What is a Website Backup?

Backups exist for the moment something breaks. When the failure is operational (a botched update, a deleted file, a database error), restoring a saved copy is usually the fastest way back online. A cyberattack, such as a brute-force attack, or a data breach takes more care. A backup still recovers the damaged data, but restore last, not first: contain the compromise, preserve evidence, patch the vulnerability the attacker used, and rotate any affected passwords and keys. Then restore from a copy made before the intrusion, so you don't put the attacker's changes straight back online.

The risk is measurable: ransomware figured in 44% of the breaches Verizon investigated for its 2025 Data Breach Investigations Report. CISA, the FBI, and the NSA recommend keeping offline, encrypted backups of critical data and regularly testing that they restore (#StopRansomware Guide, updated September 2023). That advice goes double for high-risk or high-stakes websites, such as ecommerce stores, where an hour of lost orders costs real money.

Full, incremental, and differential backups

Backups differ in how much they copy each time, and in what a restore needs afterward:

• Full backup: a complete copy of the site, files and database included. It uses the most storage, but a restore is simple because one archive holds everything.
• Incremental backup: only what changed since the last backup of any kind. Copies are small and fast, but a restore needs the last full backup plus every increment after it, so one missing file breaks the chain.
• Differential backup: everything that changed since the last full backup. Each copy grows over time, but a restore needs only 2 files: the last full backup and the newest differential.

For most small sites, scheduled full backups are the right choice, since storage is cheap and restores stay simple. Switch to an incremental or differential schedule when full copies become too large to run daily, and keep a periodic full backup as the anchor either way.

Backups vs. snapshots

A snapshot is a point-in-time image of an entire server or virtual machine, captured and stored by the platform that runs it. A backup is an independent copy of your site's files and database that you can store anywhere and keep as long as you need.

Snapshots make short-term rollback fast: revert one, and the server returns to that exact state in minutes. But a snapshot usually lives on the same platform as the site itself, so a platform failure or account compromise can take out the site and its snapshots together. Take a snapshot before a risky change, when a fast rollback is the goal. Rely on independently stored backups for longer retention and for recovery when the platform itself fails or is compromised. A snapshot complements a backup; it doesn't replace one.

Three ways to back up a website

You can back up a site through your host, with a plugin, or by hand:

• Your host's automated backups. Some web hosts back up sites on a schedule and let you restore from the control panel. Check the schedule and retention before you rely on them.
• A backup plugin. For a WordPress website, backup plugins such as UpdraftPlus (active on more than 3 million sites) run on a schedule and send copies to remote storage like Google Drive, Dropbox, or Amazon S3.
• A manual backup. Download the site's files over SFTP and export its database. It's free and works with any host, but it only happens when you remember to run it.

For exact steps, follow our guide to backing up a WordPress website.

Where to store backups: the 3-2-1 rule

A backup stored only on your hosting server fails with the server: one crash or compromise takes out the site and its safety net together. CISA's 3-2-1 rule is the standard fix. Keep:

• 3 copies of important files
• 2 different types of storage media, such as a hard drive and the cloud
• 1 copy stored off-site, away from your server

Retention needs a policy, not a pile. Set a tiered schedule: keep daily backups for a few weeks, weekly backups for a few months, and monthly backups for a year, then prune on that cadence. (DreamHost's DreamPress plans, for example, keep daily off-site backups for 14 or 30 days, depending on the plan.) Some sites need more: legal or industry rules can require older copies, and a compromise that goes undetected for months can only be undone from a copy older than your daily window. Before you prune, test-restore a known-good copy rather than assuming the newest one is the one you'd want back.

Restoring and testing a backup

Restoring a backup replaces the site's current files and database with the saved copy. Your host or backup plugin may offer a one-click restore; the manual route is re-uploading your files over SFTP and re-importing the database.

An untested backup is not a backup. CISA's guidance is to test that you can restore data both fully and partially, so run a test restore on a schedule, ideally into a staging copy of the site. An emergency should never be your first attempt.