A backup retention policy answers a simple question: how many backup copies should you keep, and for how long? Small websites often either keep too few backups or keep everything forever. Both approaches create risk. Too few copies make recovery harder. Too many unmanaged copies waste storage and hide whether the backups actually work.
This guide is for WordPress sites, small SaaS projects, documentation sites, and internal tools that need a clear daily, weekly, and monthly backup plan.
Key Takeaways
- Keep enough backups to recover from both sudden failure and delayed discovery.
- Separate database backups from file backups when the site changes at different speeds.
- Store at least one backup copy away from the production server.
- Test restores on a schedule; an untested backup is only a hope.
Retention Basics
Retention is about recovery windows. A daily backup helps if something broke yesterday. A weekly backup helps if a bad change went unnoticed for several days. A monthly backup helps with longer-term mistakes, deleted content, or compliance needs.
For many small websites, a practical starting point is 7 daily backups, 4 weekly backups, and 6 monthly backups. This gives short-term flexibility without turning storage into a mess. Higher-value sites may need more frequent database backups or longer monthly retention.
Daily, Weekly, and Monthly Copies
Daily backups should capture the parts of the site that change often. For WordPress, that usually means the database and uploads. Weekly backups can include the full application directory, themes, plugins, and server configuration. Monthly backups act as long-range restore points.
Do not assume all files change at the same rate. A site with frequent posts and comments needs more database coverage. A site with large media uploads needs careful file storage planning. A mostly static site may need fewer full backups but should still protect configuration and DNS notes.
Storage Locations
Keeping backups only on the same server is not enough. If the VPS is deleted, compromised, or has disk failure, local-only backups may disappear with the site. Keep at least one copy in separate storage such as object storage, another server, or a managed backup system.
Use clear naming with site, date, and backup type. A file named wordpress-backup-final-new.zip is not helpful during recovery. A name like example.com-db-2026-05-14.sql.gz is easier to sort and trust.
Database vs File Retention
The database stores posts, pages, settings, orders, comments, and user data. Files store uploads, theme code, plugin code, and configuration. These two layers may deserve different retention rules.
For a content site, daily database backups and weekly full-file backups may be enough. For a membership or ecommerce site, database backups may need to run hourly or more often because new transactions matter. Always match frequency to how much data you can afford to lose.
Restore Testing
Retention is incomplete without restore testing. Schedule a test restore to a staging server or local environment. Confirm the database imports, files unpack, wp-config or environment variables are correct, and the site loads without critical errors.
A monthly restore test is a strong habit for important sites. At minimum, test after changing backup tools, moving hosts, changing database size, or adding critical plugins.
Sample Backup Retention Policy
- Database: daily backups retained for 14 days.
- Files: weekly backups retained for 8 weeks.
- Monthly archive: retained for 6 months.
- Storage: one local copy and one off-server copy.
- Restore test: once per month or after major infrastructure changes.
- Owner: one named person checks failures and storage usage weekly.
Common Mistakes
The first mistake is never pruning old backups. This fills disks and can cause the site itself to fail. The second mistake is backing up cache files while missing uploads or database data. The third mistake is relying on a plugin backup without knowing where the file is stored.
The fourth mistake is not protecting backups. Backups can contain private data, admin emails, API keys, or customer information. Limit access and avoid leaving public backup zip files inside the web root.
FAQ
How many backups should a small website keep?
A good starting point is 7 to 14 daily backups, 4 to 8 weekly backups, and 3 to 6 monthly backups. Adjust based on site value, update frequency, and storage cost.
Are host-level snapshots enough?
Snapshots are useful, but they should not be the only backup. Keep an exportable database and file copy so you can restore to another provider if needed.
Should backups include plugins and themes?
Yes, at least in weekly or monthly full backups. Even if plugins can be downloaded again, configuration and custom theme changes may be harder to rebuild.
Final Check
A backup retention policy should be simple enough to run every week and clear enough to use during stress. Keep recent daily restore points, longer weekly and monthly copies, off-server storage, and a regular restore test.