Ask most business owners if their WordPress site is backed up and you get the same answer: "yes, the host does it." That is usually true. It is also not a backup plan, and the gap between those two things only becomes obvious on the day you need to use it.
A backup is a file. A backup plan is knowing what exists, where it lives, how old it is, who restores it, and how long that takes. Most sites have the first and none of the rest.
What "the host backs it up" usually means
Host backups exist to protect the host. They are snapshots of a server, taken on the host's schedule, kept for whatever period the host decided, and restored on the host's terms. That is a reasonable thing for them to do. It just is not built around your business.
Read the fine print on your hosting plan and you will typically find some combination of these:
- The backup lives on the same infrastructure as your site, so an account suspension or a billing dispute can take both away at once.
- Retention is short. Seven days is common on cheap plans, which is useless for a problem you did not notice for two weeks.
- Restoring is all or nothing. You wanted one deleted page back, and the only option is to roll the entire site back to Tuesday, losing four orders in the process.
- Restores are a support ticket, not a button. Sometimes with a fee attached.
- Backups are described as "courtesy" or "best effort" in the terms, which is the legal way of saying do not rely on this.
That last one is the important one. A lot of hosting agreements explicitly state that the customer is responsible for maintaining their own backups. People sign it and never read it.
The fix: open your hosting control panel today and answer three questions. When was the last backup taken? Where is the file stored? How do you trigger a restore? If any answer takes longer than a minute to find, you do not have a plan.
The single point of failure nobody plans for
The scenario that ruins people is not a hardware failure. Hosts are generally decent at hardware. It is the account-level problem: a card expires, a chargeback gets filed, a support agent flags your site for abuse after malware appears, or you decide to leave and the relationship gets awkward.
In every one of those cases, the site and its backups are behind the same login. Lose access to the account and you lose both. A backup stored inside the thing you are backing up is not much of a safety net.
This is why off-site matters. Not off-site as in a different folder on the same server. Off-site as in a completely separate storage account that you would still control if your host disappeared tomorrow.
Old backups fail quietly
The other half of the problem is age. Site gets hacked, you find out on Thursday, and the newest clean backup is from a month ago. Technically you have a backup. Practically you are rebuilding a month of content, orders, form submissions and comments by hand, assuming you can even reconstruct them.
Any scheduled backup loses whatever changed since it ran. That is just how scheduled backups work, and anyone telling you otherwise is selling something. The honest question is not "will I lose anything" but "how much can I stand to lose, and does my schedule match that number?" A brochure site that changes twice a year and a store taking daily orders need very different answers.
The fix: write down what a week of lost work would actually cost you. Orders, leads, content, staff hours. Then compare it to how often your backups run. If the numbers do not line up, change the schedule or accept the risk on purpose rather than by accident.
Untested backups are just files
Here is the part almost nobody does: confirming the backup actually restores. Backup jobs fail silently all the time. A database export times out on a large table, a plugin excludes the uploads folder, a storage token expires and the job has been erroring for six weeks while the dashboard still shows a green tick.
Nobody notices, because the only moment anyone looks closely at a backup is the moment they desperately need it. That is the worst possible time to discover it is 200KB and contains nothing but a broken SQL dump.
A backup you have never restored is a hypothesis, not a safety net.
What an actual plan looks like
A real plan has four parts: backups that run on a known schedule, storage somewhere separate from the site, retention long enough to cover a problem you notice late, and someone who verifies the restore works before you need it.
That is exactly what Up Speed does on every plan. Scheduled off-site backups, roughly four times a month, held for 30 days, with one-click restore. And the part hosts rarely bother with: we test restores quarterly, so the file is proven to work rather than assumed to.
If you would rather not be the person checking any of this, the Starter plan covers it from $99 a month per site, and a real human handles the restore if it ever comes to that.