Website backups: what to copy, how often, and where to keep it
A backup nobody has ever restored is not a backup, it is a hope. You learn the difference on the worst possible day.
What to copy
A site has two halves and both matter: files (code, templates, uploaded images) and the database (page text, products, orders, enquiries, users). A file-only copy is useless for a shop.
Keep configuration separately too — web server settings, cron jobs, environment variables holding integration keys. These are rarely in automated backups and cost the most time during a move.
Frequency and retention
Frequency answers one question: how much data are you willing to lose? A brochure site changed quarterly is fine with weekly copies; a shop taking daily orders needs at least a daily database dump.
Retention matters as much. Infection or silent data corruption surfaces a week later, by which point a single overwritten copy already contains the problem.
Restore testing
Once a quarter, restore to a test subdomain and confirm the site loads, the database attaches and images are present. Broken archives and partial dumps only reveal themselves this way.
Time the restore while you are at it: that number is what you can honestly tell management on an outage day.