WordPress Backups and Security: A Small Business Guide

Nobody thinks about backups on a normal day. You think about them the morning your website is a blank white screen, or when a customer emails asking why your site is showing adverts for something dodgy. By then the question is no longer whether you should have a backup. It is whether you have one, and whether it actually works. This guide is for small business owners running WordPress who want a straight answer to both, without the scare tactics.

What can actually go wrong

WordPress sites rarely die dramatically. They break in mundane, predictable ways:

• A plugin update breaks the site. Updates are essential, but occasionally one conflicts with your theme or another plugin and the whole site goes down. It happens to careful people too.
• A hack through an outdated plugin. Most small business sites are not hacked by someone targeting them. Automated bots scan the web for known holes in old plugin versions and walk straight in. An out-of-date WordPress install is one of the most common ways small sites get compromised.
• Your host has a bad day. Servers fail, accounts get suspended over a billing mix-up, and budget hosts occasionally vanish altogether. "The host will have a copy" is a hope, not a plan.
• You delete something yourself. A page removed by mistake, a change that cannot be undone, a tidy-up that went too far. Human error is probably the most common cause of all.

None of these are rare. The point is not to frighten you. It is that every one of them is a minor annoyance with a working backup, and a genuine crisis without one.

Why "the host has backups" is not a plan

Most hosting companies do keep some backups, and that is genuinely useful. But relying on them alone has three problems. First, those copies often live on the same server, or at least in the same account, as your site. If the account is compromised or suspended, the backups can go with it. Second, many hosts keep backups for a short window, sometimes only a few days, and charge a fee to restore them. Third, and most importantly, you have probably never seen one of these backups or tested a restore. A backup you have never tested is a guess.

What a real backup actually is

A proper backup for a WordPress site has four ingredients:

• Files and database together. Your theme, plugins and images live in files. Your pages, posts, settings and orders live in a database. A backup that misses either one is half a website.
• Stored offsite. The copy must live somewhere other than the server it protects: Google Drive, Dropbox, a dedicated backup service. If the site and the backup can be lost in the same incident, it is not really a backup.
• More than one version. If your site was quietly hacked two weeks ago, last night's backup contains the hack. Keeping daily copies for a few weeks means you can go back to a clean version.
• A tested restore. The only backup that counts is one you have successfully restored, at least once. Everything else is faith.

A simple backup plan for a non-technical owner

You do not need to become a system administrator. This takes about an hour to set up and a few minutes a month to keep an eye on:

1. Install one reputable backup plugin. UpdraftPlus is a popular free option that most owners can manage.
2. Connect it to offsite storage such as Google Drive or Dropbox, so the copies leave the server automatically.
3. Schedule a daily backup of the database and a weekly backup of everything, keeping at least two or three weeks of versions.
4. Do one test restore, or ask whoever built your site to do it with you, so you know the process works and roughly how long it takes.
5. Put a monthly reminder in your calendar to check the backups are still running. Plugins fail silently more often than you would think.

That is it. Not glamorous, but it turns almost every disaster on the list above into an afternoon's inconvenience.

The security basics that prevent most hacks

Backups are the safety net. These habits mean you rarely need it. They are not sophisticated, which is exactly the point: the overwhelming majority of small business hacks are automated and opportunistic, and basic hygiene defeats them.

• Keep everything updated. WordPress core, the theme and every plugin. Old versions with known holes are how bots get in.
• Use strong, unique passwords. Especially for the WordPress admin and your hosting account. A password manager makes this painless.
• Turn on two-factor authentication. One extra step at login blocks the vast majority of automated break-in attempts, even if a password leaks.
• Run fewer plugins. Every plugin is more code that can carry a vulnerability. Remove the ones you do not use, and actually delete them rather than just deactivating them.
• Make sure the site runs on HTTPS. If browsers are flagging your site, we covered what that means and how to fix it in why your website says Not Secure.

When maintenance is the reason to change approach

Everything above is genuinely doable by a non-technical owner. The honest question is whether you will keep doing it, every month, for years, on top of actually running your business. If the answer is no, that is not a personal failing. It just means WordPress's biggest cost for you is not money, it is attention.

At that point you have two sensible options. Pay someone to maintain your WordPress site properly, or move to a managed website where updates, backups and security are simply part of the service rather than a separate chore. We compared the two approaches in WordPress or a custom website. Our own managed websites work the second way: hosting, security, backups and changes are all included from £49 per month, with a one-off setup of £150-£300, so you never log into an admin panel or think about a plugin again.

Frequently asked questions

How often should I back up my website?

Daily for the database if your content or orders change often, and weekly for the full site as a minimum. The right answer is: often enough that losing everything since the last backup would be annoying rather than devastating.

Are free backup plugins good enough?

Yes, for most small sites, provided the copies go offsite and you test a restore. The paid tiers mostly add convenience, like finer scheduling and faster restores, not fundamentally better protection.

My site is already broken and I have no backup. What now?

Contact your host first, as they may hold a recent copy even if you never set anything up. If the site was hacked, do not just restore it and carry on, because the hole that let the attacker in is still there. Get the site cleaned, update everything, change your passwords, and then set up real backups so this is the last time.

If you would rather never think about updates, backups or security again, that is exactly what our managed plans are for. Tell us about your site and we will give you a straight answer on the easiest way to make it safe.