How often a small business website needs a backup depends mainly on how much changes on it day to day. A site with a store, a blog, or online booking should be backed up daily, since orders and customer data change constantly. A site that barely changes from month to month can run safely on a weekly schedule. What matters more than frequency alone is whether a backup has actually been tested for restore, since a backup nobody has ever restored is a guess, not a safety net.
How often a backup is actually needed
Frequency should track how much would be lost in an outage, not the age of the site. An online store or a booking system changes multiple times a day through new orders and appointments, so a 24-hour gap in backups means real, measurable lost revenue. A typical trades or home services website with service pages, a project gallery, and a contact form often does not change for weeks at a stretch, aside from an occasional new photo or blog post.
A practical rule of thumb that has become common among hosting and security providers:
- Daily: stores, online scheduling, customer portals, anything with live transactions.
- Weekly: sites with occasional text or image updates but no order or booking function.
- Before any major change, regardless of the usual schedule: a redesign, a relaunch, or a hosting provider switch.
Why a backup without a restore test is worthless
An automatic backup running quietly in the background feels reassuring, but it says nothing about whether it will actually work when needed. Corrupted database dumps, expired credentials to the storage location, or a backup that only captures files without the matching database are the kind of failures that typically surface only when a restore is actually attempted and fails. A restore test, where the backup is actually loaded onto a staging environment, should happen at least once a year, more often for frequently changing sites.
With a clean, tested backup, a hacked site can usually be back online within a few hours. Without a reliable backup, cleanup by an agency or a security service often stretches over several days, depending on how deeply the malicious code has embedded itself.
What US law actually requires, and what it does not
There is no general federal or state law that requires most small businesses to back up their public website. For the large majority of trades and home services businesses, backup is a business continuity practice, not a direct legal mandate. That changes in a handful of regulated sectors: the FTC Safeguards Rule requires a tested, offline-capable backup system for businesses that count as “financial institutions” under the broad Gramm-Leach-Bliley definition, such as car dealers who arrange financing, mortgage brokers, or tax preparers. FINRA Rule 4370 requires a written business continuity plan covering data backup and recovery for broker-dealers, HIPAA requires a documented backup plan for electronic health information, and state bar ethics rules push law firms toward redundant, tested backups.
Outside of those sectors, CISA, the federal cybersecurity agency, recommends backups as best practice rather than mandating them by law, specifically pointing small businesses toward the 3-2-1 rule described below. In practice, that means a home services business is free to choose its own backup approach, but going without one is a business risk decision, not a compliance shortcut.
What hosting providers actually include
Most US hosting providers advertise automatic backups, but the details vary in ways that matter, especially around whether backup is a core feature or a paid add-on.
| Provider | Frequency | Cost |
|---|---|---|
| SiteGround | daily | included from the entry-level shared plan |
| Bluehost (via CodeGuard add-on) | daily | roughly $48 to $108 per year, depending on tier |
| GoDaddy | daily | included on most shared hosting plans, exact retention varies by plan |
The practical takeaway is the same across providers: check whether backup is a contractual feature with a defined retention window, or a best-effort extra that the provider can change or drop. For a site where downtime has a real revenue impact, that distinction is worth confirming in writing before relying on it exclusively.
When a dedicated backup tool is worth it
For WordPress sites, dedicated backup plugins and services exist specifically to keep a copy independent of the hosting provider, usually stored on separate cloud storage:
- UpdraftPlus: free basic version available, premium version with cloud storage and multi-site licensing from around $70 in the first year.
- Jetpack Security bundle: automated backup with 10 GB of storage from around $9 per month in the first year, standard pricing afterward.
- BlogVault: single-site plan with daily backups and 30-day retention from around $99 per year, business plan with two daily backups and 90-day retention from around $299 per year.
These tools mainly solve a problem specific to classic WordPress hosting: a database, a plugin ecosystem, and a publicly reachable admin login together create a lot of attack surface and a lot of potential failure points. According to Patchstack’s 2025 WordPress security research, over 11,000 new vulnerabilities were disclosed across the WordPress plugin ecosystem in 2025 alone, the large majority in plugins rather than WordPress core. A statically built website without a database or a public login sidesteps most of that surface, which cuts the backup problem down to versioning code and content rather than protecting a full CMS stack.
The 3-2-1 rule as a simple standard
For a business that does not want to get lost in the details, one rule covers most of it: three copies of the data, on two different types of storage, with at least one copy kept off-site. CISA states this rule explicitly in its small business guidance as a practical minimum, not the highest bar available. Applied to a business website, that means treating the hosting provider’s backup as one copy, adding a separate backup tool or manual export as a second copy on different storage, and making sure at least one of those copies sits somewhere that would not be affected by the same incident as the hosting server itself.
The next step
Ransomware was involved in 88% of confirmed breaches at small and mid-sized businesses in 2025, according to Verizon’s Data Breach Investigations Report, a sharply higher share than at large enterprises. A backup cannot be arranged retroactively once a site has already been compromised. Business owners who do not want to personally track whether their hosting backup actually exists and actually restores should hand that task to an ongoing maintenance service rather than relying on a best-effort feature buried in a hosting contract. Mr.Site keeps several hundred business websites actively maintained, backup and restore testing included. Details on that model are on the Managed Website Service page. For the other maintenance tasks that matter alongside backup, see What Actually Happens Without Website Maintenance; for how the hosting location question plays out for businesses with EU customers, see Does Your Web Host Need a Data Processing Agreement.