Backing up your hotel website and booking data (2026)

Updated: 10 November 2026

A hack, ransomware, a provider outage or an update gone wrong: if there is no working backup that day, the hotel is left without its website, its bookings and the data the law requires it to keep. This guide sums up what we could check on 10 November 2026 at INCIBE (Spain's cybersecurity institute), in the GDPR, in Spain's Official Gazette and in the WordPress documentation, and flags what we could not confirm. We do not recommend any paid service. If your site has already been hacked, see our guide /hotel-website-hacked-what-to-do-google-warning-2026.

The short answer

The essentials:

Back up the website (files and database), email, guest records, bookings and, in Spain, the traveller register.
INCIBE recommends the 3-2-1 strategy, based on diversifying copies; the usual wording is three copies, on two different media, one kept off-site.
The GDPR (art. 32(1)(c)) requires the ability to restore the availability and access to personal data in a timely manner after a physical or technical incident, and art. 32(1)(d) regular testing of the measures.
In Spain, traveller register data must be kept for 3 years from the end of the service (Royal Decree 933/2021, art. 5.3).
A backup you have never restored is a backup you do not know works: test the restore.

What to back up

A practical list for a hotel:

Website: according to the WordPress documentation, you need both the database and the files (core, themes, plugins, uploads, wp-config.php and .htaccess) to fully restore it.
Booking engine and PMS: ask your provider what backups they make, how often, where they keep them and how you can export your data. Our tip.
Email: conversations with guests and suppliers are often the hotel's memory.
Guest records, invoices and contracts with agencies and platforms.
Traveller register (Spain): Royal Decree 933/2021 requires a computerised register and keeping its data for 3 years from the end of the service; non-professional hosts are exempt from that retention (art. 5.4). Check your case with your adviser. For Italy, Portugal and Greece we did not confirm the retention period.

The 3-2-1 rule, explained

How a small hotel can apply it:

INCIBE recommends the 3-2-1 strategy, «based on diversifying copies», so that there is always a copy the malware has not encrypted.
Three copies: the original data plus two backups.
Two different media: for example, the hosting server and an external drive. WordPress advises keeping at least three copies on different media and in different locations.
One off-site copy: outside the hotel and, ideally, disconnected from the computer or network when not in use, so ransomware cannot reach it. Our tip.
INCIBE lists location, control of media, encryption, a backup log, restore tests and secure deletion among the ways to protect backups.

Frequency and WordPress website backups

No specific paid plugins or services:

WordPress recommends weekly backups for small sites, daily for high-activity sites, and a database backup always before an upgrade.
Keep 3 to 5 recent backups in different locations (for example hosting, cloud storage and a local computer).
If your host makes automatic backups, make a manual one from time to time: WordPress advises this to make sure the process is working.
To restore, WordPress says: files first, then the database, and update wp-config.php if the database credentials changed.

Testing the restore

What the GDPR asks and what we recommend:

Art. 32(1)(d) of the GDPR requires a process for regularly testing, assessing and evaluating the effectiveness of security measures.
INCIBE lists restore tests among the measures to protect backups.
Once a quarter, restore the site to a test subdomain or locally and open an old booking to check the data is complete. Our tip, not a legal deadline.
Write down the date of each test and what failed: it helps show due diligence.

Ransomware, breaches and the 017 line

If the worst happens:

INCIBE says paying the ransom is «in no case» an advisable option: clean the devices and restore the backups.
In Spain, INCIBE points to its 017 Cybersecurity Helpline if you have doubts.
If personal data was affected, the GDPR (art. 33) requires notifying the data protection authority no later than 72 hours after becoming aware of it. General information, not legal advice.
If the site is already hacked, follow our guide /hotel-website-hacked-what-to-do-google-warning-2026.

If you run a property: what travellers ask AI

Why the website also matters for assistants:

Travellers ask AI assistants about price, availability, cancellation terms or whether they can book direct.
If your site goes down or shows old data after an incomplete restore, those answers may lack your information or use outdated details.
After a restore, check prices, policies and booking links before declaring the site recovered. Our tip.

How iQuota helps

iQuota makes independent properties available to AI assistants with direct booking, payment at the property and 0% commission, with the price and terms each property sets. We cannot guarantee that an AI assistant will recommend you.

Want AI to give your real details, with direct booking and no commission? The first 30 hotels join free until 30 June 2027.

See the Founding Hotels programme

Frequently asked questions

What is the 3-2-1 rule?

INCIBE recommends it as a strategy based on diversifying copies. The usual wording: three copies, on two different media, one off-site.

How long must the traveller register be kept in Spain?

Three years from the end of the service, under art. 5.3 of Royal Decree 933/2021 (except non-professional hosting, art. 5.4).

Does the GDPR require backups?

It does not use that word, but art. 32(1)(c) requires the ability to restore availability and access to personal data in a timely manner after an incident. General information, not legal advice.

How often should I back up the website?

WordPress recommends weekly for small sites, daily for high-activity sites and always before an upgrade.

Should I pay a ransomware demand?

INCIBE advises against it in all cases. Restore from clean backups and, in Spain, call 017 if in doubt.

Sources

More guides for hotels

More guides for hotels →

Español · Italiano · Português · Ελληνικά