“Backed up”
isn’t the whole answer.

“Backup included” is easy to put on an invoice. The useful detail sits underneath: what is copied, how often, how long copies are retained and who can access them. Website files, content data and important configuration may all need consideration, depending on the build.

If the only backup is controlled through the same compromised hosting account, an attacker may be able to reach it too. Independently protected off-site copies help separate that risk. Off-site alone is not enough: permissions, retention and the restoration process still matter.

A backup that has never been restored is an untested recovery option. Ask who verifies it, what a restore involves and how recent the recovered content would be. A useful care agreement should make those responsibilities understandable before an urgent problem forces the conversation.

Storage, checks and recovery work take resources. They should be scoped alongside hosting and maintenance, rather than implied by a vague promise. No arrangement makes a site invulnerable, but a deliberate recovery plan gives you a better place to start when something goes wrong.