£14.99
£33.98
£23.24
£41.99
For many small businesses, the website is where enquiries, bookings, sales, support requests and brand trust begin. If it is hacked, broken by an update, accidentally deleted or disrupted during a hosting move, the problem is not only technical. It can affect customers, staff, marketing and cash flow.
A sensible website backup and disaster recovery approach helps you reduce that risk. It does not guarantee that every incident will be simple or instant to fix, but it gives you a clearer route back to a working website when something goes wrong.
This guide explains what UK small businesses should back up, how often to take backups, why off-site storage matters, how to test restores, and what to include in a practical recovery plan.
Backups are often ignored until they are needed. Unfortunately, the moment you discover a missing backup is usually the worst possible time: after a hack, a failed plugin update, a deleted product catalogue, or a hosting migration that has not gone to plan.
A backup is a copy of your website data. A disaster recovery plan is the broader process for using that backup, deciding who does what, communicating with customers, verifying security, restoring services, and confirming the website is safe to use again. Several disaster recovery guides distinguish between backup copies and broader recovery planning, including recovery objectives, asset lists, responsibilities and regular drills or testing.
For small businesses, this does not need to be overcomplicated. The goal is to know what you have, where it is stored, how recent it is, how to restore it, and who to contact when time matters.
Website incidents vary in severity. Some are minor mistakes; others may involve security issues, data loss, or prolonged downtime. Backups are useful in several common scenarios.
If a website is compromised, a clean restore point may help you return to a known earlier version. However, restoring a backup is not the whole answer. You still need to identify how the attacker got in, update vulnerable software, change passwords, check user accounts and scan for malware. Otherwise, the same problem may return.
Giraffe Hosting's platform includes security features such as Web Application Firewall protection, malware scanning, and DDoS protection, along with daily backups. These measures can reduce risk and support recovery work, but no hosting or backup arrangement should be treated as a guarantee that incidents cannot happen.
A staff member, developer or site administrator might delete a page, media folder, product category, database table or form entry by mistake. In these cases, the best outcome is often a targeted restore from a recent backup, rather than rolling the whole website back unnecessarily.
WordPress core updates, plugin updates, theme changes and PHP version changes can occasionally cause layout, Checkout, booking or login problems. A recent backup gives you a fallback while the underlying compatibility issue is investigated.
Moving to a new host is a common time when problems arise, especially if files, databases, DNS records, SSL certificates, or email settings are overlooked. A pre-migration backup protects the original website before changes begin. If you are moving a WordPress site, see our guide to migrating an Elementor WordPress site to new hosting. For online stores, our WooCommerce migration SEO checklist includes additional considerations for URLs and product pages.
A useful website backup should include everything needed to rebuild the site in a working state. For a typical small business website, that means more than just visible pages.
Some items may sit outside the website itself. For example, domain names, DNS records, email mailboxes, third-party payment systems, CRM integrations and analytics platforms may need separate documentation or export processes. If your website relies on these services, include them in your recovery planning even if they are not part of the hosting backup.
Backup frequency should reflect how often your website changes and how much data you can reasonably afford to lose. Disaster recovery guidance often refers to a recovery point objective, or RPO. In simple terms, this is the maximum amount of data you are prepared to lose if you need to restore from a backup.
| Website type | Typical change pattern | Practical backup approach |
|---|---|---|
| Brochure website | Pages change occasionally, with a few contact form enquiries | Daily backups are usually a sensible baseline, with manual backups before major edits. |
| Blog or content website | New articles, comments or uploads may be added regularly | Daily backups, plus a backup before theme, plugin or content structure changes. |
| WooCommerce or booking website | Orders, bookings, customer records and stock levels may change throughout the day | More frequent database protection may be needed, depending on order volume and the acceptable level of data loss. |
| Membership or learning website | User activity, payments and course progress may change frequently | Plan backups around user activity and consider tighter recovery point requirements. |
Giraffe Hosting includes daily backups as part of its hosting platform. For many small business websites, daily backups are an important foundation. For websites with frequent transactions or time-sensitive records, you should discuss whether additional backup frequency or application-level exports are appropriate.
It is also good practice to create a manual restore point before making higher-risk changes, such as major WordPress updates, new plugins, theme changes, PHP upgrades or migrations.
One widely referenced backup concept is the 3-2-1 backup principle: keep multiple copies of data, use more than one type of storage, and keep at least one copy off-site. The reason is simple: if all copies are stored in the same place or managed through the same account, one incident could affect both the live website and the backups.
For websites, off-site storage might mean backups stored away from the production server, cloud storage managed separately from the live hosting environment, or a managed backup system that maintains restore points outside the main website account.
Off-site does not mean "set and forget". You still need to know:
These details matter because ransomware, account compromise, human error and hosting problems can all affect availability. Separating copies helps reduce single points of failure.
A backup answers the question: "Do we have a copy of the website?" A disaster recovery plan answers a broader question: "How do we get back to an acceptable working position after an incident?"
A practical disaster recovery plan for a small business website should include:
Disaster recovery sources commonly refer to recovery time objectives, recovery point objectives, inventories, personnel roles, communication plans and regular drills. Small businesses can adapt these ideas into a concise document rather than a complex corporate manual.
A backup that has never been tested is only an assumption. Restore testing is the process of proving that a backup can actually be used.
For a website, testing might involve restoring to a staging area or temporary environment rather than overwriting the live site. You can then check whether pages load, forms work, images appear, user logins behave correctly, and key business functions still operate.
A simple restore test checklist might include:
Testing should be repeated after major website changes, migrations or platform changes. It is also worth testing before high-risk periods, such as a large campaign, a seasonal sales period or an important product launch.
Before you need a restore, ask clear questions. A good hosting conversation should cover practical details rather than vague reassurance.
Giraffe Hosting has provided UK hosting services since 2007 and offers web hosting, WordPress hosting, managed cloud hosting, VPS hosting, domain registration and domain transfer services. Its platform includes daily backups, autoscaling resources, Web Application Firewall protection, malware scanning and DDoS protection, 24/7 support, onboarding assistance, free migration support, and a knowledge base. For growing websites that need more flexible resources, you may also find our guide to autoscaling WordPress hosting useful. If you are weighing up infrastructure choices, our article on cheap hosting versus VPS hosting explains the trade-offs.
Use this checklist as a starting point for your own website backup and disaster recovery planning:
This does not remove all risk, but it gives your business a more controlled way to respond when something breaks.
Backups help you recover to an earlier restore point after incidents such as malware infections, accidental deletions, or failed updates. They should be combined with security checks, software updates, and access reviews because restoring a backup alone may not fix the root cause of a compromise.
A good website backup should include the website files, database, media uploads, configuration settings and relevant application data. For some businesses, logs and separate records for DNS, domains, email, and third-party systems should also be documented as part of recovery planning.
Backup frequency should depend on how often the website changes and how much recent data the business can afford to lose. Daily backups are a useful baseline for many small business websites, while e-commerce, booking, and membership sites may need more frequent backups to protect changing database records.
A backup is a copy of data. A disaster recovery plan explains how the business will respond after an incident, including recovery objectives, responsibilities, communication steps, restore procedures and testing.
Businesses should test restores in a safe staging or temporary environment, then check pages, forms, media, logins, database content and key customer journeys. Any issues found during testing should be recorded and used to improve the recovery plan.
