Start with what you would need to restore
Before choosing a schedule, list the parts of your website that would be difficult to recreate. For many small organizations, that means the website files, database, uploaded images and documents, and settings that control how the site works. A copy of the visible pages alone may not include form entries, account information or content stored in a database. Ask your website provider what its backups contain rather than assuming everything is covered.
Keep a separate record of essentials that may sit outside the website backup: domain and hosting account details, the names of important services, and instructions for reconnecting them. Store this record securely, with access limited to people who need it. The aim is not just to save data; it is to give someone a clear starting point if the usual website administrator is unavailable.
Match the schedule to the cost of losing recent changes
The central question is simple: how much recent work could your organization afford to redo? A brochure-style site updated once a month may need a different schedule from a site that receives bookings or publishes daily. If losing a week of changes would be painful, a weekly backup is too far apart. If important information changes throughout the day, consider more frequent backups and check whether the relevant submissions are included.
For example, a community group that posts news each Friday might take an automatic daily backup and an extra copy before major site changes. A small shop that regularly updates products and receives orders would need to think about much shorter gaps, especially for its database. These are starting points, not universal rules. Choose a schedule you can maintain, then revisit it when the way you use the site changes.
Keep a copy away from the website
A backup stored only on the same hosting account as the live site may disappear or become inaccessible alongside it. Arrange for copies to go to a separate storage account or backup service. Where practical, use an account with its own login and limited permissions. This separation gives you another route to your files if the website account has a technical failure or is compromised.
Check how the copies reach that location. An automatic transfer is easier to maintain than a task someone must remember each week, but it still needs occasional attention. Confirm that new backups arrive, that storage has enough room, and that the person responsible can find and download a copy. Protect backup accounts with strong, unique passwords and multifactor authentication where available. Backups may contain private information, so access should be restricted.
Keep more than the newest backup
The most recent copy is not always the one you want. A broken page, unwanted change or unnoticed problem may already be present in it. Keeping several older copies gives you a better chance of finding a usable version. Decide how long to retain them based on how quickly you are likely to notice problems, how often the site changes, storage limits, and any obligations that apply to your organization.
Write down a simple retention plan, such as keeping recent daily copies plus a smaller set of older ones. Review that plan if storage costs grow or the site starts holding different kinds of information. Avoid keeping sensitive backup data indefinitely just because space is available. Make sure old copies are removed in a controlled way, and do not let automatic cleanup leave you with no usable backup.
Test the restore, then make it a routine
A successful backup notification does not prove that you can rebuild the site. Periodically restore a copy to a safe test location, not over the live website, and check key pages, images, forms and administrative access. Note anything that needs separate setup, such as connecting email or updating configuration settings. If a full test needs technical help, arrange it before an emergency rather than learning the process during one.
Give one person responsibility for checking that backups run and another person access to the recovery instructions if the first is away. Record where copies are held, who can access them, how to request a restore, and when the last test succeeded. A short, repeatable routine is more valuable than an elaborate plan nobody follows: back up on a schedule, confirm copies are separate, keep useful older versions, and practise bringing the site back.
