Almost every site owner believes they have backups. Far fewer have backups that would actually bring the site back. The gap between those two things usually only becomes visible on the worst possible day.
1. Half a backup is not a backup
A website is two things: files and a database. The files are your code, images, themes and uploads. The database holds your pages, posts, products, orders and settings.
Plenty of backup tools save one and not the other. Files without the database gives you an empty shell. A database without the uploads folder gives you text with every image broken. You need both, from the same moment in time.
2. The backup lives on the same server as the site
This is the most common mistake. If the backup sits in a folder on the same hosting account, then a hacked server, a failed drive or a suspended account takes the backup with it.
A backup needs to exist somewhere your hosting cannot reach — cloud storage, another provider, or a copy you download. One copy off the server is worth ten copies on it.
3. Nobody has ever tested a restore
An untested backup is a hope, not a plan. Files get truncated, exports fail halfway, a database dump misses a table, the archive is corrupt. You find out at the moment you can least afford to.
Test it once. Restore to a staging subdomain or a local environment and click around. If it comes back, you now know your backups work. If it does not, you just discovered that in a calm week instead of a catastrophic one.
4. The schedule does not match the site
A brochure site that changes twice a year does not need hourly backups. A shop taking orders every day absolutely does — a nightly backup means a bad morning can lose a day of orders.
Ask yourself how much work you are willing to redo. That answer is your backup interval.
5. Only one copy is kept
If your system overwrites the same backup every night, and the site was compromised or corrupted four days ago, every copy you have is broken. Keep a rolling history — several daily copies, a few weekly, a monthly. Storage is cheap compared to rebuilding.
6. Everything else is forgotten
Your site is not the only thing that matters. Also record where the domain is registered and who controls it, your DNS records, your email accounts, and your SSL setup. A perfect file backup does not help if nobody can find the domain login.
Keep that in a document with the backups. Future you, or whoever replaces you, will need it.
A setup that works for most small sites
Daily automatic backup of files and database, stored off-server, with thirty days of history kept, plus a manual backup taken before any major update — and one restore tested every few months to prove the whole thing works.
That is not complicated and it is not expensive. It is just the difference between an afternoon of inconvenience and losing the site.