Back up your website, email, and files

If your website, business email, or files vanished tomorrow, could you get them back? This guide helps you list what matters, put a second copy of each somewhere safe, and set up a short monthly check so you know those copies actually work.

Before you start

• About an hour for the first run. After that, the monthly check takes around 15 minutes.
• The logins for your website, your domain, your email, and your cloud storage. If you don’t know one, step 1 helps you find it.
• Somewhere to keep a second copy: an external hard drive or USB stick, or a second cloud account.
• A notebook or a simple document to write your list in.

Want to do it yourself?

Difficulty

6 out of 10

Estimated completion time

1–2 hours, plus backup transfers and a monthly restore check

Skills you’ll need: Use hosting, email, and cloud-file backup controls. You must restore a test copy and confirm it opens correctly.

I’ll do it myselfI’d rather get help

How this helps your brand

Your brand depends on more than its visible pages: email, files, and captured customer records keep work moving. Separate copies and restore checks help you recover the business process as well as its presentation.

1. 1

   Step 1: List everything you’d hate to lose

   You can’t back up what you’ve forgotten about. Start with a plain list of the things your business runs on. For each one, write down where it lives, who can log in, and whether it has any backup today.

   Most small businesses have something in each of these groups:

   Trace what happens after a visitor contacts or books through your website. Add the original form records, enquiry list or CRM, booking system, uploaded files, and notification service to your inventory. For each, note the business-owned account, export or backup option, retention limits, and who can restore it. A code export, an email notification, and a database backup protect different parts of that journey.

   • Website: who hosts it or which site builder it uses (for example WordPress on a hosting company, Squarespace, Wix, or Shopify).
   • Domain name: your web address, and the company you pay for it each year. This is called the registrar.
   • Business email: the service behind it, such as Google Workspace, Microsoft 365, or your web host.
   • Files: documents, photos, price lists, contracts, and customer lists, and which computer or cloud folder they sit in.
   • Key accounts: bookkeeping, booking, online shop, and social media logins.

   Tip: If only one person knows a login, write down where to find it, and keep that note somewhere safe and private. A password manager is the simplest place.

2. 2

   Step 2: Back up your website through your host or site builder

   How you back up a website depends on where it lives. Log in to your hosting account or site builder and look for a section called Backups, Export, or Site history. The exact menu names change often, so search your provider’s official help pages for “backup” or “export” to find their current steps.

   What to look for:

   • Hosting company (common with WordPress): check whether automatic backups are switched on, how often they run, and how long they are kept. Download one full backup to your own computer as well.
   • WordPress: a backup has two parts, the files and the database. Make sure your backup includes both. Many hosts do this for you, or a backup plugin can.
   • Site builders such as Squarespace, Wix, or Shopify: these usually keep your site running for you, but many can’t export the whole site. Export whatever they allow, such as products, orders, customers, and blog posts, and keep your own copies of your text and images.
   • Domain name: log in to your registrar and check that auto-renew is on and the contact email is one you still read. A lapsed domain can take your website and email down together.

   Tip: If someone else built or manages your site, ask them in writing: “Where are the backups kept, how often are they made, and how would I get a copy?” Keep their answer with your list.

   Illustrated exampleA WordPress backup needs two parts

   Example WordPress backupnorthline-site-2026-10-01.zip

   Full backup

   1. Website files

   • uploads/ Photos and documents
   • themes/ Site appearance
   • plugins/ Extra site features

   2. Database

   database.sql

   • Page and post text
   • Site settings
   • Other stored site data

   Check that your backup includes both parts, then download a copy.

   Your provider may package these differently. Site builders may only export selected content.

3. 3

   Step 3: Back up your business email

   Most email services keep your messages on their servers, but that isn’t the same as a backup. If an account is deleted, hacked, or locked, the messages can go with it.

   Look in your email service’s settings or admin area for an option called Export, Download your data, or Archive. Google Workspace and Microsoft 365 both offer ways to export a mailbox; their official help pages show the current steps. If your email comes with your web host, check their help pages too.

   Save the export file with your other backups. Do it once now, then on a schedule that suits how much you rely on email. For most businesses, every month or every quarter is enough.

   Tip: Keep your contacts and calendar too. They are often a separate export from your messages.

