Web Hosting Backups: How to Protect Your Site

People discover their backup policy during an outage. Hosts include snapshots that may live on the same infrastructure. Plugins write zips into the uploads folder and call it safety. Neither is a strategy until you restore onto a staging site and watch the site boot. WP Engine, Kinsta, SiteGround, and Cloudways make snapshots easy. You still want a copy they cannot delete with your account.

SiteGround daily backups, WP Engine checkpoints, Kinsta backups, and Cloudways snapshots are convenient and often the fastest restore. They are still tied to the vendor. If the account is suspended, the region has a bad day, or ransomware hits the panel, you want an export you control: files plus a database dump in object storage or another host. InMotion and others advertise backups as a selling point; read retention days. HostGator-class plans may make backups an upsell—price that in or leave. Do not store the only archive in wp-content/backups. That folder is in the blast radius. A snapshot is layer one. Your copy is layer two. Calling layer one “we have backups” is how restore tickets become archaeology.

A daily backup with seven-day retention cannot save last month’s deleted product catalog. An hourly backup with one-day retention cannot save a bad plugin you noticed on Friday. Match frequency to how often unique data changes: WooCommerce orders want tighter RPOs than a brochure. Retention is how far back you can travel. Then rehearse. Restore to staging on Kinsta, a Cloudways clone, or a local copy. Time it. Note whether plugins need license keys again. If the host restore is a ticket, not a button, that latency is part of the RTO. Hosts advertise 99.9% uptime; backups are how you survive the other minutes plus your own mistakes. Practice is the only SLA that is fully under your control.

Send archives to Backblaze B2, Amazon S3, or another region—not the second folder on the same SSD. Cloudways and many plugins will ship to S3-compatible storage. Even a scheduled dump to a different provider’s VPS is better than nothing. Encrypt archives if they contain customer data. Test that the credentials still work quarterly; expired keys are a silent backup failure. Registrar-level or DNS-only failures do not replace file backups, and file backups do not replace knowing your Namecheap login. Offsite means a different company’s failure domain. USB in a drawer counts if you remember. A zip on the desktop of the only admin laptop does not count as offsite.

Backup plugins on WordPress (UpdraftPlus and its peers) are useful, especially on Bluehost or HostGator when host backups are weak. They are also PHP processes that can time out, fill inodes, and back up malware if the site is already compromised. Schedule them off-peak. Exclude giant cache directories. Do not keep infinite local copies. Pair the plugin with remote storage. On WP Engine or Kinsta, prefer the platform backup as primary and the plugin as an export. Running three backup plugins is not three times safer; it is three cron jobs fighting disk. Policy: what is copied, where it lives, who can restore, how often you test. The plugin is an implementation detail.

Pick a date. Restore last night’s backup to a staging URL. Click login, a form, and checkout if you have it. If DNS or SSL breaks on the clone, write that down—production restores will do the same. If the restore is incomplete (empty uploads, old table prefix), fix the job now. SiteGround, WP Engine, Kinsta, and Cloudways all document clone/restore; use their words, not a forum post from 2017. Then delete the clone if it is public so you do not leak a duplicate shop. A backup you have never restored is a story you tell yourself. This month’s rehearsal is cheaper than a consultant on a holiday weekend.

Layer host snapshots with an off-site archive, set retention to the data you cannot recreate, and restore to staging on purpose. Plugins help on cheap shared; they are not a vault. WP Engine, Kinsta, SiteGround, and Cloudways make the button easy. You still have to press it before disaster.