WordPress Backup Strategy for Small Irish Businesses

A good WordPress backup strategy comes down to five decisions: back up both the database and the files, run it on a schedule that matches how often your site changes, keep copies in more than one place, decide how long you keep them, and test a restore. If you do those five things, a hacked site, a failed update or a deleted page is an inconvenience and not a crisis.

This guide is for sole traders and small businesses whose website brings in enquiries or sales. It shows you how to back up WordPress, what to put in writing, and where the limits are.

TL;DR

• A complete backup needs two parts: the database (posts, pages, comments, settings) and the files (core, themes, plugins, uploads).
• Match the schedule to your site. A brochure site that rarely changes can be weekly. A shop or busy blog needs daily.
• Keep several recent copies in different places: on the host, in cloud storage and on a computer you control.
• A backup you have never restored is a guess. Test a restore and write down the steps.
• Backups that hold customer data need the same protection as the live site.

Table of Contents

• What a complete WordPress backup includes
• Why small businesses need a plan
• Your WordPress backup strategy in five decisions
• Three ways to back up WordPress
• Test your restore, and write down the steps
• Irish data protection: treat backups like live data
• Common mistakes we would fix first
• Our perspective
• Get your WordPress backups set up properly
• FAQ
• Sources

What a complete WordPress backup includes

A WordPress site is two things stored in two places. WordPress’s own documentation explains that the database holds your posts, comments, links and other site data, while the files hold core, themes, plugins, uploads and other code and static files.

That has a practical consequence. The database lives outside the WordPress folder, so copying the folder does not back up the database. Copying only the database does not back up your images, theme or plugins. Many “backups” that fail on the day are only half a backup.

Treat the two parts as one set. The same documentation advises creating the files and the database backup around the same time, so they match when you restore.

What this means for a typical business site

Think about what you would lose, in plain terms:

• Database: your page text, blog posts, form entries, WooCommerce orders if you have a shop, user accounts and plugin settings.
• Files: your logo and photos, your theme and any customisation, the plugins that make forms, bookings and payments work.
• Also worth noting down: your domain registrar login, DNS records and where your email is hosted. These are not part of a WordPress backup but you will need them if you ever rebuild on a new host. Our business account ownership checklist covers who should hold which logins.

Why small businesses need a plan

Most site problems are dull. A plugin update breaks the layout. Someone deletes the wrong page. A host has a technical fault. A hacked site is the dramatic case, but it is not the only one.

The Irish figures show how thin the preparation often is. The SME Cyber Resilience State of the Sector 2025 report, based on 894 Irish enterprises, found that 78% of Irish SMEs fell into the “Low” or “Very Low” cyber resilience categories. Only 35% had a business continuity plan. The same research found that 81% of micro businesses were rated “Low” or “Very Low”, compared with 45% of medium businesses.

The cost is real too. eir business research reported by ThinkBusiness puts the annual cost of cyber risk to Irish SMEs at up to €3.4 billion, with a median cost of €8,700 per incident for firms that report attacks.

Recovery is where backups matter. The Hiscox Cyber Readiness Report 2025 found that 42% of Irish SMEs had at least one cyber attack in the previous 12 months. It also found Ireland had the lowest data recovery rate after ransomware among the surveyed countries, at 53%, against 74% in the US. A tested backup is one of the few things in your control that changes that outcome.

If your site has already been compromised, start with our guide on what to do when WordPress is hacked. Come back here to make sure it cannot cost you as much next time.

Your WordPress backup strategy in five decisions

Write these down on one page. That page is your strategy.

1. What you back up

Database and files, as one set. If you run WooCommerce, memberships or a booking plugin, the database changes constantly, so it matters most. If your uploads folder is large, you may choose to back up the database more often than the files.

2. How often

WordPress guidance says to set the schedule by how often the database changes. According to the WordPress backup guide, smaller sites with few posts can be backed up weekly, and high-activity sites with many posts should be backed up daily.

A simple way to apply that: ask how much work you could stand to redo.

