Your host backs up your site. That is not a backup strategy.

Every host advertises backups, including us. They are genuinely useful and they are not a strategy, because they protect against one failure mode — the server breaking — and that is the least likely thing to happen to you.

What actually happens is a plugin update breaking the site, someone deleting the wrong thing, or a compromise that sits unnoticed for a fortnight.

The three questions

How much work can you afford to lose? A brochure site that changes monthly is fine with weekly backups. A shop taking orders hourly is not — losing a day means losing orders you cannot reconstruct.

How far back can you go? This is the one host backups fail. If you keep seven days and a compromise happened three weeks ago, every copy you have is infected. Malware and slow corruption need depth, not just recency.

Where does the copy live? A backup on the same server is not a backup. It is a convenience. If the account is suspended or the disk fails, both copies go together.

A setup that is actually enough

For most small sites, three layers:

1. Your host's automatic backups for quick restores — a broken update at 10 pm, fixed in five minutes.
2. A weekly off-site copy to Google Drive, Dropbox or S3. Any decent WordPress backup plugin will do this on a schedule; cPanel can also push a full backup to remote storage.
3. A manual copy before anything risky — a theme change, a PHP version bump, a plugin you have never used. Thirty seconds that saves an evening.

Test the restore

This is the part everyone skips, and it is the only part that matters. A backup you have never restored is a hypothesis.

Once — just once — restore into a subdomain or a local environment and check the site actually comes up. People discover their backups excluded the database, or captured files but not email, or silently truncated at a size limit. Far better to find that on a Tuesday afternoon than during an outage.

What to keep beyond files

Files and database are obvious. Also write down, somewhere outside the server: your DNS records, your nameservers, which registrar the domain is at, and the list of email accounts. Rebuilding a site from a good backup is easy. Rebuilding DNS from memory at 2 am is not.