---
title: Backups that actually restore
description: A backup only counts if it restores, so this Security Monday covers restore testing, retention, offsite copies and what your host does and does not do.
date: 2026-05-04
updated: 2026-05-04
tags: [security monday, backups, recovery]
url: "https://drivenhost.com/blog/backups-that-restore"
author: DrivenHost
---

Security Monday is back, and this time we are talking about the safety net under everything else: backups. Or more precisely, restores, because after two decades of running servers we can tell you that nobody has ever needed a backup. They needed a restore, and the two are not the same thing.

## An untested backup is a hope, not a plan

The saddest tickets we handle follow one script. A site breaks or gets compromised, the owner says "it's fine, I have backups", and then we open them together. The backup plugin silently stopped running eight months ago. Or it backed up the files but never the database. Or the archive is there but corrupt. The owner did everything except the one step that would have caught all of this: trying a restore.

So here is the rule this whole post hangs on. A backup you have never restored is unverified, and unverified means you do not know if you have a backup.

Test it the low-stakes way: take a recent backup and restore it somewhere harmless, a subdomain, a local environment, a temporary account. Confirm the site comes up, the content is current, and you can log in. Once or twice a year is plenty. The first test is the one that finds the surprises.

## Retention: yesterday is not enough

One backup from last night sounds safe until you meet the problems that arrive quietly. Malware injected three weeks ago. A table that got mangled during some forgotten plugin update last month. If you only keep one recent copy, your backup faithfully preserves the damage.

You want depth, not just recency. A pattern that has served our customers well: daily backups kept for a week, weeklies kept for a month, and a monthly or two beyond that. Storage is cheap. The ability to reach back past the day something went wrong is what you are actually buying.

## Offsite means somewhere your attacker isn't

Where the backup lives matters as much as whether it exists. A backup archive sitting in the same hosting account as the site fails exactly when you need it most: an attacker with access to the site has access to the backup, and disk-level problems take both at once.

At least one copy should leave the building. Cloud storage, another server, even a scheduled download to an office machine. The test is simple: if your hosting account were completely emptied tonight, could you still put your hands on a copy? If the answer is no, the backup is decoration.

## Host backups and your backups do different jobs

We run server-side backups across our [hosting](/hosting) platform, and they have saved a lot of bacon over the years. But we tell every customer the same thing: our backups are the second line, not the first.

Host backups run on the host's schedule and retention, sized for the whole server rather than tuned to your business. They are excellent for "the account is wrecked, roll it back". They are less suited to "I need the product table as it stood before Tuesday's import". Your own backups are the ones you configured, whose retention matches how your site changes, and which restore on your terms without waiting on anyone.

The setup we consider properly safe is both, running independently. Two systems, two locations, no shared failure. We compared the established WordPress options in [our backup plugins roundup](/blog/backup-plugins-compared) if you are choosing one; any of them beats none of them.

And as we said when covering [why updates matter](/blog/why-updates-matter), a backup taken right before an update is the cheapest insurance in this whole business.

## This month's homework

Three items. Check that your backups have actually run recently. Get one copy stored outside your hosting account. Then restore one, anywhere, just to watch it work.

Do that and you have converted a hope into a plan. If you would like to know exactly what our server-side backups cover for your account before you decide what to run yourself, ask our [support team](/support) and we will spell it out.