Backup Retention Policies: How long to keep backups

A backup retention policy defines how long you keep backups before deleting them. Without a policy, backups accumulate forever, consuming storage space and increasing costs. With a policy, you balance recovery needs against storage limits and compliance requirements.

What is a retention policy?

A retention policy specifies:

• How many daily backups to keep (e.g., last 7 days)
• How many weekly backups to keep (e.g., last 4 weeks)
• How many monthly backups to keep (e.g., last 12 months)
• Which backups are archived permanently
• When to delete old backups automatically
• How long to keep deleted data in case of recovery needs

Factors that affect retention

Type of data

Business criticality

• Critical systems: Keep more backups. Daily for 30 days, weekly for 1 year.
• Important systems: Keep moderate backups. Daily for 7-14 days, weekly for 3-6 months.
• Non-critical systems: Keep fewer backups. Daily for 3 days, weekly for 1-2 months.

Storage capacity and cost

• Each backup consumes storage space
• Large sites with frequent backups fill storage quickly
• Off-site cloud backups cost per GB per month
• Older backups may be moved to cheaper archival storage

Recovery scenarios

• User mistakenly deleted a file yesterday → keep 7 days minimum
• Database corruption discovered last week → keep 14 days minimum
• Ransomware found after 30 days → need 31+ day old backup
• Data breach investigation 6 months ago → may need year-old backups

Common retention policies

Grandfather-Father-Son (GFS) Policy

A classic rotation strategy for layered retention:

• Son (Daily): Keep last 7 daily backups
• Father (Weekly): Keep last 4-5 weekly backups
• Grandfather (Monthly): Keep last 12 monthly backups

Result: You have granular recovery options for 1+ year of data, while space usage grows slowly.

Rolling window (most common for small sites)

• Keep last 7 daily backups (delete older than 7 days)
• Then keep 4 weekly backups after that
• Then keep 12 monthly backups after that

Result: Automatic cleanup saves space; old backups deleted when policy triggers.

Tiered retention

• Backups 0-7 days old: Keep on-server (fast restore)
• Backups 8-30 days old: Move to cold storage (slower but cheaper)
• Backups 31+ days old: Archive or delete per policy

Result: Balances fast recovery for recent backups with cost savings for older backups.

Compliance-driven retention

• Keep all backups for required period (e.g., 7 years for financial data)
• Can't delete until retention period expires
• Requires more storage but meets legal requirements

Compliance and legal holds

Some industries require minimum retention periods:

Storage costs and cleanup

On UnderHost shared hosting:

• Backups count toward your disk quota
• Older backups consume space that could be used for your website
• Delete old backups manually when storage is running low
• Backuply may have automatic retention settings—check your control panel

On Cloud VPS or Dedicated Servers:

• You pay per GB of disk storage
• Each backup that accumulates increases your bill
• Automatic retention policies save money by deleting old backups
• Off-site backups (cloud storage) add per-GB monthly costs

Cost calculation example:

• Website size: 50 GB
• Daily backups for 30 days: 1,500 GB (50 × 30)
• Cloud storage cost: $0.023 per GB/month = ~$35/month
• With retention policy (keep 7 days): 350 GB stored = ~$8/month

How to implement retention

For UnderHost shared hosting with Backuply:

1. Log in to cPanel → Backuply
2. Look for backup settings or retention options
3. Set automatic backup schedule (daily is recommended)
4. Set retention to delete backups older than X days
5. Monitor your disk usage to ensure retention is working
6. Contact support if Backuply doesn't have retention settings

For Cloud VPS or Dedicated Servers:

Create an automated retention script using cron:

# Delete backups older than 30 days
find /backup/directory -name "*.sql.gz" -mtime +30 -delete

# Schedule daily via crontab
0 2 * * * find /backup/directory -name "*.sql.gz" -mtime +30 -delete

Or use cloud provider retention policies:

• AWS S3: Set lifecycle policies to delete/archive after X days
• Google Cloud Storage: Configure retention policies in bucket settings
• Backblaze B2: Set file retention and auto-delete rules

Retention at UnderHost

Shared Hosting:

• Server maintains rolling backups for 5-7 days (included with plan)
• You can request restore from server backup up to 7 days old
• Backuply (if available) allows you to set your own retention
• Offsite backups are your responsibility (we support uploads to remote storage)

Cloud VPS & Dedicated Servers:

• You manage all backups; there are no automatic server-side backups
• Set up your own retention policy with cron jobs or cloud services
• Snapshots (if available) may have automatic lifecycle policies

Related: Backup best practices | Disaster recovery planning | Database backup

Related articles