Website Backup Solutions for Nigerian Businesses: Options, Costs and How to Choose

What must a website backup include?

A complete website backup includes the site files (code, theme, plugins, uploaded images and documents), the database (content, users, orders, bookings, settings), and the configuration needed to rebuild the environment (server settings, environment variables, DNS records and SSL setup). Backing up files without the database, or the reverse, produces a copy that cannot be restored to a working site. In practice the parts are:

• Files. For WordPress, the whole installation directory including the uploads folder, which is usually the largest part.
• Database. A consistent export taken while the site is not mid-write, ideally with tables locked or using the database's own dump tool.
• Configuration. Web-server settings, PHP or runtime version, cron jobs, API keys and environment files. These are often forgotten and turn a one-hour restore into a two-day rebuild.
• External records. DNS zone file, domain registrar details, payment gateway webhook settings and email routing. Keep an exported copy in a document outside the server.
• Third-party data. Anything stored only in a plugin's external service (some form builders, booking tools and email systems) needs its own export.

For custom web applications, add the source code repository, database migrations, uploaded user files (often in object storage) and any queue or cache state that matters.

Website backup options compared

Nigerian businesses typically choose between six backup approaches: hosting-provider backups, CMS backup plugins, server snapshots, scheduled scripts to off-site cloud storage, a managed backup service, and manual exports. They differ in who controls the copy, where it lives and how quickly it restores.

Each option has a weakness that another covers. Host backups fail with the host. Plugin backups can fail silently when the site runs out of disk space. Snapshots restore the whole server, including the malware you are trying to remove, unless you have one from before the breach. Scripted backups need someone to monitor them. The strongest small-business setup pairs a host or snapshot backup with an independent off-site copy you control.

How much data loss and downtime can you tolerate?

Two numbers decide how sophisticated your backup plan needs to be: the recovery point objective (RPO), meaning how much recent data you can afford to lose, and the recovery time objective (RTO), meaning how long the site can be down. A brochure site edited monthly can tolerate a week of data loss and a day of downtime; an e-commerce store taking orders every hour cannot.

The old "3-2-1" rule remains a good target: three copies of your data, on two different types of storage, with one off-site. For a Nigerian SME that translates to the live site, a host or snapshot backup, and an independent copy in cloud object storage or with a managed service. Retention matters as much as frequency. Malware and data corruption are often discovered weeks after they begin, so a plan that keeps only the last seven days may have overwritten every clean copy. Keep daily backups for 30 days, weekly for three months, and a monthly copy for a year where the data is important.

Which backup setup does your website need?

The right backup setup depends on how much the site changes, how much money flows through it, and whether it holds customer data you would have to explain losing. Use the following as a decision framework.

• Brochure or portfolio site (content changes rarely). Host backups plus a CMS plugin sending weekly files and daily database copies to cloud storage. Restore test twice a year.
• Lead-generation site (forms, quotes, appointments). As above with daily files. Also route form submissions to email or a CRM so a lost database does not mean lost leads.
• E-commerce store. Managed hosting with daily snapshots, plus hourly database backups of orders and customers to independent storage, plus payment records retrievable from the gateway dashboard. Restore test quarterly, on a staging copy.
• Customer portal or web application. Database replication to a second server, nightly snapshots, off-site copies of code and user files, documented restore runbook, restore test quarterly with timing recorded.
• Site built and hosted by a freelancer who has moved on. Priority is to obtain a full copy now, before anything else, then rebuild the plan from that copy.

If in doubt, choose the level above what you think you need. The cost difference between tiers is small; the cost of the wrong tier appears all at once.

What changes for Nigerian businesses

Backups in Nigeria face four local realities that shape the choice.

• Local copies are exposed to power and theft. An external drive in the office is not a serious off-site copy when generators fail, offices flood or laptops are stolen. Cloud storage, priced in US dollars, is the practical off-site option; budget for exchange-rate movement.
• Bandwidth and data costs. Uploading a multi-gigabyte backup over mobile data or a small office link every night is slow and expensive. Incremental backups, which send only what changed, and server-to-cloud transfers that never touch your office connection solve this.
• Hosting provider variability. Local and low-cost international hosts differ widely in backup frequency, retention and restore responsiveness. Ask in writing: how often, how long retained, where stored, how to restore, and whether restores are self-service or ticket-based.
• NDPA obligations. Backups contain personal data, so they fall under the Nigeria Data Protection Act 2023. Encrypt backups, restrict who can access them, retain them no longer than your stated policy, and delete customer data from backups when your retention period ends where technically feasible. Confirm current guidance with the NDPC if you handle sensitive or large-scale data.

There is also a positive local factor: Nigerian payment gateways keep transaction records independently of your site, so payment history is recoverable from the gateway dashboard even after a total loss. Order details, customer accounts and content are not.

What do website backups cost in Nigeria?

For most SME websites, a robust backup plan costs less per month than a single hour of developer time. The figures below are indicative 2026 ranges; actual quotes vary with site size, vendor and exchange rate.

Separate the recurring storage cost from the one-off setup, and when comparing maintenance plans ask whether restore testing is included or only "backups are taken". Compare 2–3 written quotations on identical scope.

