Best Website Backup Checklist: Files, Databases, Email, and DNS Settings

Overview

This guide gives you a reusable website backup checklist that goes beyond the usual advice to “back up your site regularly.” The goal is simple: make sure you can restore not just the website, but the working business system around it.

For most sites, a complete backup plan should cover five areas:

• Website files: themes, plugins, uploads, media, custom code, configuration files, and application assets.
• Databases: posts, pages, products, users, settings, form entries, and other dynamic content.
• Email and related records: mailbox settings, aliases, forwarding rules, and the DNS records that support delivery.
• DNS and domain settings: nameservers, zone records, redirects, and domain registrar details.
• Access and restore documentation: logins, recovery steps, hosting panel access, and notes on dependencies.

That broader view matters because website recovery problems often start outside the website itself. A restore can fail because a database export is outdated, because DNS management changed during a domain transfer, or because a mail record was never documented. If your site uses domain and hosting from different providers, that risk increases slightly, since pieces of the setup may live in more than one account.

A good backup process should answer three questions:

1. What do we need to restore?
2. Where is each item stored?
3. Has the restore process actually been tested?

If you are still setting up your environment, it helps to review related launch basics too, including Website Launch Checklist for Small Business: Domain, Hosting, SSL, Email, and Analytics and How to Connect a Domain to Your Website Builder or Hosting Account. A clean launch setup usually makes backup planning much easier later.

Checklist by scenario

This section breaks the backup checklist into practical scenarios. Use it as a working list before changes, migrations, or regular audits.

1. Core checklist for any website

Start here, no matter what platform or web hosting plan you use.

• Export website files, including media uploads, themes, plugins, templates, custom scripts, and configuration files.
• Export the primary database and label it with date, environment, and site name.
• Record application version details, such as CMS version, plugin versions, theme version, runtime version, and server notes if relevant.
• Save environment configuration, including database connection details, environment variables, cron jobs, rewrite rules, and caching settings.
• Back up SSL-related information, especially certificate source, renewal method, and any manual installation notes. For background, see SSL Certificate Guide for Website Owners: Types, Costs, and Renewal Basics.
• Document storage locations so the backup itself does not become hard to find later.
• Keep at least one off-server copy stored separately from the live hosting account.

2. WordPress website backup checklist

WordPress sites often look simple on the front end while depending on many moving parts behind the scenes. If you use WordPress hosting or managed WordPress hosting, make sure your list includes:

• Full wp-content backup, including uploads, themes, plugins, and any custom mu-plugins.
• Database export with posts, pages, users, settings, product data, order data, comments, and plugin-managed content.
• Theme customizations saved outside the live theme if changes were made directly.
• Plugin license keys and premium download access where needed for reinstallation.
• Form submissions if your forms store entries in the database rather than sending only by email.
• SEO settings, redirects, schema settings, metadata templates, and verification tokens.
• Cache and performance settings, CDN configuration, image optimization rules, and security plugin settings.

If you are evaluating hosting options, the level of backup support can vary widely. That is one reason articles like WordPress Hosting vs Managed WordPress Hosting: What’s the Difference? and Best Web Hosting Features Checklist for Small Business Owners are useful before you commit.

3. Ecommerce backup checklist

If your site processes orders, bookings, memberships, or customer records, the backup scope needs to be tighter and the backup frequency usually needs to be higher.

• Back up product data, categories, product images, SKU references, and stock-related fields.
• Export order records and customer account data where your platform allows it.
• Save tax, shipping, and payment settings along with transaction gateway configuration notes.
• Document third-party integrations, including inventory tools, CRM connections, automation platforms, and webhooks.
• Check where transaction history actually lives; some essential records may be in external systems rather than your website database.

For stores and booking systems, test restores matter as much as backup frequency. A backup website files and database routine is helpful, but only if the restored system still handles logins, checkouts, notifications, and admin access correctly.

4. Email and communications checklist

Email is one of the most overlooked assets in a small business website backup checklist. Yet during a domain change, hosting migration, or DNS error, it may be the first business function people notice breaking.

• List all mailboxes, aliases, forwarding rules, groups, and shared accounts.
• Back up mailbox contents if your provider supports export or desktop synchronization.
• Record mail client settings for incoming and outgoing servers, ports, and authentication methods.
• Save all email-related DNS records, including MX, SPF, DKIM, and DMARC where used.
• Document who manages email: domain registrar, web host, business email provider, or another service.

If email setup is tied to your domain registration and DNS management, it is worth reviewing Business Email Setup Guide: Domain Email Options, Costs, and DNS Records.

5. DNS backup checklist

DNS backup is often treated as optional until something breaks. In practice, your DNS zone is part of your website’s operational backup.

