The Backup Most Small Businesses Don’t Have

Here’s a scenario that plays out more often than most small business owners expect. A website goes down on a Wednesday morning. The hosting company investigates. Somewhere between a server migration, a plugin update, and a piece of malware that snuck in three weeks ago, the database is corrupted. The most recent working backup is from 14 months ago, before you added a dozen blog posts, updated your service pages, and refreshed the design. You can restore to that version and lose a year of work, or you can pay a developer to attempt a manual recovery that may or may not succeed.

This isn’t a hypothetical. It happens to real businesses regularly. And in most cases, it was entirely preventable with a basic backup system that costs less per month than a cup of coffee.

What You Actually Need to Back Up

For a typical small business website, a complete backup has two parts: the database and the files. Your WordPress database contains all of your content — pages, posts, settings, user accounts, form submissions, product orders. Your files contain your theme, plugins, uploaded images, and any customizations. You need both to restore a fully working site.

Beyond your website, business data backup extends to email archives, client documents, financial records, and any other critical business information stored digitally. If you use cloud tools like Google Workspace or Microsoft 365, those platforms have their own backup limitations that many users aren’t aware of. Google doesn’t guarantee indefinite retention of deleted files or emails — if something gets deleted and you don’t notice for more than 30 days, it may be gone.

The principle that matters here is sometimes called the 3-2-1 rule: keep at least three copies of your data, on at least two different types of storage, with at least one copy offsite. For most small businesses, a practical implementation is: automated daily backups through your hosting provider or a dedicated plugin, a second copy to cloud storage you control (like an AWS S3 bucket or Google Drive), and periodic local downloads to an external hard drive for the most critical data.

WordPress Backup Options

If your website runs on WordPress, you have several solid backup options ranging from free to modest monthly fees. UpdraftPlus is one of the most widely used backup plugins and offers free automated backups to cloud destinations including Google Drive, Dropbox, and Amazon S3. The free version handles most small business needs. The paid version adds features like incremental backups and better scheduling control.

BlogVault and WPvivid are other well-regarded options with clean interfaces and strong restore functionality. Jetpack, if you’re using it, includes automated daily backups in its paid plans along with one-click restore — which is convenient but means your backup and restore are both controlled by a third party, which introduces its own dependency.

Many managed WordPress hosting providers — WP Engine, Kinsta, Flywheel — include automated daily or hourly backups as part of their hosting plans. If you’re on one of those platforms, verify what their backup policy covers, how far back you can restore, and whether restoring is self-service or requires a support request. On Hostinger, which is common for small businesses, daily automated backups are included on many plans, but the retention window varies — often only 7 to 14 days, which means your backup may not cover a problem that developed slowly over weeks.

Backup Frequency: How Often Is Often Enough?

The right backup frequency depends on how often your site changes. A purely informational website that you update once a month can get by with weekly backups and a monthly download. An e-commerce site taking orders daily needs backups that run multiple times per day — losing a day’s worth of orders is a real business problem.

A practical starting point for most small business websites: daily automated backups retained for 30 days, with monthly backups retained for at least a year. The 30-day window covers most malware scenarios, since malicious code often does its damage gradually and the problem may not be noticed immediately. The yearly retention covers situations where data loss isn’t discovered until weeks or months after it occurred.

More important than any specific schedule is actually testing your backups. A backup that exists but doesn’t restore properly is almost as useless as no backup at all. Schedule a quarterly test where you restore your site to a staging environment and verify that it comes up correctly. Most business owners have never done this. Doing it once will tell you more about the reliability of your backup system than months of assuming it’s working.

Protecting Client and Business Data Beyond Your Website

For many small businesses, the data that matters most isn’t on the website at all — it’s in spreadsheets, contracts, project files, and email. This data deserves the same attention as your website backups.

If you use Google Workspace, tools like Spanning Backup or Backupify create independent copies of your Google Drive and Gmail content, which protects you against accidental deletion, account compromise, and the edge cases where Google’s own data retention doesn’t cover you. The cost is modest — typically a few dollars per user per month — and the protection is significant for any business that runs primarily on cloud tools.

For local files, an automated cloud backup service like Backblaze Personal Backup is a well-regarded option that continuously backs up everything on your computer to the cloud for a low flat rate. For business-grade needs with more control, Backblaze B2 or Amazon S3 with an automated client like Arq provides reliable offsite storage at minimal cost per gigabyte.

What to Do After a Data Loss Event

If data loss does happen — a hacked website, a corrupted database, an accidentally deleted folder — the most important thing is not to panic and not to start making changes without thinking through the implications. If your website is hacked, immediately take it offline to prevent further damage and to keep malware from spreading to visitors. Contact your hosting provider, who may have server-level backups beyond what you have at the application level. If you have an incident response plan — even a simple one — follow it.

For most small businesses, the incident response plan is simply: who do you call? Having the contact information for your web developer, your hosting provider’s support line, and your backup service’s support ready before something goes wrong means you’re not wasting critical time searching for help when you’re already in crisis mode.

Prevention is almost always cheaper than recovery. The cost of a solid backup system — perhaps a few hundred dollars per year at most for a complete setup — is a small fraction of the cost of professional data recovery, site reconstruction, or the business you lose while your website is down.

If you want to make sure your website and business data are properly protected — or if you need help recovering from an issue right now — Manson Bay Digital is ready to help. We help small businesses get their digital infrastructure set up right, including backups, security, and recovery planning. Get in touch at mansonbaydigital.com/contact/ or call (509) 800-7735.

“}],”stop_reason”:null,”stop_sequence”:null,”usage”:{“input_tokens”:3,”cache_creation_input_tokens”:7697,”cache_read_input_tokens”:7392,”cache_creation”:{“ephemeral_5m_input_tokens”:7697,”ephemeral_1h_input_tokens”:0},”output_tokens”:1,”service_tier”:”standard”,”inference_geo”:”not_available”}},”requestId”:”req_011CZ4MtTKbNeNCo6BjYavQY”,”type”:”assistant”,”uuid”:”a4b0334c-118d-49c6-ad51-b180ab7f2ef7″,”timestamp”:”2026-03-15T06:09:27.035Z”,”userType”:”external”,”cwd”:”/Users/scottmdavidson/Projects/MansonBayDigital/new-site-2026″,”sessionId”:”da9ecce8-fc82-4624-a987-edb30e387ddf”,”version”:”2.1.74″,”gitBranch”:”HEAD”,”slug”:”goofy-tumbling-pearl”}