory does not normally copy the database because the database is stored separately. A backup process that captures only one half can therefore leave you without everything required to reconstruct the site.
For ecommerce and frequently updated websites, the age of the restore point matters as well. A very old copy may bring the site back online but lose recent content, orders or configuration changes. Backup frequency should reflect how much recent data the organisation could reasonably afford to lose.
Website backup retention and restore testing
We keep 30 days of restore points with the website backup service supplied through our care plans. That gives a choice of previous versions rather than relying on one copy that could already contain a problem discovered later.
Version history matters during security incidents. Malware can remain unnoticed before somebody spots the visible symptom, which means the newest backup is not automatically the safest backup. The NCSC recommends backup systems that allow restoration from an earlier version even where later versions have become corrupted.
Restore testing matters for a different reason. A successful backup job tells you that data was copied. It does not, by itself, prove that the copy contains everything needed for recovery. Testing a restore checks the part that matters when the website is unavailable: whether usable files and data can actually be put back.
What happens when a website needs restoring
A restore should start with identifying the right recovery point rather than automatically selecting the latest copy. If the problem is a bad update or accidental deletion, that may be straightforward. If malware is involved, the compromise date may be earlier than the date it was discovered.
The recovered website then needs checking. Pages loading successfully is only the first test. Important functions such as navigation, forms, logins and ecommerce features should also be checked where they exist, together with configuration that may depend on the hosting environment.
For WordPress, files and database content have to correspond correctly. WordPress guidance describes them as a backup set and recommends backing up both. If database credentials or the server environment change during recovery or migration, configuration may also need updating.
If the problem involves a compromised site rather than simple data loss, see WordPress malware removal before restoring an unidentified backup over the live installation.
Website backups included with our care plans
Daily off-server backups are included with Essential Care from £59 a month. Essential Care also includes weekly WordPress core, plugin and theme updates, uptime monitoring, security scanning and hardening, a monthly health report and next-business-day email support.
Professional Care and Premium Care include the Essential Care backup provision alongside their additional support and development allowances. You can compare the plans on our website support pricing page.
If your main concern is moving away from an unsuitable hosting provider rather than maintaining routine restore points, see website migration.