A small business homepage may look like one page, but restoring it can require several systems: the content manager, database, theme or code, images, domain settings, forms, analytics, and third-party services. A useful backup plan begins by defining the site components and ends with a restore test. An export button alone is not proof that the business can recover.
What is included in the export?
Ask the website platform exactly what its export contains. For WordPress, the built-in Tools Export screen creates a WordPress eXtended RSS file. WordPress says the file can include posts, pages, custom post types, comments, custom fields, categories, tags, custom taxonomies, and users, with filters that can limit the export. That is useful for content portability, but it is not automatically a copy of every file, theme, plugin, setting, or external service.
Inspect an export rather than relying on its label. Confirm that the homepage, navigation content, reusable blocks, SEO fields, redirects, form configuration, and custom content types appear. Check whether images are embedded, referenced by URL, or excluded. Keep a list of items that live elsewhere, such as the logo source file, licensed fonts, analytics properties, email marketing forms, booking tools, payment links, and consent settings.
Does the backup include files and the database?
A full site recovery needs all state that the site uses. WordPress's backup documentation explains that a typical WordPress site requires both the database and the files for a full restore. It notes that downloading website files does not back up the database because the database is stored separately. Ask the host whether snapshots cover both, how often they run, how long they are retained, whether they are stored away from the live account, and whether the business can download an independent copy.
Also identify what the backup does not cover: domain registration, DNS records, email routing, CDN rules, certificates, environment variables, API credentials, and data held by form, chat, booking, or commerce providers. Do not store secret values in a general documentation file. Instead, record the credential owner, recovery method, and approved secure storage location.
Can the content be imported elsewhere?
Portability matters if the host fails or the business changes providers. WordPress documents an Import screen with importers for WordPress posts, pages, comments, custom fields, and categories. Test the specific export and importer combination on a staging site. Confirm internal links, featured images, menus, templates, forms, metadata, and redirects. A successful import message is not enough; visit the restored homepage on desktop and mobile and submit a test form to an owner-controlled address.
Who can authorize and perform a restore?
Record the owner for the domain, hosting, website administrator account, backup account, and third-party services. Use individual accounts and least-necessary permissions where possible. Make sure a current owner controls recovery email, multifactor authentication, and billing. Ask whether a vendor or former contractor is the only administrator and what happens when the contract ends. Keep a break-glass recovery procedure that does not depend on the same email system the website outage could affect.
What should a restore test prove?
Restore to an isolated staging location, never over the only live copy. Record the backup date, software versions, restore steps, elapsed time, warnings, and checks performed. Verify the homepage layout, navigation, images, accessibility basics, contact details, forms, confirmation emails, analytics consent, search visibility settings, redirects, and HTTPS. Compare a small sample of database-driven content with the live site. Remove or protect the staging copy so it does not expose customer submissions or create duplicate search pages.
Before accepting a platform or maintenance plan, ask: Can we export without vendor support? How long are backups kept? Can we restore a single page and the entire site? Are files and database both included? Where is the off-site copy? What is excluded? Who owns each account? Has a restore been tested in the last quarter?
The strongest plan combines a portable content export, a complete files-and-database backup, separate documentation for infrastructure and integrations, and a practiced restore. That turns the homepage from a fragile vendor account into a business asset with a known recovery path.
Sources
- Tools Export screen — WordPress.org
- WordPress Backups — WordPress Developer Resources
- Tools Import screen — WordPress.org