"My Host Handles Backups" Is the Most Dangerous Myth in WordPress Hosting

Everyone says it. "I don't need to worry about backups, my host takes care of that." You have probably heard it from a web designer, read it on a hosting comparison site, or simply assumed it because the hosting plan mentioned backups somewhere in the marketing copy.

It is not true. Or more accurately, it is not true in the way you think it is.

I have spent twenty years in Irish hosting infrastructure, and I can tell you that the gap between what business owners believe about their backups and what their hosting provider has actually committed to is the single most dangerous disconnect in small business hosting. It is not a technical problem. It is a reading-the-fine-print problem. And most people never read the fine print until the day they desperately need a backup and discover it does not exist.

What Your Hosting Provider Actually Promises

Here is what typically happens. A business owner signs up for a shared hosting plan. The marketing page mentions "daily backups" or "automatic backups" somewhere between the storage allocation and the SSL certificate. The business owner ticks the mental checkbox. Backups sorted.

Then something goes wrong. A plugin update corrupts the database. A rogue script wipes the uploads folder. Someone gains access and injects malware across every page. The business owner contacts support expecting a clean restore.

And that is when they discover the terms of service.

Most shared hosting providers include language along these lines in their hosting agreements: backups are performed on a "best effort" basis, are intended for internal disaster recovery purposes only, and the provider accepts no responsibility for the completeness, accuracy, or availability of any backup. As the WordPress Advanced Administration Handbook states plainly, your website is your responsibility, and backing it up is your responsibility too.

GoDaddy's hosting agreement, to take one widely used example, makes clear that their backup services save files once per day with storage limits based on the plan purchased, and backup add-ons are available for an additional fee. The base hosting plan does not guarantee you a usable, restorable backup. It guarantees that GoDaddy will try.

There is a meaningful difference between those two things.

The Fine Print That Costs Businesses Everything

Let me dismantle this myth layer by layer, because it is not a single misconception. It is three misconceptions stacked on top of each other.

The first misconception: backups are automatic and reliable. On shared hosting, backup processes compete for the same server resources as your website and every other site on that server. As the WordPress plugin support forums regularly document, hosting providers routinely kill backup processes that exceed resource limits. Your backup starts, runs for a few minutes, hits a CPU or memory threshold, and gets terminated. No error message. No notification. The backup simply does not complete. Veeam's Data Protection Trends research, spanning several thousand organisations globally, consistently reports that somewhere between 55% and 60% of backup restorations encounter issues of some kind, though that figure spans everything from enterprise databases to small websites and methodology varies year to year.

The second misconception: if a backup exists, it is recent. "Daily backups" does not always mean yesterday's backup is sitting there waiting for you. Some providers retain only the most recent successful backup, which might be days or weeks old if recent attempts failed silently. Others retain backups for seven days but never verify whether those backups are actually restorable. A backup file that exists on a server is not the same thing as a backup that works.

The third misconception: restoring is straightforward. Even when a backup exists and is recent, restoring a WordPress site from a raw hosting backup is not a one-click operation on most shared hosts. You may need to restore files via SFTP, reimport the database manually through phpMyAdmin, update wp-config.php with the correct database credentials, and verify that file permissions are intact. For a business owner with no technical background, that process might as well be in a different language.

I made this mistake myself, early in SmartHost's life. Trusted a provider's "daily backups included" marketing for a client migration. When we needed a restore six weeks later, the most recent backup was three weeks old and would not complete the restoration process. That conversation with the client taught me more about backup verification than any documentation ever did.

The Backup Plugin Tax

The obvious response is: install a backup plugin. And that works, to a point. But it comes with costs that most business owners do not anticipate.

UpdraftPlus, the most widely used WordPress backup plugin, offers a free tier with basic functionality. The premium version starts at around $70 per year as of 2026, adding features like incremental backups and multiple storage destinations. BlogVault, which takes a different approach by running backups on its own servers rather than consuming your hosting resources, starts at roughly $89 per year for its basic plan, climbing to $249 per year for real-time backups with a full year of storage.

