How do you back up a WordPress site properly? Back up both the files and the database, automatically, on a schedule that matches how often the site changes, and keep copies somewhere other than your hosting account. Then test a restore, because a backup you can’t restore is not a backup.
I’ve rescued sites where the owner believed they had backups. Sometimes they did, but the backups were stored on the same server that had just failed, or they only covered the database.
Here is how to set up backups that will save you on a bad day.
What a WordPress backup must include
A WordPress site has two parts. You need both.
- The database. Your pages, posts, products, orders, settings and users all live here.
- The files. WordPress core, your theme, plugins and everything in the uploads folder, which holds your images and documents.
A database-only backup brings back your words but not your images. A files-only backup brings back the design but not your content. Many “free backup” options cover only one.
How often should you back up?
Match the schedule to how much you could afford to lose.
| Type of site | Suggested schedule |
|---|---|
| Brochure site that rarely changes | Weekly, plus before every update |
| Site with a blog or regular edits | Daily |
| Online shop or booking site | Daily at least, ideally real-time for the database |
If you take orders, ask yourself: how many orders could you afford to lose? A daily backup taken at midnight loses everything since midnight if the server fails at 11pm.
Where to store backups: the 3-2-1 rule
The safest approach is the 3-2-1 rule:
- 3 copies of your data.
- 2 different types of storage.
- 1 copy off-site, away from your hosting account.
In practice, for a small business site, that means your host’s own backups plus an automatic copy sent to cloud storage such as Google Drive, Dropbox or Amazon S3.
Never rely only on backups stored on the same server as the website. If the server fails, the account is suspended or a hacker deletes files, those backups go too.
Your options for backing up WordPress
Host backups
Many good hosts take daily backups automatically and let you restore in a few clicks. They are a great first layer. Check how long they are kept and whether you can download them.
A backup plugin
A reputable backup plugin can schedule full backups and send them to cloud storage. This is the easiest way to get an off-site copy. Pick one that is actively maintained and widely used.
Manual backups
Downloading files over SFTP and exporting the database works, but nobody does it consistently. Use it before a risky change, not as your main plan.
Test your restore
This is the step almost everyone skips. At least a few times a year:
- Restore a recent backup to a staging site, never over the live site. I explain staging in what a staging site is.
- Click through the key pages, the forms and, if you have one, the checkout.
- Check that images load and that you can log in.
- Note how long the restore took, so you know what to expect in a real emergency.
If the restore fails, you have found the problem on a calm day instead of during an outage.
When to take an extra backup
Take a fresh, manual backup right before:
- Updating WordPress, a theme or a major plugin.
- Installing a new plugin you haven’t used before.
- Changing hosts or domains.
- Big design changes or a redesign.
- Editing theme files or code.
These are the moments sites break. My maintenance checklist builds this into the routine.
Common backup mistakes
- Backups stored only on the same server. One failure takes everything.
- Backups that silently stopped. A plugin was deactivated or cloud storage filled up months ago. Check that new backups keep appearing.
- Keeping only one copy. If your only backup was taken after a hack, it contains the hack. Keep several, going back at least a few weeks.
- Never testing. Corrupted or incomplete backups are more common than people think.
- Losing the login. If backups go to a personal cloud account that a former employee controls, they may as well not exist.
Let someone else worry about it
Backups are boring until the day they are the only thing that matters. Automatic off-site backups, monitoring and test restores are part of my WordPress support and maintenance plans, so you always have a recent copy and someone who knows how to use it.
Frequently asked questions
Are my host’s backups enough?
They are a good first layer, but don’t make them the only one. Keep an off-site copy that you control, in case of an account problem, a billing issue or a host outage.
How long should I keep WordPress backups?
Keep at least two to four weeks of history. Some hacks go unnoticed for days, so you may need to go back further than yesterday to find a clean copy.
Do backups slow down my website?
A well-configured backup runs at quiet times and should not be noticeable. If your site slows every night, the backup may be too heavy for your hosting plan.
Can I restore just one page instead of the whole site?
Usually not from a full backup without technical work. For a single page, check the revisions panel in the editor first, as WordPress keeps older versions of your content.
About the author
Vincent Earl Panoncial is a WordPress developer and the founder of VEP Studio. He has built and maintained 100+ WordPress websites, most of them at digital marketing agencies, and now works directly with businesses on development, maintenance and webmaster services.
Need a hand with your WordPress site?
Tell me what your website needs and you’ll get a clear plan and an honest answer on cost before any work starts. Get a free consultation →