The table is our practical suggestion for how to apply the WordPress guidance, not a rule. Whatever the schedule, take an extra manual backup before any major update, theme change or plugin install.

3. Where the copies live

One copy on the same server as your site is not enough. If the server fails or the account is compromised, the backup goes with it. The WordPress guidance recommends keeping at least 3 to 5 recent backups in different locations, such as the hosting server, cloud storage and a local computer. The older WordPress Codex makes the same point: one copy can be corrupted or lost, so keep several, on different media and in different places.

For most small businesses that looks like this:

1. A copy on the host, for quick restores of recent problems.
2. A copy in business cloud storage, such as the OneDrive or Google Drive account your business already pays for. Our comparison of OneDrive and Google Drive for small Irish businesses helps you choose.
3. A copy on a computer or drive you control, updated less often.

A widely used pattern is called 3-2-1: three copies, on two kinds of storage, with one off-site. One technical write-up on off-server WordPress backups adds two good habits: encrypt backups before they leave the server, and verify restores.

4. How long you keep them

Keep enough history to catch a problem you notice late. A hack or a broken form can sit unnoticed for weeks. If you only keep last night’s copy, you may only have a copy of the broken site. Decide on a number of daily copies, a number of weekly copies and a number of monthly ones, then keep to it. Storage is cheap compared with the cost of discovering the only clean copy was overwritten.

5. Who is responsible

Name one person. If you are a sole trader, that is you, or the one person you have agreed will do it. Write down who gets the failure alert, who holds the logins, and who restores. Backups that nobody owns tend to fail quietly.

Three ways to back up WordPress

The WordPress documentation lists three routes: backup software provided by your host, automatic backup plugins, or a manual copy. They can be combined.

Host backups

Many hosts run backups at server level. They are convenient, but check what is covered, how often it runs, how long copies are kept and how you restore. Do not let a host backup be your only copy, because it sits in the same account and provider as the site. If you want to know what we set up on our own hosting, see our managed Irish web hosting page.

Backup plugins

A plugin lets you schedule database and file backups and send them to storage you choose, such as Google Drive, Dropbox or other cloud storage. The usual steps are the same whichever plugin you use:

1. Install a reputable, regularly updated backup plugin.
2. Choose database and files.
3. Set the schedule from the table above.
4. Pick a storage destination that is not your web server.
5. Run a first backup by hand and check that the files appear.
6. Turn on failure notifications to an address you actually read.

Keep the plugin updated like any other. An out-of-date plugin is itself a risk.

Manual backups

You copy the site files using an FTP client and export the database using phpMyAdmin. This is useful before a big change and as a spare copy. It is slow and easy to forget, so do not rely on it alone. Save each set in its own folder named after the date, and keep the files and database from the same session together.

Test your restore, and write down the steps

A backup proves nothing until you have restored it. Most failures show up here: the backup was empty, the storage login had expired, or nobody knew the steps.

WordPress guidance on restoring is to put the files back first, then import the database. Do this on a test copy or a staging site if you can, not on your live site. Then check:

• The home page and a few inner pages load, with images.
• You can log in to the dashboard.
• Forms send and arrive in your inbox.
• If you sell online, a test order goes through.
• Links, menus and plugin settings look as they did.

Write down how long it took and what you had to look up. That note is worth more than the backup tool. We have a backup restore-test log you can use to record each test, and a short guide to starting a disaster recovery plan in 20 minutes if you do not have one yet. Test after any change to your host, your plugin or your storage account, and at least a couple of times a year.

Irish data protection: treat backups like live data

If your site holds personal data, such as customer names and emails in orders, enquiries or a mailing list, your backups hold it too. The Data Protection Commission’s data security guidance says backup systems are essential for recovering from loss or destruction of data, and that security standards for backup data are the same as for live data. It also points to measures such as encryption or pseudonymisation, the ability to restore access in good time, and regular testing of security measures.

