Backups should be stored in a separate, secure location from your live website, and most business websites should keep daily backups for at least 14 to 30 days, with longer monthly copies when the site supports sales, bookings, patient inquiries, or lead generation.
That answer matters because a backup is not just a technical safety net. It protects the traffic, calls, forms, appointments, and revenue your website creates. If your WordPress site breaks after a plugin update, gets hacked, loses form data, or has content deleted by mistake, the backup policy decides whether you recover in minutes, hours, or not at all.
For most small and mid-size businesses, backups should not live only on the same server as the website. If the server fails, gets infected, or the hosting account is locked, same-server backups can fail with it. A safer setup keeps copies offsite, such as secure cloud storage or a separate backup system controlled outside the main hosting environment. For higher-risk sites, we also like having more than one restore point, not only yesterday’s copy.
| Backup type | Where it should be stored | How long to keep it |
|---|---|---|
| Daily website backup | Offsite backup storage separate from the live server | 14 to 30 days for most business sites |
| Monthly backup | Separate cloud or backup archive | 3 to 12 months when the site changes often or supports leads |
| Pre-update backup | Backup system tied to maintenance workflow | Until the update is confirmed stable |
| Manual backup before major edits | Offsite or downloadable copy | Until the redesign, migration, or content change is approved |
Website backup storage should match how your site is used. A five-page lawn care site may be fine with 30 days of daily backups. A dental, healthcare, legal, pest control, or ecommerce site may need longer retention because lost forms, broken landing pages, or deleted service content can affect booked work and ad spend. If you run Google Ads or Meta ads to landing pages, losing one high-converting page can waste money quickly.
Good example: A pest control company keeps nightly offsite backups for 30 days, monthly backups for 6 months, and creates a manual backup before plugin updates or landing page changes.
Bad example: A law firm assumes its host “has backups,” but the only copy sits on the same server and the firm has never tested a restore. When a plugin conflict breaks the contact form, nobody knows which backup works.
Ask your host or agency these questions before you trust the backup setup:
- Are backups stored offsite, or only on the same server?
- How many days of backups are kept?
- Are files and the database both included?
- Can one page, one file, or one database table be restored, or only the whole site?
- How fast can the site be restored after a failed update, hack, or server issue?
- Are backups tested, or are they only created?
The database matters as much as the files. WordPress pages, posts, users, form entries, settings, and many plugin records live in the database. If your backup only copies theme files and uploads, you may still lose form submissions, landing page edits, or SEO changes. That is why a full backup should include website files, media uploads, themes, plugins, database tables, and configuration details.
Retention should also account for slow discoveries. A broken form may go unnoticed for a week. A hacked page may sit hidden from normal visitors until Google Search Console reports an issue. A deleted service page may not be noticed until rankings and calls drop. Keeping only one or two days of backups may not give you a clean restore point.
Recommended action: Check your current hosting panel this week. Find the backup section, confirm the latest restore point, check the retention window, and ask for proof that a restore has been tested. Also check GA4 and Google Search Console after any restore so you can spot lost tracking tags, indexing changes, or broken lead paths.
If your site brings in leads, bookings, or sales, backups should be part of hosting, not an afterthought. Our WordPress hosting work includes the backup, update, security, and recovery planning needed to keep a business website ready to recover when something breaks.
