Your host probably does back up your website, but usually for its own disaster recovery, not as a promise to you. Many hosting agreements make you solely responsible for backups, keep copies for a short time, or charge to restore them. Ask your host a few direct questions today, and keep at least one copy of your own somewhere else.
Key takeaways
- “Backups included” can mean anything from a guaranteed daily copy to an occasional server snapshot with no promises.
- Read your hosting terms: many say backups are your job, not theirs.
- Short retention, same-building storage and size limits are the common gaps.
- A backup only counts if someone has tested restoring it.
Does my web host back up my website?
Most do something. The question is whether they promise to, and whether you can get a copy back quickly when you need it.
Take one large host’s Australian terms as an example. Bluehost says it “from time to time backs up data on its servers” but “is under no obligation or duty” to do so. It also says the customer is “solely responsible for backing-up all Subscriber Content” (Bluehost terms of service). That wording isn’t unusual. Clauses like it appear in many hosting agreements.
WordPress.org’s own advice says the same thing more gently. Most hosts back up the whole server, “but it takes time to request a copy” of your site, so you should know how to back up and restore it yourself (WordPress.org).
Why do hosting backups let people down?
In our experience, owners find the gaps on the worst possible day. These are the usual ones:
- Best effort only. If the backup didn’t run, there’s no remedy in the contract.
- Short retention. A few days of copies won’t help if malware sat unnoticed for weeks. Our guide to backup retention explains why.
- Size limits. Bluehost’s terms say it won’t back up accounts over 50,000 files or 30 GB. Busy shops and image-heavy sites hit limits like this.
- Whole-account restores. Some hosts can only roll back everything at once, or charge per restore. Bluehost’s terms say it “does not offer file-by-file restoration services”.
- Gone when the account goes. If hosting is cancelled or suspended, the host’s backups usually go with it.
- Infected copies. Sucuri found backdoors on 49% of compromised sites (Sucuri). Restoring a backup taken after the break-in brings the backdoor back.
Can a backup really be lost with the server?
Yes. In March 2021, a fire destroyed one of OVHcloud’s data centres in Strasbourg, France. One customer, Bati Courtage, believed its backups were in a separate building. They were in the same one, and nothing could be recovered. A French court later ordered OVHcloud to pay it €101,102 in damages, and OVHcloud said it would appeal (Blocks and Files).
Fires are rare. The lesson isn’t. A backup on the same server, or in the same building, shares the same risks as your site. The 3-2-1 rule exists for this reason: three copies, on two kinds of storage, with one off-site (Backblaze). If you’re unsure whether your host’s copies are true backups, read our explainer on the website backup vs snapshot difference.
What should I ask my host today?
Send these questions by email, so you have the answers in writing:
| Ask | A good answer | A warning sign |
|---|---|---|
| How often do you back up my site? | At least daily, with a set time | “Regularly” or “from time to time” |
| How long do you keep copies? | Several weeks | A few days |
| Where are copies stored? | Off-site, away from my server | Same server or “on our infrastructure” |
| How do I restore one, and what does it cost? | Self-serve or free on request, files or database separately | Fees, or whole-account restores only |
| Can I download a copy? | Yes, any time | No, or only on request |
| Are backups guaranteed in my agreement? | Yes, in writing | “Best effort” or no mention |
Whatever the answers, test a restore once. A backup nobody has restored is a hope, not a plan.
What does a reliable backup setup look like?
For most small business sites, it looks like this:
- Automatic daily backups at least, more often for busy shops. Our guide on how often you should back up your website helps you choose.
- Copies stored off-site, separate from the hosting account.
- Weeks of history, so you can go back before a hidden infection.
- A backup before every update, as WordPress.org recommends.
- Someone responsible for restoring, who has done it before.
That’s what our website backups you can restore are built around. Maintain & Protect takes off-site backups daily on Essentials, four times a day on Advantage and hourly on Elite, and keeps them for 30 days. They’re part of our website maintenance plans, alongside updates, scanning and monitoring.
If your site has already been hacked and you’re not sure which backup is clean, our hacked website repair team can find the infection first, then restore safely.
Frequently asked questions
Are my host’s backups enough on their own?
Rarely. They’re a useful extra layer, but they’re often short-lived, stored close to your site and not guaranteed in your agreement. Keep at least one independent, off-site copy that you or your maintenance provider controls, and make sure someone has tested restoring it.
How do I find my host’s backup policy?
Search your hosting agreement or terms of service for “backup”. Then check your hosting control panel for a backups section. If the terms and the marketing page say different things, the terms are what count. Ask support to confirm the details in writing.
Do hosts charge to restore a backup?
Some do, and some only restore the whole account rather than single files or the database. Others let you restore for free from the control panel. Ask before you need it, because a restore fee during an emergency is a bad surprise.
What happens to backups if I leave my host?
They usually go when the account closes. Download a full copy of your files, database and email before you cancel. If you’re moving hosts, keep that copy until the new site has been running smoothly for a few weeks.
Should I back up my email too?
If your email is on the same hosting account, yes. Website backups often skip mailboxes, or keep them separately. Ask your host how email is backed up, or move email to a service that keeps its own history.
Sources
- Terms of Service, Bluehost (Australia), accessed 13 November 2026
- Backups, WordPress Advanced Administration Handbook, accessed 13 November 2026
- 2023 Hacked Website and Malware Threat Report, Sucuri, June 2024
- OVHcloud must pay damages for lost backup data, Blocks and Files, 23 March 2023
- The 3-2-1 backup strategy, Backblaze