In this guide · 7 sections
Short answer
Back up both files and database (WordPress) or CSV exports plus your theme (Shopify), keep at least 3 to 5 recent copies in separate locations off the web server, and test a restore on a staging copy at least twice a year. A host's own backup is a bonus, not your plan.
Why your host's backup is not enough
Most hosts back up their servers, and that helps. But the WordPress backup documentation points out that it takes time to request a copy from the host, and a speedy recovery is critical. Host backups also tend to share three weaknesses:
- Short retention. Many keep only days or a few weeks. If malware sat on the site for a month, every copy may contain it.
- Same place as the site. If the hosting account is compromised or closed for unpaid bills, the backups can go with it.
- Unknown restore process. You find out whether restore is one click, a support ticket or a paid service only when you need it.
CSA's Cyber Essentials (2025) standard puts this into requirements: clause A.8.4 (g) says backups shall be stored separately and isolated from the operating environment, and offsite where feasible. Clause A.8.4 (f) says backups shall be protected from unauthorised access.
What to back up: WordPress, Shopify and website builders
What counts as a full backup depends on the platform.
| Platform | What to back up | How |
|---|---|---|
| WordPress / WooCommerce | Database (posts, pages, orders, settings) and files (themes, plugins, uploads, wp-config.php) | Backup plugin or host tool, plus an off-server copy |
| Shopify | Products, customers, orders, discount and gift card codes, financial data, and the theme | CSV exports and theme download in the admin, or a backup app |
| Wix, Squarespace and similar | Page content, images, form submissions, blog posts | Built-in site history or duplicate, plus manual exports of key content |
| Any platform | Domain and DNS settings, list of plugins or apps, admin logins | Written record in your password manager |
WordPress's docs are clear that backing up the files does not back up the database, which lives in a separate MySQL or MariaDB system. Treat the two as one backup set, made at the same time.
Shopify's backups and duplication page lists what you can export as CSV and notes that you can download your theme. It also notes limits: orders cannot be imported back through the admin, and discount codes and issued gift cards cannot be transferred. For anything beyond basic exports, Shopify points you to backup apps in its App Store.
Where to store backups and how many to keep
WordPress suggests keeping at least 3 to 5 recent backups in different locations, for example one on the hosting server, one on cloud storage, and one on a local computer. For a small business site, a practical pattern is:
| Setting | Brochure site | Online store or booking site |
|---|---|---|
| How often | Weekly, and before every update | Daily, and before every update |
| Copies kept | At least 5 weekly copies | At least 14 daily copies plus monthly copies |
| Where | Cloud storage outside the host | Cloud storage outside the host, plus a second location |
| Who can delete | Owner only | Owner only; backup tool cannot delete old copies |
Use a cloud storage account that belongs to the business, not to your web designer, and protect it with MFA. If ransomware or an attacker gets into the website admin, they should not be able to reach and delete the backups too.
How to restore a website backup: the restore drill
CSA's Cyber Essentials clause A.8.4 (i) says, as good practice, backups should be tested at least bi-annually to make sure restoration works. For a website, testing means restoring onto a separate staging copy and checking it. WordPress's recommended order is to restore files first, then import the database.
Pick a backup at random, not the newest
Choose one from a week or two ago. This also checks that older copies are kept and readable.
Restore it to a staging site
Use your host's staging feature, a subdomain or a local copy. Never test by overwriting the live site.
Restore files, then the database
For WordPress, put the files back first, then import the database. If database details changed, update wp-config.php to match.
Check the site works
Log in, open key pages, submit the contact form, check images load and, for a store, check products, prices and a test checkout.
Time it and write it down
Record how long the restore took, what went wrong and who did it. That time is your realistic recovery time if the site goes down.
Delete the staging copy or lock it
A forgotten staging copy is a security risk. Remove it or password-protect it and block search engines.
Common backup mistakes that break restores
These are the problems that most often turn up during a real restore:
Check for these now
Always take a fresh backup before updating WordPress core, themes or plugins. If an update breaks the site, see our guide to fixing a WordPress update that broke your site.
Do it yourself or get help?
On a simple WordPress site you can set up a reputable backup plugin to send copies to business-owned cloud storage, then run the drill above. The hard part is keeping it going: checking backups still run, renewing storage and testing twice a year. That is what to ask about when comparing care plans; our checklist for website maintenance services covers it.
Our Backup & Ransomware Recovery package (S$290) sets up off-site backups and a tested restore procedure. If you want backups monitored and restore drills done for you, our Care plan (S$129 a month) includes it alongside updates and monitoring. For your email and files, see our guide to backing up Microsoft 365 and Google Workspace.
Frequently asked questions
WordPress's documentation suggests weekly backups for smaller sites with few changes and daily backups for busy sites. An online store or booking site that takes orders every day should be backed up daily. Always take an extra backup before updating the site, its theme or its plugins.
Shopify runs the platform, but its help centre tells merchants to export CSV files of products, customers, orders and other data, and to download the theme, if they want their own backup. For automatic backups and easier restores, Shopify points merchants to backup apps in the Shopify App Store.
Store them away from the web server, in cloud storage owned by the business and protected with MFA, with a second copy somewhere else. CSA's Cyber Essentials says backups should be kept separate from the operating environment and protected from unauthorised access, so an attacker on the site cannot delete them.
Restore it. Take a backup from a week or two ago, restore it onto a staging site, and check that pages, forms, logins and, for a store, products and checkout all work. Time the process and write it down. Repeat at least twice a year, which matches CSA's Cyber Essentials good practice.
WordPress's documentation suggests at least 3 to 5 recent backups in different locations. For a store, keeping two weeks of daily copies plus monthly copies helps if a hack or error is only noticed weeks later. Make sure old copies cannot be deleted by the same login that runs the site.