"Automatic backups included" reassures on the product sheet. Then comes the wrong folder deleted, corrupted database after migration, or ransomware — and support says restore only possible for the last 7 days, managed databases not covered, or you need a €49 billed ticket. That is not an edge case: it is the gap between a marketing line and continuity planning.
"Included backup" is only worth what fine print specifies: what, when, how long, where, and how you recover.
Five variables marketing skips
1. Frequency. Daily? Weekly? Once at provisioning? A weekly snapshot leaves a six-day hole.
2. Retention. 7, 14, 30 days — sometimes less. Beyond that, your data no longer exists on the host side.
3. Scope. Web files only? Full VM? Consistent SQL (hot dump vs crash-consistent snapshot)? Network config, certificates, crons?
4. Restore. Self-service one-click or 48-hour ticket? File-level vs full restore overwriting production?
5. Location. Copy in same datacenter = correlated risk on site incident. Off-site or under your account = better resilience.
| Displayed promise | Question to ask | Weak signal |
|---|---|---|
| "Automatic backups" | Automatic at what time? | No schedule docs |
| "30-day retention" | Rolling or calendar days? | Retention absent from contract |
| "Restore included" | How many restores/month? | Per-restore billing |
| "Snapshots" | Database consistency included? | Snapshot without SQL quiesce |
Shared, VPS, cloud: three different logics
On shared hosting, included backup mostly protects the host from shared disk failure — not necessarily your FTP mistake. On VPS, a hypervisor snapshot may exist without consistent DB dump. On cloud IaaS, included is often minimal; paid snapshots and lifecycle policies become your job.
Many teams learn too late that "included backup" meant "provider infra snapshot," not "I can roll back my orders table to yesterday 2:32 p.m."
Test before you need it
An untested backup is a hypothesis. At least quarterly:
- Restore a sample (file + SQL table) to a test environment.
- Time the real delay — not marketing's.
- Verify application integrity after restore.
The summit: included mostly protects the provider
Decide and move forward without blind spots
List your loss scenarios: human deletion, deploy bug, ransomware, DC failure. For each, check whether included covers it.
Budget a layer under your control (S3-compatible, Borg, restic) if included is short or opaque.
Compare offers via our directory and hosting backup guides at /en/guides/.
Frequently asked questions
Do included backups replace a real recovery plan?
Rarely. They often cover a limited infra snapshot, with no contractual RTO/RPO, no restore test, and no off-site copy under your control.
What should you check in included backup terms?
Frequency, retention length, scope (files, databases, config), restore cost and delay, exclusions (large volumes, managed DBs), and copy location.
Do shared-hosting backups protect against user error?
Not always. Some only cover host-side hardware failure. Accidental file deletion may be unrecoverable with short or no retention.
Should you pay for backup on top of the base plan?
Often yes for serious projects — especially if included means 7 days, paid restore, or snapshots without consistent database dumps.
Before ticking "backup included," ask for a test restore — not a product screenshot.