Most site owners discover their backup is broken at exactly the worst moment — when they actually need to restore it. Backups are one of those maintenance tasks that feel optional until they're not. The uncomfortable truth: a backup that hasn't been tested isn't a backup. It's a false sense of security.
This guide covers what you need to back up, how often, where to store copies, which tools to use, and — critically — how to verify that a restore actually works before an emergency forces you to find out.
What Exactly Needs to Be Backed Up
A complete WordPress backup has two components. You need both. Missing either one means an incomplete restore.
The Database
The WordPress database (typically MySQL or MariaDB) contains everything dynamic: all posts, pages, comments, user accounts, settings, plugin configuration, and WooCommerce orders. If your database is lost and you only have the files, you have an empty shell.
The Files
The files component includes WordPress core, your active theme, all installed plugins, and — most importantly — the /wp-content/uploads/ directory where all your media is stored. Without your uploads folder, you lose every image and document your site has ever used.
Some hosts advertise "database backups" as a feature. That is not a complete backup. Ensure your backup solution captures both the database and the full file system.
How Often Should You Back Up?
The right backup frequency depends on how often your content and data changes. Use these as starting guidelines:
- Blog or portfolio (low update frequency) — weekly backups are sufficient if you publish infrequently
- Business or service site (moderate updates) — daily backups. New content, form submissions, and contact data accumulate quickly.
- WooCommerce or membership site — real-time or hourly database backups. Every order, every transaction, every new member account is data that cannot be manually reconstructed. File backups can remain daily since product images change less frequently.
Where to Store Your Backups
The cardinal rule: never store your only backup on the same server as your website. If your server is compromised, hacked, or physically fails, local backups go down with it.
Off-Site Storage Options
- Amazon S3 — highly reliable, cost-effective at scale, supported by virtually every backup plugin
- Google Drive or Dropbox — easy to set up, good for smaller sites, storage limits to be aware of
- Backblaze B2 — cheaper than S3, straightforward pricing, increasingly well-supported by backup tools
Ideally, maintain two off-site copies using the 3-2-1 rule: three total copies of your data, on two different media types, with one stored off-site.
Best WordPress Backup Plugins
UpdraftPlus (Free Tier)
UpdraftPlus is the most widely used WordPress backup plugin. The free version covers scheduled backups with remote storage to Google Drive, Dropbox, S3, and others. It handles both database and file backups, and the restore process is manageable directly from the WordPress dashboard. Sufficient for blogs and small business sites.
BlogVault
BlogVault is the better choice for WooCommerce stores and high-traffic sites. It provides real-time incremental backups (only changes are synced), a built-in staging environment for testing restores, and off-site storage included in the subscription. Restores are faster because incremental backups are smaller.
Duplicator
Duplicator is the go-to tool for site migrations rather than ongoing backups. It packages your entire site — files and database — into a single installer archive that can be deployed to a new host. Useful to know, but not a substitute for automated scheduled backups.
How to Test a Backup
Testing a backup means performing a full restore to a staging environment and verifying the site works. Here is the process:
- Set up a staging environment — most managed WordPress hosts include this. Alternatively, use a subdomain or a local environment like Local by Flywheel.
- Restore your latest backup to the staging environment using your backup plugin's restore function.
- Verify the database restored correctly: check that posts, pages, and settings are present. For WooCommerce, confirm that recent orders appear.
- Verify the files restored correctly: check that the media library is intact and images display properly.
- Test the front-end: browse the site, submit a test form, and run through any critical user flows.
- Document the date and result of the test. Run this process quarterly at minimum.
Backup Retention: How Long to Keep Them
Keeping only your most recent backup is a common and dangerous mistake. Malware infections often sit dormant for weeks before activating — if your oldest backup is three days old and the infection is two weeks old, every copy you have is already compromised.
Minimum retention guideline: 30 rolling days. For sites with regulatory requirements or high transaction volume, 90 days is safer. Keep at least one monthly snapshot for the past 12 months as a long-term archive.
Not having a working backup is a financial exposure. Emergency WordPress recovery services — manual database reconstruction, malware removal, and file restoration — typically cost between $500 and $2,000 or more, depending on the complexity of the site. That's before factoring in revenue lost during downtime. Automated backups cost a few dollars a month. The math is straightforward.