Why backups fail when you need them most
Everyone nods at how to backup a website until the day something breaks, and then a depressing number discover their backups were imaginary. The classic failures: backups stored on the same server that just died, backups that stopped running silently months ago, backups of files without the database, and backups nobody ever tested restoring. A backup is not a file; it is a verified recovery path. Before this guide gets tactical, internalise the standard: automated, off-site, versioned, covering files plus database, with a restore you have actually performed. Anything less is optimism. The good news is that reaching that standard takes about an hour of setup and then runs itself. Whether you use your host’s backups, a plugin, or manual copies, judge every method against those five words: automated, off-site, versioned, complete, tested (checked 14 Oct 2026).
What your host’s backups do and do not cover
Host backups are your first layer, and you should know exactly what yours includes. Hostinger provides weekly backups on Premium shared plans and daily backups on Unlimited and Cloud plans, restorable from hPanel. That is a solid baseline for most small sites. But understand the limits: these backups live on the host’s infrastructure, retention windows are finite, and restoring usually means rolling back the whole account rather than one file. If the hosting account itself has a billing or security problem, host-only backups are at risk alongside the site. So treat host backups as layer one, not the whole strategy. For a hobby blog they may genuinely suffice. For anything that earns money or took months to build, add an independent layer. Knowing your plan’s backup frequency before disaster strikes is part of choosing the right tier; compare them at Hostinger web hosting and Hostinger cloud hosting.
Plugin backups: the setup that actually works
For WordPress, a backup plugin sending copies to independent cloud storage is the standard second layer. UpdraftPlus is the established free option: install it, connect it to Google Drive, Dropbox, or similar, schedule daily or weekly automatic backups of files plus database, and set a sensible retention count like four to eight copies. The settings that matter most are the destination being off your server, the schedule actually being automatic, and files plus database both included. Paid tiers add incremental backups and easier restores, worth it for stores. Non-WordPress sites can use similar tools or host-level snapshots, but the principle is identical: automation plus off-site destination. Do not rely on manual exports you promise yourself you will do monthly; you will forget, and the one month you skip will be the month you need it. Automation is not laziness here; it is the entire point. Set it once, verify the first few runs land in your storage, then let it work.
How to backup a website manually, step by step
Sometimes you need a manual backup: before a risky migration, before a major redesign, or as a one-off snapshot. Here is how to backup a website by hand. First, back up the files: connect via FTP or your host’s file manager and download the entire public_html directory, or compress it on the server first if your panel allows, which is far faster for large sites. Second, back up the database: in phpMyAdmin, select your WordPress database and export it as SQL, or use your panel’s database backup tool. Third, store both somewhere safe: your computer plus a cloud drive, not just one. Fourth, label the archive with the date and what it contains. Manual backups are complete control with zero automation, which makes them perfect for pre-change snapshots and terrible as your only strategy. Do one before every major change, even if automated backups run daily; the five minutes it takes is the cheapest insurance in web publishing.
The 3-2-1 rule and testing your restore
The professional standard is the 3-2-1 rule: three copies of your data, on two different media or locations, with one copy off-site. In practice for a website owner: your live site is copy one, your host's backup is copy two, and your plugin's off-site backup is copy three. That already satisfies the rule with minimal effort. Then comes the step almost everyone skips: testing the restore. Once, when you set everything up, restore a backup to a staging subdomain or a local install and confirm the site actually works. Note how long it takes and what the steps are, while you are calm, not during an outage. Re-test after any major change to the backup setup. A tested restore turns backup theory into a recovery plan you can execute under pressure. Put a quarterly reminder in your calendar; it takes twenty minutes and it is the difference between a bad day and a lost business. Managed options with stronger backup guarantees are compared at best managed web hosting.
When Hostinger backups are not enough
Be blunt about the ceiling. Hostinger's weekly backups on Premium are too sparse for a store or any site updated daily; if that describes you, the plan tier is wrong or you need a plugin layer regardless. Host backups cannot help if the account itself is compromised or suspended, which is exactly when you need backups most. Restores are account-level rollbacks, not surgical single-file recoveries, so a small mistake can mean rewinding everything. And Hostinger, like most budget hosts, is not a backup company: retention windows and restore support have limits that a dedicated backup service does not. None of this makes Hostinger bad; its backup offering is fair for the price. It just means your strategy must include an independent copy the moment the site matters. The honest rule: the more the site is worth, the less any single backup location should be trusted, whoever the host is (checked 14 Oct 2026).
| Method | Automation | Off-site | Best for |
|---|---|---|---|
| Host backups | Automatic | No | Baseline for small sites |
| Backup plugin | Automatic | Yes | WordPress sites that earn |
| Manual copies | Manual | Your choice | Pre-change snapshots |
| Cloud snapshots | Automatic | Yes | VPS users |
| 3-2-1 combined | Automatic | Yes | Anything you cannot rebuild |
Cloud Startup
48-month plan, paid upfront
Renews at $25.99/mo
- Unlimited websites
- 100 GB NVMe storage
- 4 CPU cores + 4 GB RAM
- Daily and on-demand backups
- Free domain for 1 year
FAQ
A complete backup includes all website files plus the database. For WordPress that means wp-content, core files, and a full SQL export of the database. Files without the database, or the database without files, cannot produce a working restore on their own.
For active sites, daily automated backups with several retained versions. For rarely-changed brochure sites, weekly is fine. Before any major change, take a manual snapshot regardless of schedule. Frequency should match how often the site changes and how much data you can afford to lose.
Host backups are convenient and free with your plan, but they live on the host's infrastructure with finite retention. Plugin backups to independent cloud storage survive hosting-level problems. Use both: the host's for convenience, the plugin's for independence.
Spin up a staging copy or a local environment and run the full restore there, then check that pages load and the database is intact. Do this at least once when you set backups up, and again after any major change to the backup setup. An untested backup is a guess.
Restore the most recent clean backup from before the hack, then change all passwords, rotate salts, update everything, and scan for leftover malicious files. If you have no clean backup, professional cleanup is worth paying for before rebuilding blindly. Document what happened so you can prevent a repeat.
Keep multiple dated versions, not just the latest. If malware sat undetected for weeks, the newest backup may already be infected. Retention of four to eight versions gives you clean rollback points. This is why versioned backups beat single snapshots.