A website backup is a copy of your pages and your database. It does not hold your domain name, your DNS records, your email, or the logins that control those three. Those four things sit outside the backup, and they are the ones that put a trade business off the internet for a week.
What is actually inside a backup
GoDaddy’s help page on website backups lists what should be in one: “Website code files, Any website databases, Images, Any add-ons, plugins, or themes used by your website.” That page carries no update date.
Read that list again. Every item on it is the site itself. None of it is the name people type, or the mail that comes back.
The same page adds a limit worth knowing. A backup made by one control panel restores to the same kind of account. GoDaddy puts it plainly: “cPanel backups can only be restored to Web Hosting (cPanel), Plesk backups to Windows Hosting (Plesk).”
Your host’s legal terms are blunter than its help pages. HostGator’s General Terms of Service, last modified June 10, 2026, says it “makes and stores backups of shared and reseller accounts pursuant to its disaster recovery policy” and “does not maintain backups of dedicated accounts.” It also sets a size cut off: “Any shared account using more than 20 GB of disk space will be removed from our off-site backup with the exception of databases continuing to be backed up.”
Bluehost’s User Agreement, last modified July 28, 2026, goes further. It says Bluehost backs up data on its servers “for its own operational efficiencies and purposes” but is “under no obligation or duty to Subscriber to do so.” It “will not attempt to back up accounts that exceed 50,000 files or 30 Gigs of space for any reason.” The same agreement says that “upon termination of the Services for any reason Subscriber Content, Subscriber Websites, and other data will be deleted.” That is a host switching your site off, and it is its own story.
Open your own host’s agreement and find the backup paragraph. The number in yours is the number that applies to you.
The domain name is on its own clock
Your domain is a yearly registration, not a file. No backup renews it, and no restore brings it back.
ICANN publishes an FAQ for registrants on renewals and expiration. That page carries no update date. It sets out what happens if a domain is not renewed: “If deleted, the domain name will enter into a redemption period for 30 days, under which it remains available to restore. If it is not restored, the domain name will enter into PendingDelete status for 5 days. After this period, the domain name will be released and made available for registration on a first-come-first-served basis.”
Thirty days, then five more, then anyone can take it. Getting it back inside the thirty can cost you. The same page says restoring a name in that window “may result in an additional fee, sometimes referred to as a redemption fee,” and that options and fees for renewing domain names, including expired ones, vary by registrar.
The site goes dark before any of that. Under ICANN’s Expired Registration Recovery Policy, which all registrars and registries have had to comply with since 31 August 2013, the registrar has to interrupt the existing DNS path once a registration expires, for as long as the registry allows it. Your backup is sitting there untouched and your phone still is not ringing.
This is not legal or tax advice, and contract questions are decided under your own state’s law, so ask someone licensed there. If your domain is registered in a former web company’s name and they will not hand it over, that is a contract matter between you and them. Talk to a lawyer in your state, not to a forum. ICANN’s FAQ does carry one attorney line, and it is narrower than people expect: it covers the case where you paid your registrar to renew and the name was not renewed anyway. There, the FAQ says the registrar “may be in breach of the registration agreement” and that you “may want to consult an attorney for legal advice to determine your options.”
Where the name points is a separate thing again
DNS is the short list that says where your name sends people. One record points at the web host. Another points the mail somewhere else entirely. That list is held by whoever runs your DNS, which may be your registrar, your host, or a service like Cloudflare, which is also a CDN. A hosting backup does not contain it.
Put the site on a new server and the name keeps pointing at the old one until somebody edits those records. That is the part that goes wrong during a move to a new host.
So keep a copy. Cloudflare’s documentation on importing and exporting records, last updated April 16, 2026, has an export button that hands you your records as a zone file. That page says Cloudflare writes each record’s own settings in after it, on the same line, as a comment. Most DNS providers have some version of that button. Find yours, export once, and save the file with your insurance papers.
Your email runs on a clock of its own
Mail for a small trade business usually sits at Google Workspace or Microsoft 365. Neither one is inside your website backup.
Google’s admin help page on restoring a recently deleted user, last updated 14 August 2026, says: “You can restore a user account (including administrator accounts) up to 20 days after deleting it. After 20 days, the data is gone and you can’t restore it.”
Microsoft’s Exchange Online documentation on deleting and restoring mailboxes gives a different number: “When you delete a mailbox, Exchange Online retains the mailbox and all its contents until the deleted mailbox retention period expires, which is 30 days. After 30 days, the mailbox is permanently deleted and can’t be recovered.” The same page says that when an Exchange Online license is pulled off a user, the data is held for 30 days, and “after the 30-day grace period, the data is deleted and can’t be recovered.”
Twenty days and thirty days. Both clocks start when somebody deletes an account, and neither waits for you to notice.
One more trap, from that expired registration policy. It says registrars “should advise registered name holders to provide a secondary email point of contact that is not associated with the domain name itself so that in case of expiration, reminders can be delivered to this secondary email point of contact.” If the only address on your registrar account is you@yourcompany.com, and that domain expires, the warning has nowhere to land.
What to do this week
None of this needs a purchase. It needs an hour and a pen.
- Keep a copy of the site files on a drive you own. GoDaddy’s list is the checklist for what that copy needs in it: the code files, the database, the images, and any add-ons, plugins or themes.
- Look up your own domain at lookup.icann.org. It names your registrar and the expiry date. Write both down.
- Log in to that registrar. Turn on auto renew, then check the card on file has not expired.
- Change the contact email on the registrar account to an address that is not on your own domain.
- Export your DNS records from wherever they live and save the file off the internet.
- Write down four logins and who holds each: registrar, DNS, hosting, mail admin. If a contractor holds one, ask this week to be made the owner on the account, not a user on it.
Two honest limits. This is a paper exercise. It tells you nothing about whether the backup you hold would actually load if you needed it, which is a different job on a different day. And the terms quoted here are the ones published on the day this was written. Hosts rewrite them. ICANN’s pages describe generic endings like .com, so if yours ends differently, ask your registrar what its clock is.
Also, do not buy a backup product for a five page site that changes twice a year. Download the files and keep them. Paid tools mostly buy frequency and a faster restore, and neither of those covers a domain, a DNS record or a mailbox.
A site built as plain files makes the site half of this easy. The folder is the website, so a copy of the folder is a real backup. That still leaves the domain, the DNS and the mail sitting in your name, which is the whole point of this page.