If you have to ask how many website backups you need, the honest answer is: more than you currently have. And almost certainly more than one.
That sounds glib, but it’s the most common gap we see when a business comes to us after something has gone wrong. They had “a backup.” They just didn’t have enough of them, or any from far enough back, or any way to take one when it mattered. Let’s fix that.
Why one website backup is a trap
A single backup feels like insurance. It isn’t. It’s a snapshot, and a snapshot is only useful if it was taken before the problem started.
Here’s how that goes wrong. Plenty of hosting plans keep exactly one backup of your site, refreshed automatically every night. The new backup overwrites yesterday’s. On a quiet week where nothing happens, fine. But site problems rarely announce themselves on a schedule.
Most website compromises are quiet by design. An attacker injects malicious code, and instead of defacing your homepage, it just sits there. It might redirect a slice of your mobile traffic to a spam site, skim data from a contact form, or add hidden pages to game search results. You could go a week or two without noticing. Meanwhile your nightly backup has run ten or fourteen times, faithfully overwriting every clean copy with the compromised one.
By the time you spot the problem, your only backup is a backup of the problem. You can restore it perfectly and still be hacked.
The same logic applies to damage that isn’t malicious. A plugin update breaks something subtly, a database error creeps in, a staff member deletes the wrong thing. If you don’t catch it within 24 hours, a single rolling backup has already erased your last good version.
How much backup retention you actually need
This is why backup retention matters as much as the backup itself. Retention is simply how far back your restore points go. One backup gives you 24 hours of history. That’s not a window, it’s a sliver.
We recommend 15 to 30 days. Thirty is better. That range exists for a specific reason: it covers the realistic gap between when a problem starts and when a normal business actually notices it. Slow-burn malware, a gradual SEO attack, a subtle layout break that only shows up on certain devices. These get found in weeks, not hours. If your restore points only go back a day, all of it is unrecoverable.
With a 30-day window, you can do something genuinely useful when things go wrong: look at the date the problem likely began, and restore to a clean version from just before it. You’re not gambling. You’re picking a known-good point in time.
On-demand backups: the check before you change anything
Automatic daily backups handle the problems you don’t see coming. On-demand backups handle the ones you do.
Any time you’re about to change something significant on your site, you should be able to take a fresh backup first, on the spot. Updating a pile of plugins. Switching themes. Editing the database. Migrating content. Letting a developer in to make changes. All of these are routine, and all of them occasionally break things.
If you can take a backup the moment before you start, a broken update is a five-minute annoyance. You restore and try again. If you can’t, you’re relying on last night’s automatic backup and hoping nothing else changed in between. A lot of low-cost plans simply don’t offer on-demand backups at all. You get the nightly one, and that’s it.
Why low-cost hosting often gets this wrong
This is where budget hosting quietly lets people down. The backup feature is technically present, so the box gets ticked, but the details are thin. One rolling backup. No on-demand option. Restores that cost extra or require a support ticket and a wait.
Several GoDaddy plans are a good example. Depending on the tier, you may get limited backup retention, restore functionality locked behind a higher-priced add-on, or no easy way to take a manual backup before you make changes. It’s not that backups don’t exist. It’s that the version you get isn’t enough to actually save you on a bad day. Plenty of other low-cost hosts work the same way (and even some hosts that you pay a lot of money for).
The hosting looked cheap because the protection was thin. You just don’t find out which corner was cut until you need it.
How to check what your host actually does
You can settle this in about five minutes. Log into your hosting account and answer three questions honestly. How many days of backups do you currently have access to? Can you trigger a backup yourself, right now, without contacting support? If your site were compromised today, how far back could you restore?
If the answers are “one day,” “no,” and “not far,” your site isn’t really backed up. It’s exposed, and the cost of finding out the hard way is measured in lost data, lost revenue, and the days it takes to rebuild.
Backups are one of those things you never think about until the one time you desperately need them. That’s exactly why they shouldn’t be an afterthought in your hosting.
Every site we host at E11 includes 30 days of automatic backups plus on-demand backups, so you always have a clean version to return to and you can snapshot your site yourself before any risky change. No add-ons, no support ticket, no waiting. You can see how our hosting works here: https://e11group.com/services/hosting/.