Example (hypothetical): an Ibadan private school's portal

Example (hypothetical): a private secondary school in Bodija, Ibadan runs a WordPress site with a parent portal plugin holding results, fee records and admission forms for around 600 pupils. The site is on shared hosting with seven-day host backups. Nobody has ever restored one. During the third-term results upload, a failed plugin update corrupts the database. Results entered over the previous two weeks are unreadable. The host's backup from seven days earlier restores cleanly, but nine days of results entry and 40 admission forms are lost and must be re-entered by staff, while parents receive apologetic messages. The school's revised plan, sized as a customer-portal site:

• Managed hosting with nightly snapshots (upgrade cost roughly ₦100,000–₦250,000 per year above the old plan, indicative).
• A backup plugin sending daily database copies and weekly file copies to cloud object storage, with 90-day retention and encryption enabled.
• Form submissions also emailed to the admissions office, so admission forms survive a database loss.
• A restore test each term holiday on a staging copy, with the time recorded.
• A one-page runbook naming who restores, where the credentials are and whom to call.

The total recurring cost is small next to the staff time lost in re-entry and the erosion of parents' confidence in a school that promotes its "digital portal".

How to set up backups that actually restore

The first step is to find out what backup already exists and to obtain a complete copy today. Then build the plan.

1. Audit the current position. Ask the host and the developer what is backed up, how often, where, and how long it is kept. Get the answers in writing.
2. Take a full manual backup now (files and database) and store it in cloud storage the business controls. This is your safety net while the rest is set up.
3. Choose the primary automated method from the comparison above, matching the site type framework.
4. Add the independent off-site copy in a cloud bucket or managed service under a company account, encrypted, with retention set to at least 30 days.
5. Configure alerts so that a failed or missed backup sends an email to a monitored inbox. Silent failure is the most common backup problem.
6. Write the restore runbook: where the backups are, the credentials (in the password manager, not the runbook), the steps, and who does it.
7. Test a restore to a staging environment, time it, and note anything that had to be fixed manually. Repeat quarterly, or each term or season for businesses with a natural cycle.
8. Review before major changes. Take a fresh backup before every plugin update, theme change or migration.

Mistakes to avoid

• Assuming "the host does it". Host backups may be infrequent, short-lived, slow to restore and on the same infrastructure. Treat them as one layer.
• Backing up to the same server. A plugin that stores copies in a folder on the hosting account loses them with the account.
• Never restoring. Corrupt archives, missing database exports and forgotten configuration only surface during a real emergency.
• Short retention. Seven days is not enough when a hack or corruption is discovered on day twelve.
• Ignoring uploads and external services. Product images, documents and form data held in third-party tools need their own export.
• Leaving backups in the developer's personal cloud account. When the relationship ends, so does your access. Use a company account.
• Storing unencrypted copies of customer data. Backups are personal data under the NDPA; secure them like the live site.

Conclusion

The decision is simpler than the options suggest: keep the host's backups, add an independent, encrypted, off-site copy under the business's own account, retain it for at least 30 days, get alerted when a backup fails, and rehearse a restore every quarter. Size the frequency to the site: weekly and daily for brochure sites, hourly or continuous database copies for stores and portals. The monthly cost is modest; the alternative is re-entering a term's results or a month's orders by hand. If you want a backup plan set up, documented and tested for your site, or included in an ongoing maintenance arrangement, Linestech can review your current hosting and put the right layers in place.

Frequently asked questions

How often should a Nigerian business website be backed up?

Match frequency to how often the site changes. A brochure site needs a weekly file backup and daily database copy; a store or portal needs daily files and hourly or continuous database backups so orders and bookings are not lost. Always take an extra backup before updates or migrations.

Are free WordPress backup plugins good enough?

For small brochure sites, a reputable free plugin sending copies to cloud storage is adequate if someone checks that the schedule runs. Premium tiers add incremental backups, better scheduling, encryption and support, which matter for larger sites and stores. The plugin's reliability record matters more than its price.

Where should off-site website backups be stored?

In cloud object storage or a managed backup service under an account the business owns, encrypted, in a different provider from your hosting where practical. Avoid office drives and personal laptops as the only copy: power, theft and hardware failure make them unreliable in Nigerian conditions.

How long does it take to restore a website from backup?

A prepared restore of a typical WordPress site takes 15–60 minutes; a whole-server snapshot rollback can take minutes; an unprepared restore with missing configuration can take days. The difference is whether a restore has been rehearsed and documented, which is why quarterly tests matter.

Do backups protect my website against hackers?

They make recovery possible but do not prevent attacks. After a breach you restore a clean copy from before the compromise, then close the entry point. Without retention long enough to reach a clean copy, backups only preserve the infected site. Pair backups with updates, firewall and access controls.

Who should own the backup accounts and credentials?

The business, through a company email and password manager, with at least two trusted people able to access them. Developers and agencies can be given access to operate the backups, but ownership should never sit in a contractor's personal account.

Sources and further reading

Figures, platform rules and regulations change. These are the primary references behind this article and the places to check before you act on it.

• Nigeria Data Protection Commission (NDPC)
• MDN Web Docs — web platform reference
• Core Web Vitals — web.dev
• PostgreSQL documentation
• Cloudflare Learning Center
• Baymard Institute e-commerce UX research