Nobody Has a Backup of Your Website: How to Check Today (2026)

A furniture dealer in Jaipur rang me on a Tuesday morning. His website had been showing a blank white page since Sunday. Eleven years of product photographs, around 400 of them, every one shot in his own showroom. A catalogue his staff sent to customers on WhatsApp twenty times a day. All of it a white page.

The hosting had lapsed. Not dramatically, nobody hacked anything. An auto-debit failed in June, the renewal notice went to an email address belonging to a developer who stopped working with him in 2023, and after the grace period the host deleted the account. Host deletions are permanent. There was no backup anywhere. We rebuilt the site from photographs his son had posted to Instagram over the years, at a quality nobody was happy with, and it cost him more than the original build.

The part that still bothers me: the fix, had anyone set it up, would have cost about ₹200 a month.

The only question that matters: who has a copy, and where

Ask ten business owners in India whether their website is backed up and nine will say yes. Ask them where the backup is and almost all of them go quiet. The developer has it. It is in the hosting. There is a plugin. None of those three answers is a backup. They are guesses about a backup, and a guess gets tested exactly once, on the worst day.

A real backup has four properties, and if any one of them is missing you do not have a backup:

1. It is a complete copy. Both halves of the site: the files (pages, photographs, theme, code) and the database (products, prices, enquiry forms, blog posts, customer accounts). A copy of only the files restores a website with no content in it.
2. It lives somewhere other than the server it was copied from. A backup sitting on the same hosting account dies with that hosting account. That is what the Jaipur dealer actually had.
3. It is recent enough that losing everything after it would be survivable. For most businesses that means daily. For a shop taking orders on the site, daily is already too slow.
4. Someone has restored from it at least once. An untested backup is a file of unknown contents. I have opened plenty of backup archives that turned out to be 40 KB of nothing, dutifully produced every night for two years.

The ten-minute check you can run yourself

You do not need to be technical and you do not need to call anyone. Work through this in order and stop when you get a clear answer.

STEP 1. Do you control the hosting login?
Find the control panel address your site runs on. Usually one of:

    hpanel.hostinger.com        (Hostinger)
    yourdomain.com:2083         (cPanel, on most Indian hosts)
    console.aws.amazon.com      (AWS)
    dash.cloudflare.com         (Cloudflare: DNS only, not hosting)

  You can log in            -> go to step 2.
  Only the developer can    -> this is your real problem. Jump to the
                               "get the keys back" section below.

STEP 2. Is there a backup section, and does it list anything?
In cPanel look for: Backup, Backup Wizard, or JetBackup.
In Hostinger: Files -> Backups.

  A list of dated backups   -> note the newest date. Is it this week?
  "No backups available"    -> you have none. Nothing else to check.

STEP 3. Where does that backup physically live?
Click into the newest one. If the path starts with /home/ or
/public_html/ it is on the same server as your website.

  Same server only          -> treat this as no backup. It protects you
                               from a mistake, not from losing the account.
  Offsite (S3, Google Drive,
  Dropbox, or the host's own
  separate backup storage)  -> good. One more step.

STEP 4. Download it. Today.
Download the newest backup to your own laptop and look at the file size.

  Tens or hundreds of MB    -> plausible. Keep that copy.
  Under about 5 MB          -> almost certainly an empty or broken archive
                               for any site with photographs on it.

That last step is the whole exercise. A backup you have personally downloaded and can see on your own laptop is worth more than any assurance from anybody, including me. Do it once a month and you have removed the single most expensive risk your website carries.

If someone told you there is a backup plugin

On WordPress sites this is the usual answer, and it is usually half true. UpdraftPlus, BackWPup and the rest are good tools. The trouble is how they are almost always left configured.

• The free versions default to storing the backup in your own hosting folder. Offsite storage is the paid feature, so it is the one that was skipped. Same server, same fate.
• Schedules get set to monthly during the build and never revisited. A monthly backup means a bad week can cost you four weeks.
• A failed backup is silent. The plugin emails a report to whichever address was in the box during setup, which is frequently the developer's. Nobody reads those emails after month two.
• Big media libraries quietly break the job. The backup runs, hits the host's PHP time limit, and writes a partial archive. It still looks like a success in the plugin's own log.

So the plugin is not the answer to the question. Open it, look at where the destination points, look at the date of the last successful run, and download that file. Then you have an answer.

If only your developer can log in

This is the more common and more serious version of the problem, and it has nothing to do with backups as such. If you cannot log in to your own hosting and domain, your business is a guest on somebody else's property. Everything else in this article is unavailable to you until that changes.

