To back up your website, copy both the files (code, themes, plugins, uploads) and the database, automatically, at least daily for sites that change often and weekly for static ones. Store at least one copy away from your hosting account, keep around 30 days of history, and test restoring a backup every few months, because untested backups often fail when needed.
Below you'll learn what a complete website backup includes, how often to run one, where to keep copies, step-by-step methods for cPanel and WordPress, and how to check a restore actually works.
Key takeaways
- Back up both files and the database automatically, at least daily for sites that change often and weekly for static ones.
- Keep at least one copy away from your hosting account and around 30 days of history, as hacks are often found weeks later.
- Follow the 3-2-1 rule of three copies on two types of storage, with one copy off-site and hard to delete.
- Test restoring a backup every three to six months, because untested backups often fail when needed.
Why do I need my own backup if my host already backs up?
Host backups are useful but they are not a plan on their own. They often live on the same infrastructure as your site, keep only a few days of history, may be deleted if your account is suspended or cancelled, and can be hit by the same incident. Many hosting terms also make clear that keeping backups is ultimately your responsibility.
The UK National Cyber Security Centre's (NCSC) advice for small organisations is to "make a copy (also known as a backup) of all the data that your business needs to operate", explicitly naming your website, and to consider using both online storage and a separate device "to create two backups".
If your site holds customer data, there's a legal angle too. UK and EU GDPR require the ability to restore the availability of personal data "in a timely manner" after an incident, and the UK regulator, the ICO, points to an appropriate backup process as the way to show that. Data protection and security laws in other countries often expect something similar, so check the rules where you operate.
What should a website backup include?
A website is two things, and you need both:
| Component | What it contains | Why it matters |
|---|---|---|
| Files | CMS core, themes, plugins, custom code, uploaded images and PDFs, .htaccess or server config |
Without them you rebuild the site by hand |
| Database | Pages, posts, products, orders, users, settings | Most of your content and all of your customer data |
| Configuration | wp-config.php or .env, DNS records, email routing, cron jobs |
Easy to forget, hard to recreate under pressure |
Keep a separate note (in your password manager, not on the server) of your DNS records, registrar login and host account details. If your hosting account is the thing that's lost, those are what you need first.
How often should I back up my website?
Match frequency to how much work you could afford to lose. As the NCSC points out, the more often you back up, the less you lose if you are forced to recover.
| Type of site | Suggested frequency | Suggested history |
|---|---|---|
| Brochure site updated a few times a year | Weekly, plus before every change | 3 months |
| Blog or news site | Daily | 30 to 90 days |
| Online shop or booking system | Daily full, plus database every few hours or real-time | 30 to 90 days |
| Membership or customer-portal site | Real-time database replication or hourly | 90 days |
Long history matters because hacks are often discovered weeks after they happen. If you only keep seven days of backups, every copy may already contain the attacker's code. Always take a manual backup immediately before updates, plugin installs or design changes.
What is the 3-2-1 backup rule?
Keep at least 3 copies of your data, on 2 different types of storage, with 1 copy off-site. Both the NCSC and the ICO describe this strategy. For a website that typically means:
- The live site on your host.
- Your host's own backup, or a backup in another folder or server.
- An off-site copy in separate cloud storage, such as an object storage bucket or business cloud drive, under a different account.
Ransomware and account takeovers increasingly target backups too, so make one copy hard to delete. Choose storage with versioning or object lock, use separate credentials that the web server doesn't hold, and turn on two-step verification for the storage account.
How do I back up a website in cPanel?
- Log in to cPanel and open Files > Backup (or Backup Wizard).
- For a full copy, choose Download a Full Account Backup, select a remote destination or your home directory, and generate it. This bundles files, databases, email and settings, but it can only be restored by a host.
- For copies you can restore yourself, use Partial Backups: download your home directory, then each MySQL database separately.
- Move the files off the server to your off-site storage, then delete any backup archives left in your web root, where they could be downloaded by anyone who guesses the file name.
Many hosts also offer JetBackup or a similar tool in cPanel with daily automated backups and one-click restores. Check its retention period and whether you can download copies.
How do I back up a WordPress site?
The simplest reliable approach is a well-maintained backup plugin that sends copies to external storage on a schedule.
- Install a reputable backup plugin or use your managed host's backup feature.
- Schedule daily database backups and daily or weekly file backups.
- Set the destination to off-site storage, not the same server.
- Set retention to at least 30 days.
- Run a backup manually and confirm the files arrive in the destination.
If you have shell access, WP-CLI gives you a scriptable database export:
wp db export ~/backups/site-$(date +%F).sql
tar -czf ~/backups/files-$(date +%F).tar.gz -C ~/public_html .
Store ~/backups outside the web root, and copy it off-site with a tool such as rclone. Our WordPress security checklist covers the other settings to harden while you're at it.
How do I test a website backup?
The NCSC stresses that "it's important you know how to restore it, and to check that it contains all your important data". A practical test:
- Create a staging site or a local copy on your computer.
- Restore the most recent backup into it.
- Check pages, images, forms, logins and, for shops, recent orders.
- Note how long the restore took. That's your realistic recovery time.
- Repeat every three to six months, and after changing backup tools or hosts.
What to do next
Find out today what your host backs up, how often and for how long. Then set up one independent, automatic off-site backup and put a test restore in your calendar. Backups also protect against the issues a security scan finds before they're fixed: MakeItFlow doesn't take backups, but it does check for risky exposures such as public .env and .git files in its free website security scan. If you think your site has already been compromised, read signs your website was hacked before restoring, so you pick a clean backup. Then run a free MakeItFlow website audit on the restored site.
Frequently asked questions
Where is the best place to store website backups?
Somewhere separate from your hosting account, in a different provider, with its own login protected by two-step verification. Object storage with versioning works well because accidental or malicious deletions can be undone.
Are website builder sites like Wix or Squarespace backed up?
The platform protects its own infrastructure, but your options for exporting a full copy are often limited. Keep copies of your content, images and product data, and check what the platform's export tools actually include.
How long does it take to restore a website from backup?
A small WordPress site typically restores in under an hour once you have the files; large shops can take much longer. The only way to know your figure is to time a test restore.
Should backups be encrypted?
Yes, if they contain personal data or credentials, especially when stored with a third party. Keep the encryption key somewhere safe and separate, because the ICO notes encrypted backups need good key management to remain usable.
Do I need to back up my email as well?
If your email is hosted with your website, yes, or move it to a dedicated business email service with its own retention. Email often holds contracts and customer conversations you can't recreate.
Sources
Written by the MakeItFlow team
We build the website audit these guides are based on. Every fact is checked against the primary sources listed above and this guide was last reviewed on 25 October 2026 . How we research and check
Check your own site in 30 seconds
Run a free audit covering speed, SEO, DNS, email authentication and security headers — and get a prioritised fix list.