• Save nameserver values currently assigned at the registrar.
• Export or copy the full DNS zone, including A, AAAA, CNAME, MX, TXT, SRV, and redirect-related records if applicable.
• Record TTL settings for critical records.
• Document subdomains used for staging, mail, app endpoints, or verification.
• Keep screenshots or text copies of the current zone in case export tools are limited.
• Note provider dependencies such as CDN, verification, anti-spam, email, and analytics records.

This matters before a hosting move, domain transfer, or instant website launch on a new provider. When people ask how to connect domain to hosting, the answer often depends on whether they preserved the DNS setup accurately during the change.

6. Access and recovery checklist

A technically complete backup can still be useless if nobody has the right access to restore it.

• List account owners and admin contacts for domain registration, hosting, DNS, CDN, SSL, analytics, and email.
• Store recovery codes securely for two-factor authentication where used.
• Record control panel access details such as cPanel, Plesk, custom host dashboards, or cloud console access.
• Create a restore runbook with clear steps, order of operations, and decision points.
• Identify the restore target: same server, new server, staging, local environment, or fresh hosting account.

If you are comparing providers, restore tools, control panel access, and support responsiveness are important practical features, not small extras. That is especially true for businesses choosing web hosting for the first time or changing from cheap web hosting to a more reliable setup.

What to double-check

Once your checklist is assembled, review these items before you trust it.

• Backup completeness: Open the archive or export and confirm it contains what you think it contains. Do not assume a completed job means a usable backup.
• Database freshness: Make sure the database copy is recent enough to be useful, especially for sites with frequent updates.
• Restore readability: Use file names that include the site name, environment, and date. Avoid vague names like final-backup.zip.
• Storage separation: Keep copies in more than one location, and avoid relying only on the live server.
• DNS accuracy: Compare the current live zone against your saved DNS backup after any changes.
• Email continuity: Verify that mailbox records and mail routing details are included, not just website records.
• SSL and HTTPS behavior: After a restore or migration, check certificate status and look for insecure asset loading. If needed, review How to Fix Mixed Content Errors After Enabling HTTPS.
• Monitoring after restore: Confirm uptime, page response, and basic availability once the site is live again. A good follow-up resource is Website Uptime Monitoring Guide: What to Track and How Often to Check.

One practical test is to restore the site to a staging environment and walk through common user actions: homepage load, contact form, admin login, checkout or booking flow, and key landing pages. That test often reveals missing assets faster than reviewing a folder list.

Common mistakes

The most common backup failures are not dramatic technical problems. They are small omissions that only become visible during a stressful recovery.

• Backing up only the public files and forgetting the database.
• Assuming the host’s automatic backups are enough without checking retention, scope, or restore access.
• Ignoring DNS settings even though the site, email, and subdomains depend on them.
• Forgetting email records during a domain and hosting move.
• Keeping backups only on the same hosting account, which creates a single point of failure.
• Not documenting custom integrations, webhooks, API keys, scheduled jobs, or redirects.
• Never testing a restore, so the first real test happens during an outage.
• Leaving backup ownership unclear, especially when multiple people have touched the site over time.

Another mistake is treating backups as a one-time setup instead of an operational routine. A website changes whenever plugins update, DNS management shifts, new subdomains are added, a redesign launches, or business email is reconfigured. The checklist should change too.

When to revisit

This checklist is most useful when revisited before changes, not after a problem. Use the following schedule as a practical rhythm.

• Before seasonal planning cycles: review backups before major promotions, traffic peaks, or content pushes.
• When workflows or tools change: update the checklist after a platform move, provider change, new plugin stack, or email service change.
• Before a website migration: confirm files, database, DNS, redirects, SSL, and email records are all accounted for.
• Before domain transfer or nameserver changes: capture a full dns backup and document the current live zone.
• After launching new features: add any new forms, automations, third-party tools, or subdomains to the backup scope.
• Quarterly or semiannually: run a brief audit even if nothing obvious has changed.

To make this action-oriented, keep a simple backup worksheet with these columns: asset, location, backup method, frequency, owner, restore notes, and last test date. That single document can prevent a surprising amount of confusion.

If you are reviewing the broader setup around your site, it may also help to revisit hosting decisions with How to Choose Hosting for a New Website: A Beginner Decision Guide and cost planning with Web Hosting Pricing Explained: What Small Businesses Actually Pay Over Time.

Next step: open your current website account list today and check whether you can answer three things without guessing: where your latest files backup is stored, where your latest database export is stored, and where your current DNS records are documented. If any one of those answers is unclear, you have found the first item to fix.