Pick a backup with more storage than your site needs today. It should keep old versions for a long time and run every day.
It should also encrypt your files so only you can read them. Then restore one backup to prove it works.
Most small site owners think about backups only after something breaks. A plugin update ruins the homepage. Or a hosting provider wipes the media library during a migration.
Then they look for a recent copy and find one that is three weeks old. Sometimes it sits on the same hosting account that caused the problem. Sometimes it left out the database.
That moment is when most people take off-site cloud backup seriously. Then they compare providers and meet a pile of differences.
Storage caps, version history, upload speeds, and encryption all vary a lot between services.
You will not feel those differences until you need to restore. The checks below help you pick a backup that works when you need it.
Storage limits and how fast you will hit them
A free tier of 5 GB sounds like plenty. Then you add a full WordPress install and a year of blog images. Add a WooCommerce product catalogue and a couple of complete site backups, and the space is gone.
Small business sites tend to land between 2 GB and 10 GB. Client documents, downloadable PDFs, and any video add to that.
Many owners pick a plan by today's site size, and that is the usual mistake. Backup files pile up fast, especially when the provider stores several versions. Most sites outgrow a starter plan sooner than expected.
Check the total storage allowance. Also check each service's limit on file size. Some reject large uploads and only tell you after the transfer fails.
Before you upgrade, compare the yearly and monthly price of the next plan with the annual vs monthly billing calculator.
Versioning windows and why they matter
Providers keep older copies of your files for different lengths of time. Some hold them for 30 days and others for 90. A few keep them for a year or longer on paid plans. A longer window lets you roll back further.
For a small site, this matters more than it seems. Say a security breach goes unnoticed for a fortnight. If your window covers only 15 days, you will have almost no clean copy left to restore.
A longer window gives you a wider safety net. You only notice its value on the day you need it.
Upload speed and backup frequency
Upload speed depends on the provider's setup and your distance from its nearest data centre. A backup that takes four hours on a slow connection tends to get postponed. A postponed backup protects nothing.
Automatic scheduling fixes most of this. A good setup runs a daily backup that uploads only what changed since the last one. It does not send the whole site every time.
That keeps transfers short. It also keeps the gap between your live site and your latest backup under 24 hours.
Sharing controls for client files
You may also use cloud storage to share project files with clients or hand work to a designer. Then sharing controls matter.
Look for password-protected links and expiry dates on shared folders. You also want a way to cancel access when a project ends. A basic file dump has none of these.
Anyone handling client data under UK GDPR must show they took reasonable steps to protect personal information. A shared folder with no access controls will not stand up if a regulator asks how you handled someone's data.
If your contracts need a signature, compare electronic signature tools in these DocuSign alternatives.
The Encryption Question: At-Rest vs End-to-End
Most people skip over encryption details, but this is probably the single most important thing you'll decide when picking a cloud backup provider.
Two main models exist, and they work in fundamentally different ways when it comes to who can actually see your files after upload.
At-rest encryption means your files get encrypted on the provider's servers. Outside attackers can't read them, but the provider holds the decryption keys.
If their systems get breached, or if they receive a legal request for your data, they can technically access everything you've stored.
End-to-end encryption is a different animal entirely. Your files get encrypted on your device before they leave it, and you're the only one who holds the keys.
The provider can't read your data even if they tried, because they never had the means to decrypt it.
For anyone storing client contracts, financial records, or personal data, that distinction carries real weight.
Providers built on this model, like those offering end-to-end encrypted cloud storage, take the provider completely out of the trust equation, so you don't have to rely on a company's internal policies to keep your files private.
That’s because with end-to-end encryption, not even the provider can read the contents of your files.
Privacy covers your connection as well as your files. If you need a VPN too, compare these free VPN alternatives.
Why a backup you cannot restore is not a backup
Many small site owners have backups they have never tested. Compressed files sit in a folder, neatly dated and untouched. Nobody has tried a restore.
A backup that cannot be restored in a reasonable time is dead weight on a server.
Before you commit to a provider, run a test restore. Download a backup and check the database is intact. Confirm every media file is there. Then time the whole process.
If it takes over an hour or the files come back corrupted, you learn that on your own terms. You do not learn it during an emergency.
The real cost of a bad backup choice
A bad cloud backup choice only shows itself when something breaks. By then you are rebuilding from scratch. You may be explaining to clients why their files vanished.
You may be paying a developer emergency rates to piece together a partial snapshot.
A good provider stores several versions over a window long enough to be useful. It encrypts files so even the provider cannot read them. It also gives you sharing controls for working with clients.
Setup takes little time. Spend five or ten minutes comparing versioning windows and encryption models before you pay. That saves you hours of damage control, possibly days.