In practice:

• Store backups in accounts protected with strong, unique passwords and multi-factor authentication.
• Do not leave backup files in a public web folder or send them by email.
• Encrypt backups where your tool allows it, especially copies on laptops or external drives.
• Delete old copies according to the retention period you set.

The DPC’s guidance for engaging cloud service providers also says organisations must be able to restore access to personal data in a timely way after a physical or technical incident, and must regularly test and evaluate their security measures. A documented restore test helps you show that. Our plain-English GDPR guide for small Irish businesses covers the wider picture.

Common mistakes we would fix first

• Only one copy, on the web server. Add an off-site copy.
• Files without the database, or the other way round. Back up both as a set.
• No notification when a backup fails. Turn on alerts to a monitored address.
• Backups tied to one person’s personal account. Use a business account that the business owns.
• Never tested. Put a restore test in the diary.
• Forgetting everything around the site. Domain, DNS and email need their own records. Our cloud backup article explains why the wider set of business data deserves the same attention, and if you use Microsoft 365, see Microsoft 365 backup for small businesses.

Our perspective

Most small businesses we speak to do not have no backups. They have one backup, in one place, that nobody has tried to restore. That is the gap we focus on.

We think a backup strategy for a small site should fit on one page and be understood by whoever owns the business. What is copied, how often, where it goes, how long it is kept and who restores it. The technical tooling matters less than having agreed those answers and checked them.

hostme.ie is one person to contact for practical business IT help, with remote support and on-site work where agreed. That means the person who sets up your backup is the person you ring when you need it restored, and the scope is agreed before work begins. For WordPress sites, that fits naturally alongside hosting, domains, security and email, because a restore usually involves more than one of them.

hostme.ie

Get your WordPress backups set up properly

If you would rather not do this yourself, we can review how your site is backed up now, set up scheduled off-site copies, and run and document a restore test. We agree scope and cost before any work starts. Ad-hoc help and separately scoped projects are available, and managed support has an initial 12-month term.

The next step is to message us on WhatsApp with your website address and who hosts it. You can also phone or email if you prefer. See our backup and recovery services or our wider IT support page. If you are in Galway or Mayo, our pages for Tuam and Claremorris have local detail.

FAQ

How do I back up a WordPress site?

Back up both the database and the files. You can use your host’s backup tool, a backup plugin that saves to cloud storage, or copy the files by FTP and export the database in phpMyAdmin. Whichever you choose, send at least one copy somewhere other than your web server and run a test restore.

How often should I back up WordPress?

It depends on how often your site changes. WordPress guidance suggests weekly for smaller sites with few posts and daily for busy ones. If you take orders or bookings through the site, daily is the sensible starting point, and always take a copy before updates.

How many backups should I keep?

WordPress recommends keeping at least 3 to 5 recent backups in different places, such as the host, cloud storage and a local computer. Beyond that, keep enough older copies to cover a problem you notice late, and set a retention period so you are not holding personal data indefinitely.

Is a backup plugin enough?

A plugin is a good tool, but the strategy is what protects you: off-site storage, failure alerts, a sensible schedule and a restore test. A plugin that saves only to your own server, or that nobody monitors, leaves gaps.

Do GDPR rules apply to my backups?

Yes, if they contain personal data. Irish Data Protection Commission guidance says backup data should have the same security standards as live data. That means access controls, encryption where appropriate and regular testing of your ability to restore.

Sources

• WordPress Advanced Administration: Backups
• WordPress Codex: Backup di WordPress
• SME Cyber Resilience: State of the Sector 2025
• ThinkBusiness: Irish SMEs count €3.4bn cost of cyberattacks
• Hiscox Cyber Readiness Report 2025
• Off-Server WordPress Backups: 3-2-1 With restic or borg
• Data Protection Commission: Data Security Guidance
• Data Protection Commission: Guidance for Engaging Cloud Service Providers

Recommended

• WordPress Hacked? Containment and Recovery
• NAS vs Cloud Backup: Which Suits a Small Business?
• Cloud Backup Business Ireland — The Insurance Policy You’re Forgetting
• Veeam vs Acronis: which backup suits a small business?