What you are owed, and should ask for in writing today: the domain registrar login, the hosting control panel login, and the email account the renewal notices go to. Not a copy of the files. The logins. A developer who built the site in good faith will send them over the same day. One who will not is telling you something important about what happens when you eventually want to leave.

We wrote a separate piece on exactly who should own each of those three things and how to take them back when a developer has gone quiet. That is the first thing to fix, before the backup.

What a backup actually costs in India in 2026

This is the part that annoys me about how rarely it gets set up, because the numbers are small. These are the real monthly figures for a typical small business site, a few hundred pages and a media library in the low gigabytes.

• Your host's own offsite backup add-on: ₹100 to ₹400 a month on most Indian shared hosting. The cheapest option that genuinely works, and it needs no technical help to switch on.
• Object storage you control, like Backblaze B2 or AWS S3: roughly ₹50 to ₹250 a month for the storage itself at these sizes. More control, needs setting up once.
• A managed arrangement where an agency keeps daily offsite copies, verifies them, and does a test restore every quarter: usually ₹500 to ₹2,000 a month, normally inside a maintenance retainer rather than billed on its own.
• What we actually run for the sites we look after: a nightly database dump and a weekly full file copy, both pushed to storage in a different account from the server, with a restore rehearsed on a staging copy. On a Next.js and NestJS setup this is a scheduled job, not a product you buy.

Now the other column. A rebuild of a lost five-page business site starts around ₹25,000 and goes up fast with a catalogue. Re-photographing 400 furniture pieces was quoted to the Jaipur dealer at ₹90,000 by itself. Lost orders during the fortnight a site is down do not appear on any invoice, which is why they never get counted, and they are usually the largest number of the three.

The half everyone forgets

When a developer says he has the code on his laptop, believe him. Code is the easy half and it is rarely what gets lost. The database is the difficult half: your products, your prices, every enquiry anyone ever submitted, your order history, your blog.

Files change rarely. The database changes every time a customer does anything. So the two halves need different schedules, and a backup regime that treats them as one thing gets the database wrong. Nightly for the database at a minimum, and for a site that takes payments, something closer to continuous. Most Indian hosting plans can run a nightly database dump from a single cron entry. It is roughly four lines of configuration, and we have almost never seen it set up on a site we inherited.

The test restore, which is the only real proof

A backup is a promise about the future. A test restore is evidence. The exercise is simple and worth doing once a year even if you pay someone else to hold the backups.

1. Take the newest backup and restore it onto a staging address, something like staging.yourbusiness.in, never over the live site.
2. Open the restored copy and check four things: the home page renders, the product or service pages have their photographs, the enquiry form submits, and the admin login works.
3. Write down the date and how long the restore took. That number is your recovery time, and it is the honest answer to how long you would be down. Most owners assume an hour. Four to six is more usual, and without a tested backup the answer is weeks.
4. If it fails, you have learned that on a calm Tuesday rather than during a crisis. That is the entire value of the exercise.

Three things a backup will not save you from

Worth being clear, because backups get sold as protection against everything.

• A lapsed domain. If the domain registration expires and somebody else buys it, your backup restores a website nobody can reach at the address customers know. Domain auto renewal and a card that has not expired matter more than the backup does. Check the expiry date today.
• A quietly hacked site. If malware sat on the site for three weeks, so did every backup taken in those three weeks. Restoring reinstalls the problem. This is why keeping thirty days of history, rather than one copy, matters.
• Content somebody deleted on purpose months ago. If you keep seven days of backups and you need something from April, it is gone. Decide how far back you want to be able to reach, then pay for that much history.

What to do this week

In order, and the first two are free.

1. Confirm you can log in to the domain registrar and the hosting yourself. If you cannot, ask for the logins in writing today. Nothing else on this list is possible without them.
2. Run the four steps above and download the newest backup to your own laptop. Whatever you find, you now know rather than assume.
3. Switch on offsite backups, either your host's add-on or storage you control. This is the ₹200 a month that would have saved the Jaipur dealer ₹90,000.
4. Put the renewal and backup alert emails on an address you personally read, and check the domain expiry date while you are there.
5. Book one test restore. Put it in the diary. An untested backup is a rumour.

None of this is clever work and none of it is expensive. It is the sort of thing that only ever gets done by someone who has already lost a website once, which is a bad way to learn it. If you are not sure where you stand, send us the address and we will check it and tell you plainly. Knowing is free.