These are real, capable tools. I am not dismissing them.

But consider what you are actually paying for. You are paying $70 to $250 per year for a plugin to compensate for something your hosting provider should be handling as part of the infrastructure. That is on top of whatever you are paying for hosting itself. And the plugin still depends on your server environment being stable enough to complete the backup process, which brings us right back to the shared hosting resource problem.

For a Waterford manufacturer running a trade catalogue site, that backup plugin subscription might cost more per year than their actual hosting. The economics make no sense. You are essentially paying twice: once for hosting that does not properly back up your site, and once for a third-party tool to fill the gap your host left open.

When the Backup Is Not There

Here is the scenario that plays out more often than the hosting industry would like to admit. Picture this, because it happens regularly. A business owner updates three plugins on a Tuesday afternoon. One of those plugins conflicts with the theme. The site breaks. Not dramatically, not with an error page that makes the problem obvious. The WooCommerce checkout silently stops processing payments. Nobody notices until Thursday when a customer rings to say they cannot complete an order.

The business owner contacts their host. The most recent usable backup is from the previous week, before the owner added fifteen new products and updated shipping rates. Restoring that backup means losing four days of work. Not restoring means the checkout stays broken until a developer can diagnose and fix the conflict, which typically runs somewhere between €150 and €300 for emergency WordPress support.

That is the minor scenario.

The major scenario is a security breach with no backup. Acronis research on small business preparedness found that roughly 58% of small businesses admit to being unprepared for data loss. A hacked site with no restorable backup means rebuilding from scratch. Not restoring. Rebuilding. Every page, every product listing, every customer testimonial, every carefully written service description. Gone. The professional cleanup of a compromised WordPress site typically costs somewhere between €500 and €3,000, as multiple security firms have documented. If the site needs a complete rebuild because the breach was too extensive, that figure climbs further.

And those are just the direct costs. Lost search rankings. Customers who see Google's "This site may be hacked" warning and never come back. Revenue that disappears while the site is offline. Those indirect costs are harder to quantify but often larger than the cleanup bill.

What a Real Backup System Actually Does

A backup system that genuinely protects a business website needs five things. Not three. Not "backups enabled somewhere in the settings." Five specific capabilities.

Automatic scheduling with no business owner involvement. The backup runs every night regardless of whether anyone remembers to trigger it. No plugin to configure. No cron job to set up. No storage destination to connect.

Verification that each backup completed and is restorable. A backup file that cannot be restored is not a backup. It is a false sense of security, which is arguably worse than having no backup at all, because at least then you know where you stand.

One-click restoration from a dashboard. When something goes wrong, the business owner should be able to restore their site without touching an SFTP client, a database manager, or a configuration file. The restore process should take minutes, not hours.

Pre-update safety snapshots. Before any WordPress core update, plugin update, or theme update, the system should automatically create a snapshot. If the update breaks something, you rollback to the pre-update state. A staging environment catches most issues before they reach production, but a pre-update snapshot is the safety net underneath the safety net.

Separation from the hosting environment. Backups stored on the same server as the website are vulnerable to the same failures. If the server's storage fails, you lose the site and the backup together. That is not redundancy. That is the illusion of redundancy.

This is what Web60 builds into every site on the platform as part of the complete security and backup infrastructure. Automatic nightly backups with one-click restore. Manual on-demand backups when you need them. Pre-update and pre-restore safety snapshots taken automatically before any system change. All included in Web60's €60 per year, everything-included managed WordPress hosting. Not bolted on as a paid add-on. Not dependent on a third-party plugin competing for server resources. Infrastructure-level backup, the way it should work.

Where Nightly Backups Are Not Enough

I will be honest about the limitation, because if I am not, you will find out at the worst possible time.

