“We have backups” is one of the most common things a small business owner tells me, and one of the most common things that turns out not to be quite true. Sometimes the backups exist but nobody has ever restored one, so nobody actually knows if they work. Sometimes “backups” means the hosting company’s generic snapshot, which the fine print says isn’t guaranteed and isn’t meant for customer use. Sometimes they existed for a year and then silently stopped after a plugin update broke them, and nobody was watching to notice.
None of that matters until the day it does. Here’s what that day actually looks like, in the situations I see most.
Scenario 1: a plugin update breaks the site
You click “update all” on a Tuesday morning, and the site goes white: a blank page, or a fatal error message where your homepage used to be. This happens more than people expect; plugins conflict with each other or with your theme in ways nobody can predict until it happens on your specific site. With a real backup, this is a five-minute fix: restore to an hour ago, and it’s like it never happened. Without one, you’re stuck combing through error logs or paying someone, hourly, to reverse-engineer what broke.
Scenario 2: the site gets hacked
Malware, a defacement, a pile of spam pages injected into your site overnight. Cleaning an active infection by hand means finding every piece of malicious code the attacker left behind, and missing even one means they’re back in a week. Restoring from a clean backup taken before the compromise sidesteps that entire problem.
Scenario 3: your host has a bad day
Hosting providers fail too: hardware dies, a data migration goes wrong, an account gets flagged and suspended by mistake. “It’s hosted, so it’s backed up” is not a safe assumption; ask what your specific host actually guarantees, in writing, and you’ll often find the answer is “nothing.”
Scenario 4: someone on your team deletes the wrong thing
Not malicious, just human. A page gets deleted while cleaning up old content, or a bulk edit goes wrong. Undo doesn’t reach very far back in WordPress. A backup does.
What “we have backups” should actually mean
Three things, all of which are easy to skip and all of which matter:
- Automated: not something a person has to remember to run.
- Off-site: stored somewhere other than the same server the site lives on, so a host failure can’t take out the backup along with the site.
- Tested: actually restored at least once, so you know it works before the day you need it to.
That third one is the one almost everyone skips, and it’s the one that matters most. A backup nobody has ever restored is a guess, not a safety net. It’s one of the plainest, most unglamorous things a maintenance plan does, and also the single thing most likely to turn a bad day into a non-event.