A web hosting backup is an automated copy of your website's files and database, kept away from your live server. Good hosts take these copies daily and hold onto several versions, so you can roll back to a point before something broke. Without one, a single hack, a bad plugin update, or a server failure can wipe out years of work in seconds.
What is a web hosting backup, exactly?
A web hosting backup is a snapshot of your entire site, taken at a specific point in time and stored somewhere your live server can't touch. That snapshot includes your files (images, themes, code) and your database (posts, orders, user accounts). If disaster hits, you restore from that snapshot instead of starting from scratch.
I've had clients call in a panic after a plugin update took down their store mid-Black-Friday. The fix wasn't clever debugging, it was rolling back to the backup from that morning. That's the entire point of a backup: it turns a catastrophe into a twenty-minute inconvenience.
- File backups cover your themes, plugins, uploads and core code
- Database backups cover content, orders, comments and settings
- Full backups combine both into one restorable package
How often should my host back up my site?
For most sites, daily backups are the minimum acceptable standard. If you run an e-commerce store or push frequent content updates, you want more frequent backups, or a host that lets you trigger an on-demand snapshot before you make changes.
A blog publishing weekly can survive on daily backups without much anxiety. A shop taking orders around the clock cannot. Losing even a few hours of order data means refunding customers or re-entering transactions by hand, and neither is fun to explain to a client.
When comparing plans in our hosting directory, check the backup frequency listed for each provider rather than assuming. Some budget hosts back up weekly and call it a feature. That's not good enough for anything commercial.
What's the difference between full and incremental backups?
A full backup copies everything every time it runs. An incremental backup only copies what changed since the last one. Incremental backups are faster to create and use less storage, which is why most modern hosts default to them.
Think of it like photographing a room. A full backup photographs the whole room each time. An incremental backup only photographs what moved since the last photo. Both let you reconstruct the room, but incremental backups do it with far less effort and storage space.
The trade-off shows up at restore time. Restoring from a full backup is a single step. Restoring from incrementals means the system has to stitch multiple snapshots back together, which can drag on a slow VPS (a virtual private server). Ask your host how restores actually work before you need one urgently.
Do all hosting plans include backups?
No, and this trips up more site owners than any other hosting decision. Plenty of budget shared hosting plans either skip backups entirely or offer them as a paid add-on you have to remember to switch on.
I've reviewed hundreds of hosting terms pages for HostList, and the pattern is consistent: entry-level plans quietly exclude backups, while mid-tier and business plans include them by default. Read the fine print before you sign up, not after your site goes down.
This matters even more for WordPress sites, since WordPress now powers a substantial share of the web according to wordpress.org's own statistics, which makes it a constant target for automated attacks. Our WordPress hosting picks only include providers with backups built into the plan, not bolted on as an upsell.
- Shared hosting: backups often missing or paid extra on entry plans
- Managed WordPress hosting: daily backups almost always included
- VPS and dedicated servers: usually your responsibility to configure
How do I restore my website from a backup?
Most hosts let you restore through the control panel with a few clicks: pick a date, confirm the rollback, done. It usually takes minutes rather than hours, provided the host has decent infrastructure behind it.
Before you need this in a real emergency, test it once during a quiet period. Restore to a staging copy of your site, check everything loads, then delete the test. This one exercise separates hosts with genuine backup systems from ones that just claim to have them.
If your host makes you file a support ticket and wait for a human to manually restore your site, that's a warning sign. Fast, self-service restores should be standard by now, not a premium feature.
Where should backups actually be stored?
Backups should sit off the same physical server as your live site, ideally in a completely separate data centre or region. If the backup lives on the same machine as your website, one hardware failure destroys both at once.
Obvious, I know, but I've seen it ignored constantly, especially on cheaper VPS plans where the host "backs up" to a different folder on the same disk. That's not a backup strategy, it's a false sense of security.
Look for hosts that store backups in a separate region or with a third-party storage provider. Some hosting companies use distributed storage networks specifically so a regional outage can't take out your live site and its backup at the same time.
What happens if my host doesn't offer backups?
If your host doesn't provide backups, run your own using a plugin or a third-party backup service, and store the copies somewhere external like cloud storage. Relying entirely on your host with no second copy is a gamble.
WordPress users have plenty of solid backup plugins that push copies automatically to cloud storage on a schedule you control. Set it, forget it, and check occasionally that the backups are actually completing rather than silently failing.
For non-WordPress sites, ask your developer to script a regular export of your database and files to an external location. Not glamorous work, but it's the difference between a bad day and a business-ending one.
Are backups enough to protect my site from hacks?
No, backups are a recovery tool, not a prevention tool. They let you undo damage after an attack, but you still need active protection like a WAF (a web application firewall) and SSL (the encryption protocol that secures data between browser and server) to stop attacks happening in the first place.
Think of backups as insurance, not armour. A site hit by a DDoS attack (a flood of fake traffic designed to overwhelm a server) needs mitigation in real time, and a backup does nothing while the attack is underway. It only helps afterward if the attack corrupted your data.
Attack volumes across the web have grown steadily according to Cloudflare's threat research, which is exactly why backups and active security need to work together. Check our full hosting security guide for the layers you should have running alongside your backup schedule.
Here's what I'd actually do if you're choosing hosting today. First, confirm your shortlisted provider includes daily backups in the plan you're paying for, not as an upsell. Second, test a restore yourself within the first week of signing up, don't wait for an emergency to discover it doesn't work. Third, if you run anything commercial, keep a second backup copy in your own cloud storage regardless of what your host provides, because redundancy costs little and saves everything.
Frequently Asked Questions
How long should a host keep old backups?
Most reliable hosts keep at least 7 to 30 days of daily backups, giving you options to roll back even if you don't spot a problem straight away. Longer retention costs more but matters if issues surface weeks after they happen.
Can I back up my site myself instead of relying on my host?
Yes, and it's smart to do both. Use a backup plugin or export tool alongside your host's built-in backups, and keep your own copy in separate cloud storage so you're never dependent on a single provider.
Do backups protect against ransomware or hacking?
Backups let you recover after an attack by restoring a clean version of your site, but they don't stop the attack itself. You still need firewalls, strong passwords and regular updates to actually prevent intrusions.
Is a backup the same as a site migration?
No. A backup is a stored copy for emergencies, while a migration moves your live site to a new host or server. Some hosts use backup tools to assist migrations, but the purpose and process differ.
Will restoring a backup delete my recent changes?
Yes, restoring rolls your site back to the exact state it was in when that backup was taken. Anything added or changed after that point is lost, which is why frequent backups matter for active sites.
Follow HostList for new rankings, original research, and changes across the hosting industry.
