Your host says "daily backups included" and everyone nods. Then ransomware hits on a Tuesday and someone asks how fast we can restore. That is when hot and cold backups stop being jargon and start being the difference between a bad afternoon and a bad quarter.
Most Canadian SMBs need both concepts understood, not one magic checkbox. Here is the plain-language version we use with clients on Swift Host infrastructure.
Hot backups (ready to restore now)
Hot backups live close to production: same data centre, fast disk, maybe snapshots you can mount in minutes. Your host's nightly cPanel backup, VPS snapshot, or managed backup agent keeping recent copies on fast storage.
Good for: accidental file deletes, bad plugin update, "I overwrote the wrong page," quick rollbacks.
Weak against: ransomware that encrypts connected backup targets, admin account compromise that deletes backups too, data centre-wide failures if hot copies never leave the building.
Cold backups (offline or off-site, slower to fetch)
Cold backups are detached from production: object storage in another region, tape (still a thing for some enterprises), immutable S3-style buckets, or weekly dumps to a provider your production server cannot reach without a separate login.
Good for: ransomware recovery, "everything in the primary DC is gone," compliance retention, point-in-time restores from last week when you did not notice corruption for days.
Tradeoff: restore takes longer. Minutes or hours instead of seconds. You plan a maintenance window.
RTO and RPO in human terms
RPO (recovery point objective): how much data you can afford to lose. Daily backups = up to 24 hours of changes gone. Hourly = less loss, more cost.
RTO (recovery time objective): how long until you are back online. Hot snapshot might be 30 minutes. Cold off-site restore might be half a day with testing.
A law firm and a hobby blog have different answers. Write yours down before you buy backup add-ons you will never test.
What "included backups" usually mean
Hosting plans often include hot-style backups: daily, retained 7–30 days, same facility. Valuable. Not a complete disaster recovery strategy alone.
Ask your host:
- Are backups stored on the same server or account?
- Can compromised admin credentials delete them?
- Is there off-site or immutable retention?
- Have you personally restored a full site from backup in the last year?
That last question embarrasses more teams than you would think.
Canadian data residency angle
Off-site does not have to mean US-only. You can keep primary hosting in Edmonton or Beauharnois and cold copies in another Canadian region or provider. Document where each tier lives for Law 25 and client questionnaires.
Cross-border cold storage is fine for some workloads. Know what you signed up for.
A sensible stack for most businesses
- Automated daily hot backups on the host (what managed plans include)
- Weekly cold copy to separate storage with different credentials
- Quarterly restore test on staging (actually boot the site, check DB)
- Version control or exports for irreplaceable config (DNS zone file, env templates)
WordPress owners: backup plugins help, but verify backups leave the server. Ransomware looks for backup folders first.
When cheap backup theater fails
- Backup job ran but disk filled up six months ago (nobody got alerts)
- Database dump is empty because mysqldump lacked permissions
- Restore works on files but WooCommerce orders table is missing
- Only production was backed up; staging had the fix you needed
Test restores are boring until they are not.
Bottom line
Hot backups get you through Tuesday's mistake. Cold backups get you through Tuesday's catastrophe. Most teams need daily hot plus periodic cold, tested restores, and honest RTO/RPO numbers written down.
Want backup strategy reviewed on Canadian hosting? Talk with Swift Host. We will tell you what your current plan actually covers and what is missing before you need it.
