Backup, Hosting, Themes
comments 2

Beware of shared hosting and the storage of backups

Backups of your WordPress site or at least your database are essential right? Yes, absolutely, but sometimes you need to be careful where you put them, as I seek to show in this true story.

A good number of years ago I assumed responsibility for a non-profit, private sector organisation’s WordPress site and, because money was an issue, a well-known shared hosting provider was used to host the site.  We were mindful of the importance of backup so installed iThemes’ excellent BackupBuddy plugin. Periodically we made full site backups with the plugin. The backups were saved to a backups folder within our WordPress installation on the shared hosting server as well as to a local computer.

Some time later I received an unexpected email from the hosting provider which said, among other things:

“Your web hosting account for [website url] has been deactivated, as of [a specified date]. (reason: Backups/Storage Constraints)

This deactivation was due to a Terms of Service violation associated with your account. At sign-up, all users state that they have read through, understand, and agree to our terms. These terms are legal and binding.

Although your web site has been suspended, your data may still be available for up to 15 days from the date of deactivation; if you do not contact us during that 15 day period, your account and all of its files, databases, and emails may be deleted.”

I was a bit puzzled by this (not to mention miffed) as the site itself wasn’t massive and we weren’t using anywhere near our hosting package’s disc space allowance. After some digging, it turned out that the precise reason for the sudden site deactivation was the presence of the BackupBuddy backup files on the server. The host considered that the existence of those files was contrary to a sentence in its terms of use (in provisions discussing unlimited usage policies) that said the host did “not provide unlimited space for online storage, backups, or archiving of electronic files, documents, log files, etc., and any such prohibited use of the Services will result in the termination of Subscriber’s account, with or without notice.” This clause could have been better drafted but we could see that the hosting provider may have had a point.

The story ends happily, in that we removed the backup files and asked the host to reinstate the site which, thankfully, it did. (I believe the host has a good reputation. I’m not meaning to disparage it any way. If anyone was at fault, it was probably me.)

But what’s the moral of the story? The moral is actually two-fold. The first and perhaps obvious aspect is that those setting up hosting accounts for clients or others need not only to read the governing terms of use when signing up but also to remember the terms of use, or remember to check them, when doing anything subsequently to which the host might object (not always an easy thing to do…).

The second aspect is that WordPress users may need to take care of the manner in which they deploy the standard functionality of certain plugins. In particular, care may be needed where a given deployment could have an impact on one’s web host that amounts to a breach (or an arguable breach) of the host’s terms of use that you agreed to back in the dim dark ages. In our case, the BackupBuddy backups were being saved automatically to a folder at and that is what the host didn’t like.

Thanks to Bob Mical for the Data Center photo above, licensed under a Creative Commons 2.0 Generic licence


  1. Richard, I’m enjoying your blog quite a lot (despite the fact that your very first post described a situation that we’re in the middle of thrashing out with WordPress and I sure wish wasn’t necessary 😉 )

    This piece is not really a WordPress thing though, right? It’s a “digital rights and management” issue.

    Although I advise clients to give hosting customers less onerous terms–think “60 days”–in my experience, the fifteen days things is pretty common, although I expect there are numerous jurisdictions where laws are pending to define periods that are less stringent. Hopefully those laws also include better “explain the terms” terms. No comment as to just how binding click-wrap terms are.

    But as I said above at the end of the day this isn’t a legal issue at all; people take things for granted when they do hosting with (whomever) that really need to have greater attention paid to them.

    What IS a legal issue is the question of where your host is located. Here in the States, hosting out of the country is what amounts to illegal in certain businesses. Ironically, law being, as I understand it, among them. We even have Federal-level laws that prohibit “export of certain code”, with the penalties being identical to illegal export of MUNITIONS. Not kidding.

    Keep it coming, sir …

  2. Hi and thanks Jeff. Appreciate your kinds words and your comments.

    I guess this post does transcend WordPress, yes, but I wrote about it here given that a WordPress plugin was causing the issue without my realising it.

    You’re right that people often take things for granted. I do think this is a legal issue though, in the sense that often people don’t focus enough on their contractual obligations and in the sense that, in my view, the terms could have been clearer on the point in question.

    You’re raised two additional topics that are large topics in their own right: data management/preservation when outsourcing your hosting or using software-as-a-service models; and legal issues that can arise in the offshored hosting / cloud computing context. Governments, in particular, can be very sensitive to offshored hosting or data processing of certain kinds of data, particularly in the light of recent international events and particularly where there is any risk of data being stored or processed in countries with weak privacy and other laws. I’ve done quite a bit of work on such issues but this probably isn’t the place to discuss them.

    All the best with your business.

Leave a Reply

Your email address will not be published. Required fields are marked *