Website Backups: Why It’s the Cheapest Insurance for Your Business

A villa rental site in Canggu got hit by a malware injection last year that quietly redirected checkout pages to a fake payment gateway for eleven days before anyone noticed. By the time the owner found out — from a guest who complained her card was charged twice by two different merchants — Google had already flagged the domain as unsafe, three booking platforms had paused the listing, and the hosting company’s own backup had been overwritten twice by their nightly rotation. There was no clean version of the site left to restore. The rebuild took five weeks and cost more than two years of the maintenance plan the owner had originally decided he didn’t need.

That story isn’t unusual. Most website owners think about backups the same way they think about fire extinguishers — something you’re vaguely aware you should have, until the one day it’s the only thing standing between “minor inconvenience” and “start over from zero.” The difference is that a fire extinguisher costs a fixed amount whether or not you ever use it. A missing backup only shows its real price the day you need one and don’t have it, and by then the bill is set by whoever has to rebuild your business, not by you.

This is really what people mean when they say website backups are the cheapest insurance a business can buy. Insurance you hope never to use, priced at a fraction of the loss it protects against. Below is what that actually looks like in practice — the different types of backups, where they should be stored, how often to run them, how to test that a restore genuinely works, and a real cost comparison between paying for backups and paying to rebuild.

Full Site, Database-Only, and Incremental: Know What You’re Actually Backing Up

Not all backups protect the same thing, and this is where a lot of business owners get a false sense of security. Three types matter for a typical WordPress or WooCommerce site:

• Full site backup — every file: theme, plugins, uploaded images, the WordPress core, plus the database. This is the only type that lets you rebuild a site from nothing if the server itself is wiped or the hosting account is terminated. It’s the slowest to create and the largest to store, which is why many hosts quietly skip it in favor of database-only snapshots.
• Database-only backup — covers posts, pages, product listings, orders, customer accounts, form submissions, and settings. This is what changes constantly on an active business site. If a plugin update corrupts your database or someone accidentally deletes 40 products, this is what saves you — but it won’t help if the malware infection is sitting in a theme file, because that file isn’t in the database at all.
• Incremental backup — instead of copying everything every time, it only saves what changed since the last backup. This is what makes daily (or even hourly) backups realistic without eating your storage quota or slowing the server down during business hours.

A site that only takes database backups looks safe until a malware injection or a bad plugin update touches core files — at which point there’s nothing to restore from. A site that only takes full weekly backups looks safe until someone processes forty orders on a Friday and the server crashes on Saturday before the next backup runs. The combination — full backups on a schedule, with incremental database snapshots layered on top — is what actually closes the gap.

Where Backups Should Actually Live

The single biggest mistake we see on client sites in Bali is backups stored in the same hosting account as the live site. It feels convenient, and cPanel or a hosting dashboard often makes it the default. It also means that if the server is compromised, if the host suffers a data center failure, or if the account is suspended for non-payment, your backup disappears at the exact same moment your live site does.

A backup only counts as protection if it lives somewhere independent of the thing it’s protecting. In practice that means:

• At least one copy in cloud storage separate from your hosting provider — Google Drive, Dropbox, or Amazon S3 are common and inexpensive.
• A copy that isn’t touched by whatever caused the original problem — if malware can reach your hosting file manager, it can potentially reach anything mounted to the same account.
• Version history, not just the latest snapshot — if you only keep one backup and it gets overwritten right after an infection, you’ve backed up the infected version.

This is also where “cheapest insurance” starts to earn the label literally. Offsite cloud storage for a typical small business site runs a few dollars a month. Compare that to the days of lost bookings, lost orders, and lost search ranking while a site is down or flagged as unsafe, and the math isn’t close.

How Often You Actually Need to Back Up

The right frequency depends on how much changes on your site, not on a generic rule of thumb. A five-page brochure site for a consulting firm that gets updated twice a year can reasonably run weekly backups — nothing meaningful is lost if you lose six days of changes that didn’t happen. An active WooCommerce store taking orders every hour is a completely different situation. Losing a day of backups there means losing a day of orders, customer records, and payment confirmations, which creates real accounting and customer service problems on top of the technical mess.

A practical guide that covers most Bali-based businesses:

• Static brochure or portfolio sites — weekly full backup is usually enough.
• Sites with a blog or regularly updated content — daily backup, so you never lose more than a day of editorial work.
• E-commerce or booking sites processing transactions — daily full backup plus real-time or hourly database backups, so an order placed at 2pm isn’t gone if something breaks at 4pm.
• Before any plugin, theme, or WordPress core update — a manual backup regardless of your regular schedule. This is the single most common moment small sites break, and it’s the easiest one to protect against.

Testing a Restore Is the Part Everyone Skips

Here’s an uncomfortable fact: a backup you’ve never restored is a backup you don’t actually know works. Corrupted files, incomplete database exports, and backup plugins that silently stop running after a hosting migration are all extremely common, and none of them announce themselves until the day you desperately need the file that turns out to be broken.

Testing a restore doesn’t need to be complicated. The reliable way to do it:

• Spin up a staging site or a local environment separate from the live site.
• Restore your most recent backup into that environment, not into production.
• Check that the site actually loads, that recent orders or posts are present, and that login access works.
• Do this at least once a quarter, and immediately after switching hosting providers or backup plugins — migrations are exactly when backup routines quietly break.

Businesses that skip this step often discover the problem at the worst possible time: mid-crisis, with a client’s site down and a “backup” file that either won’t open, is missing the last three weeks of content, or restores a database without any of the media files that go with it. A twenty-minute quarterly check is a small price for knowing the insurance policy you’re paying for will actually pay out.

The Real Cost Comparison: Backup Subscription vs Rebuilding From Scratch

Numbers make this easier to argue for internally, so here’s a realistic comparison based on the kind of small-to-mid business sites common in Bali — a restaurant, villa, tour operator, or boutique retail site with 15–40 pages and moderate traffic.

• Managed backup as part of a maintenance plan: typically included or added for a modest monthly fee — commonly in the range of Rp 300,000–800,000/month depending on site size and backup frequency, covering automated offsite backups, monitoring, and restore support.
• Rebuilding a hacked or lost site from scratch: design and development time alone for a comparable site usually runs Rp 8–25 million, before counting lost content, lost SEO rankings that took months or years to build, lost product listings, and lost customer data that simply can’t be recreated.
• Downtime cost: for a site actively taking bookings or orders, even three to five days offline during a rebuild can mean losing the equivalent of weeks of ad spend and organic traffic that was driving those bookings in the first place.
• Reputation cost: a site flagged by Google Safe Browsing or blacklisted by hosting providers for malware doesn’t just lose visitors — it can take weeks to get delisted even after the site is clean again.

Put side by side, a year of backup coverage costs less than a single week of emergency rebuild work. That’s the entire argument for why website backups are the cheapest insurance available to a small business — not because backups are glamorous or exciting, but because the alternative is so disproportionately expensive that the comparison barely needs making.

If there’s one habit worth adopting after reading this, it’s treating backups as infrastructure rather than an afterthought — scheduled, stored offsite, and tested, not just switched on once and forgotten. That’s exactly what our website maintenance service at Bali Web Design is built around: automated offsite backups, regular restore testing, update management, and monitoring, so that if something does go wrong, getting back online is a routine fix rather than a five-week emergency. Cheap insurance only works if it’s actually in place before the day you need it.