Backup advice usually stops at “you should have one”. What a founder needs is the next part — how far a given spend reaches, and what you give up by not spending. Do that sum once and a small budget stops being a source of anxiety.
The measure is two spans of time
Backups are judged not by size or frequency but by two durations: how far back you land (everything since the last backup is lost) and how long it takes to get back. Which of the two hurts more depends entirely on your business.
That third value, retention, is the one people underestimate. Damage is rarely noticed the moment it happens, and if you find it days later with only yesterday’s copy retained, the damage is what got backed up. Trusting an automatic backup and then discovering this is a very common way to lose everything.
What a near-free setup actually covers
You can get remarkably far for nothing. A free backup plugin plus the free tier of a cloud storage provider will push files and the database off-site on a schedule. There is one rule to keep.
A backup on the same server does half a job. It helps when you delete a file by mistake, but if the account is suspended or the machine itself fails, the original and the copy go together. Pushing one copy to free storage elsewhere removes that risk in its entirety.
Manual backups are the real weakness of a free setup — not a technical limit but a human one. You forget when you are busy, and then you forget that you forgot. If full automation is out of reach, at minimum put a recurring calendar entry in place and make checking the date on the newest file part of the same action.
A backup you have never restored is not a backup
This is the sentence in the series most worth repeating. Files may be appearing every day, and whether the site actually comes back from them is unknown until you try. Databases without the uploads folder, corrupt archives, and nobody knowing the restore procedure are all ordinary outcomes.
Once a year is enough. Unpack a backup somewhere temporary, confirm the site opens, and write the steps down in order. Nobody is calm during a real incident, so whether a document exists to read at that moment is what decides your recovery time.
Security and incident material sits in the security archive, and running backups, monitoring and restoration without a human in the loop is what an InfraGuard pass covers.
Next part
Next: the upgrade decision. We said earlier that “it feels slow” is not a signal — the following part sets out precisely what is.