You do not know. Not until you have taken one, put it back somewhere else, and watched the site come up. Until then it is a file with a date on it, and a file with a date on it has never saved anybody.
The only test that counts is a restore
CISA, the federal cybersecurity agency, tells small businesses to “perform scheduled recovery tests to verify backup integrity” on its Back Up Business Data page. That page carries no update date.
The same page sets a floor you can measure. “Test backup procedure to make sure your team can rapidly restore data both fully and partially, and to ensure you can roll back data at least seven days if needed.”
Two things in that line. Fully and partially. And seven days of history, minimum.
A WordPress site is two pieces, and plenty of backups only hold one, which is only one of the things a backup does not cover. The Backups page in WordPress.org’s Advanced Administration Handbook is blunt about it: “There are two parts to backing up your WordPress site: Database and Files. You need both to be able to fully restore a typical WordPress site.” That page was first published March 28, 2023 and last updated June 4, 2026.
Files with no database gives you a site with no pages. A database with no files gives you pages with no theme and no photos.
A hack is not the only thing that sends an owner looking for a backup. An update goes in, the site comes up blank, and that is the moment you find out what the backup is worth. It is also the reason to take one by hand before you decide whether WordPress updates itself.
How to test one without touching your live site
Never test by restoring over the site your customers are looking at. If the backup is bad, you have just replaced a working site with a broken one.
Restore into a staging site, a spare subdomain, or a copy on your own laptop. Then work down this list:
- Download the backup off the host and onto your own computer first.
- Open the homepage, one service page, and the page with your phone number on it.
- Check that photos load, not just the text.
- Log in to wp-admin on the restored copy.
- Send yourself one message through the contact form.
Write down how long the whole thing took. That number is the real one. If it took six hours on a quiet Sunday, it will take longer on a Tuesday in July with the phone going.
What your host keeps, and for how long
This is where owners get a surprise. Retention is not standard, and the gap between hosts is wide.
SiteGround’s page on the Backups tool in Site Tools lists “up to 30 daily backup copies of your site if you’re on a shared hosting plan” and “up to 7 daily backup copies on Cloud hosting”. That page is stamped “Last update: May 13, 2026”.
Bluehost reads differently. Its page titled How Often Does Bluehost Back Up My Site? opens with this: “Bluehost’s automatic backup service runs once a week on a random day, and each run overwrites any previous backups. Only one week of backups is kept at a time.” That page was updated August 16, 2026, and it also says a restore handled by support carries what it calls a one-time fee.
Read past the opening line, though, since the same page gets more specific further down. On plain shared plans it says Bluehost creates daily, weekly and monthly copies “based on cycles set within the server for accounts under 20 GB and 100,000 inodes”. On Managed WordPress, Cloud and Reseller plans it says weekly. The headline answer and the answer for your own plan can be two different things.
That is the habit worth copying. Find the row that matches the plan you actually pay for, write down how often it runs and how many copies survive, and take those numbers off the host’s own documentation rather than a review site. Yours may say something else entirely.
The hack is usually older than the backup
Here is the trap. Restore a backup taken after a break-in and you restore the break-in along with it. Cleaning the site is a separate job from restoring it, and it has to be finished before the restored copy goes back on your public address.
Retention decides whether you get a choice at all. If a hack sat quietly on your site for three weeks, and your host keeps one weekly copy that writes over itself, every copy you can reach has the hack in it. There is no clean day to go back to. CISA’s seven days is a floor, not a target.
Then read the courtesy paragraph on your host’s own support page. The Bluehost backup page carries this one: “As a courtesy, Bluehost offers you our backup service. Bluehost is not liable for any files or data stored on your account. You agree to be solely responsible for all files and data sent and keep all necessary backups stored on Bluehost servers.”
And the line in that same paragraph that matters most on the worst day, or on the day you stop paying the bill: “Unless otherwise agreed to in writing by Bluehost, backups will not be given to accounts that have been suspended or terminated for any reason.”
That paragraph points at the user agreement, and the user agreement is where the two ends meet. It says you are required to “promptly remove any malware from your account”, and it says Bluehost “may terminate your access to the Services” without notice in the event that “you violate the terms and conditions of this Agreement”. The Bluehost user agreement page is marked last modified July 28, 2026. So a mess on your site and the handing over of backups are not separate stories. Go and find your own host’s version of both paragraphs.
This is not legal advice. Your contract is with your own host, the words in that contract are the ones that count, and if real money is riding on the answer, ask a lawyer licensed in your own state.
Keep one copy your host does not hold
CISA’s Back Up Business Data page gives the 3-2-1 rule in three lines: “3 copies of important files”, “2 different types of storage media (like a hard drive and the cloud)”, and “1 copy stored off-site, away from your business location”.
WordPress.org lands in the same place. Keep at least 3 to 5 recent backups, “with copies stored in different locations”, naming your hosting server, cloud storage, and one copy downloaded to your own computer.
For a plumber with an eight page site, off-site can be an external drive in a drawer and a folder in cloud storage. It does not have to be a product you pay for monthly.
Two honest limits. If your site is five pages, and you already have the words in a document and the photos on your phone, you may not need to buy anything at all. Rebuilding from saved text is slow work, but it is not a mystery, and paying every month for backup software you have never restored buys a feeling rather than a recovery.
The second limit is about the test itself. A restore that passed today proves that one copy worked today. It says nothing about next month’s copy. That is why CISA says scheduled tests, plural, and why a date in your phone beats good intentions.
What to do this week
- Find your host’s backup page. Write down two numbers: how often it runs, and how many copies it keeps.
- Download one backup to your own computer today.
- Restore that copy into staging or onto your own machine, and time it.
- Open the restored site and check the homepage, a service page, your phone number, and one form.
- Set a reminder to do the whole thing again in ninety days.
If step one gives you a worse answer than you expected, that is useful. It is cheaper to find out on a Tuesday afternoon than during an outage.
If the site is held together with plugins and a rebuild is on the table anyway, look at what a build includes and the current pricing before deciding. A site published as plain files has no database to restore and no dashboard to lock you out of. That is a smaller problem to own. It is not a cure for a site that is already infected, and that cleanup still has to happen first.