Backups are only useful if you have the right one when you need it. A backup from yesterday is great if you noticed a problem today. A backup from yesterday is useless if the problem started three weeks ago and just became visible now.
Retention policy is the part of your backup strategy that decides how far back you can go. Daily backups for 30 days gives you 30 restore points. Hourly backups for 24 hours gives you 24 restore points within that window. Weekly backups for a year gives you 52 restore points spread over a longer period.
This piece covers what backup retention means, why different retention strategies fit different situations, and how to figure out what you actually need.
What Retention Policy Actually Means
A retention policy defines two things. How often backups get made, and how long each backup gets kept before being deleted.
The Two Variables
Backup frequency is how often a new backup gets created. Common options are continuous (real-time replication), hourly, daily, weekly, and monthly.
Retention period is how long each backup gets kept. Common options are 7 days, 30 days, 90 days, 1 year, or longer.
These two combine to give you a set of restore points. Daily backups kept for 30 days produces 30 daily restore points. Hourly backups kept for 7 days produces 168 hourly restore points.
The Restore Window
Your restore window is the amount of time you can go back. If your retention is 30 days, you cannot restore from 31 days ago. Anything older is gone.
The window matters because some problems are not noticed immediately. Malware infections, slow data corruption, content issues that develop over time. If the window is too short, you find out about a problem but you cannot get back to a clean state.
Granularity
Granularity is how precisely you can pick a restore point. Daily backups give you day-level granularity. Hourly backups give you hour-level. Continuous replication gives you minute-level or better.
Finer granularity means less data loss when you restore. With daily backups, restoring loses up to 24 hours of changes. With hourly backups, it loses up to one hour.
Why Retention Length Matters
Different problems need different retention windows to handle properly.
Recent Mistakes
The most common backup use case is recent mistakes. Someone deletes the wrong file. A plugin update breaks something. A staging change gets pushed to production by accident.
For these cases, recent backups are enough. Even 7 days of retention catches most accidental issues that get noticed quickly.
Slow-Developing Problems
Some problems develop over time. Database corruption that gets worse week by week. Content that gets wrong slowly through multiple small edits. Performance issues that creep up.
For these cases, longer retention helps. You may need to go back weeks or months to find a clean version.
Malware & Infections
Malware infections often go undetected for weeks. By the time you discover them, recent backups are also infected. Restoring from yesterday brings the malware back.
For malware recovery, you need backups from before the infection started. This can be days, weeks, or months. Longer retention gives you more options.
Compliance & Legal
Some industries have compliance requirements that mandate retention periods. Healthcare, finance, government contracting all have rules about how long records must be kept.
For these situations, retention is dictated by regulation, not by your preference.
Historical Reference
Sometimes you need to see what content looked like at a specific point in the past. Legal disputes, content provenance, historical research. Long retention lets you go back to specific moments.
Common Retention Policies
Different setups suit different situations.
Basic Policy
Daily backups kept for 7 to 14 days. This is the minimum acceptable for most sites. It catches recent mistakes but does not help with longer-developing problems.
Many budget hosts default to this level. It is better than nothing but limited.
Standard Policy
Daily backups kept for 30 days. This is the most common recommendation for business sites. It covers the vast majority of recovery scenarios.
Most managed WordPress hosts include this by default.
Extended Policy
Daily backups kept for 30 days, plus weekly backups kept for 90 days, plus monthly backups kept for a year. This gives you fine granularity for recent issues and longer retention for slow-developing ones.
This is closer to enterprise backup practice. The storage cost is higher but the protection is much better.
Continuous Backup
Real-time or near-real-time replication keeping changes as they happen. Combined with traditional backups for longer retention.
This is the highest level of protection. The cost matches.
Storage Considerations
Longer retention means more storage. The trade-offs matter.
Storage Cost
Each backup takes storage space. A 10 GB site with 30 daily backups uses 300 GB of backup storage (without deduplication).
Modern backup systems use incremental backups and deduplication to reduce this. The actual storage might be a fraction of the naive calculation. But the storage cost is still real.
Cost vs Value
For most sites, the cost of additional retention is small compared to the value of being able to recover from longer-developing problems. The math usually favors more retention.
The exception is very large sites where storage costs become significant. For these sites, tiered retention (daily for recent, weekly for older, monthly for oldest) balances cost and protection.
Cold Storage
For very long retention, cold storage options like AWS Glacier or Backblaze B2 offer cheap storage at the cost of slower retrieval. Useful for backups you rarely need to access but want to keep.
For typical website backups, hot storage (immediate access) is more practical.
How to Pick the Right Retention
The right retention depends on your specific situation.
Look at Your Risk Profile
What kinds of problems are most likely for your site? E-commerce stores worry about malware and data corruption. Content sites worry about content loss. Membership sites worry about user data.
Match your retention to the threats that worry you most.
Consider Your Discovery Timeline
How quickly do you notice problems? Active sites with daily monitoring catch issues fast. Sites that get monitored weekly or monthly need longer retention to cover the discovery gap.
Factor in Compliance
If you have compliance requirements, those set the floor. You cannot drop below what regulations require.
Match Backup Quality to Site Value
A hobby blog can survive with basic retention. A revenue-generating site needs more protection. Match your backup investment to what the site is worth.
Common Retention Mistakes
People make predictable mistakes with retention policies.
Too Short by Default
Many sites accept the default retention from their host without thinking about it. The defaults are often inadequate for the actual risk profile.
Take a moment to evaluate if the default retention matches your needs.
No Long-Term Backups
Daily backups for 30 days catches recent issues but misses anything that needs longer recovery. Adding monthly backups for a year fills this gap at low cost.
Forgetting About Deletion
When backups age out of retention, they get deleted. If you need a specific backup, make sure it does not expire before you grab it.
For legal holds or specific situations, mark important backups so they do not get deleted on the regular schedule.
Not Testing Old Backups
Recent backups get tested implicitly when you restore from them. Old backups in long retention may have never been tested. Periodically restore from older backups to confirm they actually work.
Ignoring Storage Growth
As your site grows, your backups grow too. The retention policy that worked when your site was 1 GB might be expensive when it is 50 GB. Review periodically.
Putting Restore Windows in Context
Backup retention is one of those topics that does not get much attention until you need it. Most sites accept whatever retention their host provides and move on. For some sites, that is fine. For many, it is not enough.
The right retention policy matches the risks your site faces and the value of the data on it. A hobby blog can run on 7 to 14 days of daily backups without worrying much. A business site benefits from 30 days of daily backups. An e-commerce store or membership site benefits from longer tiered retention that catches both recent and slow-developing problems.
The cost of additional retention is usually small. The value when you actually need it is large. The math favors more retention for most sites.
If you have not thought about your retention policy in a while, take a few minutes to check. Find out what your host actually keeps and for how long. Compare it to the risks your site faces. Adjust if needed.
Sites with proper retention can recover from a wide range of problems. Sites without proper retention often find out about the gap at the worst possible moment. The choice between thinking about retention now and thinking about it during a recovery emergency is not really a choice. Set it up now and the future emergencies become inconveniences instead of disasters.