4. 4

   Step 4: Keep your files in the cloud, plus one other copy

   Files sitting on one laptop are one spill, theft, or failed drive away from gone. Move your working files into a cloud storage folder, such as Google Drive, OneDrive, Dropbox, or iCloud Drive, so they sync off your computer automatically.

   Then make one more copy somewhere separate. Sync alone is not a backup: if a file is deleted or damaged on your computer, the cloud copy usually changes too. A second copy protects you from that.

   • Simple option: copy your important folders to an external hard drive once a month, then unplug it and store it somewhere other than next to your computer.
   • Hands-off option: use a backup service or your computer’s built-in backup tool (Time Machine on a Mac, File History or Windows Backup on a PC) pointed at an external drive.
   • Put your website and email exports from steps 2 and 3 in the same place, so all your backups live together.

   Tip: A common rule of thumb: three copies of anything important, on two different kinds of storage, with one kept away from your office.

   Illustrated exampleSync and a separate backup do different jobs

   Working copies · linked by syncA deletion can travel with the file.

   Your laptopprice-list.pdfDeleted here

   Sync

   Cloud folderprice-list.pdfDeletion may sync here

   Separate copy · drive unpluggedMonthly backup / 2026-10-01price-list.pdf

   The saved file stays on this drive when the working copy is deleted.

   After copying, unplug the drive and keep it somewhere separate from your computer.

5. 5

   Step 5: Test a restore, then repeat it every month

   A backup you have never opened is a hope, not a plan. Test that you can get something back before the day you need it.

   Pick one thing from each group and try to open it from your backup: a document from your external drive, an old email from your export, and a recent backup in your website host’s backup list. If anything won’t open or is missing, fix that backup now.

   Then put a 15-minute monthly reminder in your calendar. Each month, check:

   For the website workflow, ask for a safe recovery test in a separate copy or provider test environment. Restore the needed pages and records, reconnect authorised services, and use a controlled enquiry to verify capture, notification, and access for the follow-up owner. Do not send messages to real customers or overwrite live records as a test. If you can only inspect a downloaded file, record that limited check; it does not prove the complete workflow can be restored.

   • The newest website backup is recent, and you can see or download it.
   • Your file copy on the external drive or second account was updated this month.
   • One random file opens from the backup.
   • Your domain renewal date, and that the payment card on file hasn’t expired.
   • Any new tool or account you started using has been added to your list.

   Tip: Don’t test a website restore by overwriting your live site. Ask your host or web person if they can restore to a test copy, or simply confirm the backup file downloads and isn’t empty.

   Illustrated exampleRehearse getting something back

   15 minutesYour monthly backup check

   1. Open a fileFrom the separate drive

      Can you read the saved price list?

   2. Open an old emailFrom your mailbox export

      Can you find and read a saved message?

   3. Check the site backupFrom your hosting account

      Is it recent, downloadable and not empty?

   For a full website restore test, ask your host to use a test copy.

I run a small business and I want to make sure I never lose my website, email, or files. I’m not technical, so please use plain English and short steps.

Here is what my business uses:
Website: [your host or site builder, e.g. WordPress on a hosting company, Squarespace, Wix, Shopify]
Domain registrar: [the company you pay for your web address]
Business email: [e.g. Google Workspace, Microsoft 365, your web host]
Where my files are: [e.g. my laptop, Google Drive, Dropbox, a shared office computer]
Other important accounts: [e.g. bookkeeping, booking system, online shop]
What I already back up: [anything you already do, or “nothing yet”]

Turn this into a personal backup checklist. For each item, tell me:
1. What to back up and where to keep the second copy.
2. What to search for on the provider’s official help pages to find the current steps (don’t guess menu names).
3. How often to do it.

Then give me a short monthly check I can do in about 15 minutes, written as a list I can tick off. Point out anything on my list that has no backup at all, starting with the biggest risk.

Include the systems behind website enquiries and bookings, not only the visible site: original submissions, enquiry lists or CRM, booking records, uploads, notification services, and private configuration. Distinguish code copies from data backups. Specify ownership, official recovery options, and a safe private test of capture through follow-up access. Clearly label anything whose restore has not actually been tested.