Backups and ransomware: protecting your website and business data

The best defense against ransomware, failed updates and accidental deletion is the same: recent, separate, tested backups. For a small business that means automated daily backups of your website and key data, at least one copy stored away from the systems it protects, and a restore you have actually practiced. Prevention matters too, but backups are what turn a disaster into an inconvenience.

What ransomware does to a small business

Ransomware is malicious software that encrypts or steals your files and demands payment to restore or not publish them. Attackers commonly get in through phishing emails, stolen or reused passwords, unpatched software and exposed remote access. Small businesses are frequent targets precisely because they often lack dedicated IT security.

For websites specifically, the more common threats are compromised admin logins, vulnerable plugins and malware injections. These don't always look like classic ransomware, but the recovery path is the same: clean up, close the hole, and restore from a known-good copy.

The modern twist is double extortion: attackers both encrypt data and threaten to leak it. Backups solve the first problem, not the second, which is why prevention and minimizing the data you store still matter.

What actually needs backing up

Most owners think of "the website," but your business data lives in several places.

The pattern to notice: most cloud services operate on a shared responsibility model. They keep the platform running; recovering your specific data from mistakes, malicious deletion or account compromise is frequently your job.

The 3-2-1 rule, updated

The classic guideline is three copies of your data, on two different types of storage, with one copy off site. Many security guides now add a further step:

• One copy immutable or offline, meaning it can't be changed or deleted for a set period, even by an administrator account.
• Zero errors on restore, meaning you have tested that the backup actually works.

For a website, that might look like:

1. The live site on your host.
2. The host's automated daily backups.
3. A separate daily backup sent to cloud storage in a different account (such as Amazon S3, Backblaze B2 or Google Cloud Storage), with versioning or object lock turned on.

The separate account matters. If an attacker gets into your hosting dashboard, they can often delete backups stored there too.

Website backups, platform by platform

WordPress and WooCommerce

WordPress sites need both files and the database backed up. Managed hosts, like those in our WP Engine and SiteGround reviews, typically include daily backups and one-click restores. Add a second, independent backup with a reputable backup plugin or service that sends copies off site. For stores, back up more often than daily if orders come in steadily, since a restore can otherwise lose recent orders. Our WooCommerce guide covers store-specific care.

Shopify

Shopify runs and protects the platform, but it does not give merchants a simple "restore my store to yesterday" button. Accidental product edits, bulk import mistakes or a bad app can change your data. Use regular exports and consider a backup app from the Shopify App Store that can restore products, collections and theme files. Keep themes in GitHub through Shopify's integration.

Webflow, Framer, Squarespace and similar builders

Hosted builders manage the infrastructure. Webflow keeps site backups and version history you can restore from, and other builders offer varying levels of history. Exports are often limited, so know what you can and can't get out, and keep copies of key content and assets yourself.

Next.js and headless sites

The code should live in version control, which effectively backs it up. The content lives in your CMS, so check its export and backup options. Our comparison of Contentful, Sanity and headless WordPress touches on how each stores content. Don't forget environment variables and API keys, stored securely in a password manager, not a spreadsheet.

AI-built sites

Sites built in tools like Bolt or Lovable should be synced to GitHub, and you should know where the database lives and how to export it. Our post on vibe coding a business website explains why.

Prevention: closing the usual doors

Backups are your safety net. These habits reduce how often you need it:

• Multi-factor authentication on hosting, registrar, email, CMS and payment accounts. This blocks a large share of account takeovers.
• Unique passwords stored in a password manager.
• Prompt updates for WordPress core, plugins, themes, operating systems and browsers. See our WordPress security hardening guide.
• Least privilege: give people the access they need and no more, and remove former staff and vendors promptly.
• Email authentication with SPF, DKIM and DMARC to make spoofing your domain harder, as explained in our domains, DNS and email authentication guide.
• Staff awareness about phishing, invoice fraud and unexpected login prompts.
• Endpoint protection on business computers.
• Collect less data. Data you never store can't be leaked.

Our small business website security checklist covers the website side in more detail.

Test your restores

An untested backup is a hope, not a plan. At least a few times a year:

1. Restore a recent website backup to a staging site and confirm it works: pages load, forms submit, logins function.
2. Restore a single file or folder from your document backups.
3. Check how far back your backups go and whether the retention is long enough. Some infections go unnoticed for weeks.
4. Time it. Know roughly how long a full restore takes, so you can plan around it.
5. Write down the steps and who to call, and store that document somewhere you could reach if your main systems were down.

If the worst happens

If you suspect ransomware or a compromised website:

• Isolate affected systems: disconnect infected computers from the network; put the website into maintenance mode if needed.
• Don't wipe everything immediately. Evidence helps investigators and insurers.
• Change passwords from a clean device, starting with email, hosting and registrar accounts.
• Contact your insurer if you have cyber coverage, and report the incident to law enforcement, in the US through the FBI's IC3 or a local field office. CISA also offers ransomware resources.
• Get professional help for anything beyond a simple website cleanup.
• Restore from a known-good backup only after the entry point is closed, or the attacker may simply return.
• Consider notification obligations if customer data was involved, with legal advice.

The short version

Back up your website and business data automatically, keep at least one copy in a separate account that can't be altered, and test restores a few times a year. Pair that with multi-factor authentication, prompt updates and staff awareness. If you want backups, monitoring and updates handled for your site, see our care and security service or talk with us.