If you are running a high-transaction WooCommerce store processing hundreds of orders per day, nightly backups leave a gap. Between one night's backup and the next, those orders exist only in your live database. Dedicated real-time backup solutions like BlogVault's advanced tier or Jetpack VaultPress genuinely serve that workload better, because they capture every database change as it happens. That is a real requirement for high-volume eCommerce, and pretending otherwise would be dishonest.

But that is not most Irish business websites. A brochure site, a professional services firm with a contact form, a small shop processing a handful of orders per day: nightly backups with pre-update snapshots cover every realistic failure scenario.

One more practical caveat. A nightly backup means your worst-case data loss window is 24 hours. If you add 30 products to your catalogue at 9am and the site crashes at 8pm, those 30 products are not in last night's backup. The practical answer: if you are making a large batch of changes, trigger a manual on-demand backup before you start. Web60 makes that a single click from the dashboard. Know the tradeoff. A nightly backup protects you from losing everything. It does not protect you from losing today's work if today was unusually productive. That is the honest deal, and it is a vastly better deal than having no verified backup at all.

Your Backup Is Your Business

The myth that your host handles backups persists because it is comfortable. Nobody wants to think about disaster recovery for their website. It is not exciting. It does not generate revenue. It sits in the background until the day it matters more than anything else on your entire to-do list.

The businesses that get this right treat their website as a business asset with operational requirements. Verify that your backups exist. Verify that they are recent. Verify that you can restore from them without a computer science degree.

If your current hosting provider cannot answer those three questions clearly, the answer is already telling you something.

Frequently Asked Questions

How often should a small business website be backed up?

For most business websites, daily nightly backups provide sufficient protection, giving you a maximum data loss window of 24 hours. If your site processes frequent eCommerce transactions or you make content changes multiple times per day, supplement nightly backups with manual on-demand backups before major changes. Real-time backup solutions exist but add significant cost and are typically only justified for high-transaction online shops.

Are free WordPress backup plugins reliable enough for a business site?

Free backup plugins like the free tier of UpdraftPlus can work, but they run on your hosting server's resources. On shared hosting, backup processes are frequently terminated when they exceed CPU or memory limits, which means the backup may silently fail without notification. Free plugins also typically lack backup verification, meaning a backup file might exist but may not actually be restorable. For a business website where the data genuinely matters, reliability matters more than saving on a plugin subscription.

What is the difference between a hosting backup and a WordPress backup plugin?

A hosting-level backup captures your entire hosting environment, including WordPress files, the database, configuration files, and server settings. A WordPress backup plugin typically captures the WordPress installation, database, and uploads folder. The critical difference is where the backup runs and where it is stored. Hosting-level backups managed by the provider run independently of your site's resources. Plugin backups compete for your site's server resources and may fail under load, particularly on shared hosting where resource limits are strict.

Does Web60 include backups in the €60 per year price?

Yes. Automatic nightly backups, one-click restore, manual on-demand backups, and pre-update safety snapshots are all included in Web60's €60 per year pricing. There is no backup add-on, no storage limit surcharge, and no third-party plugin required. Backups are part of the managed WordPress infrastructure, not an optional extra.

How quickly can I restore my website from a Web60 backup?

Restoration is a one-click process from the Web60 dashboard. The actual restore time depends on the size of your site, but for a typical small business WordPress site, you are looking at minutes rather than hours. You do not need to use SFTP, manually import databases, or edit configuration files. The system handles the complete restoration, including files, database, and configuration.

Sources

WordPress Advanced Administration Handbook on backups and site owner responsibility (https://developer.wordpress.org/advanced-administration/security/backup/)

Veeam Data Protection Trends research on backup restoration failure rates across organisations globally (https://www.veeam.com/blog/data-loss-2022.html)

Acronis research on small business data loss preparedness and recovery costs (https://www.acronis.com/en/blog/posts/cost-of-data-loss/)

GoDaddy hosting agreement detailing backup service terms, storage limits, and add-on pricing (https://www.godaddy.com/legal/agreements/hosting-agreement)

W3Techs WordPress usage statistics as of April 2026 (https://w3techs.com/technologies/details/cm-wordpress)