Every WordPress site will eventually have a bad day: a plugin update that breaks the layout, a hosting failure, an accidental deletion, or a hack. On that day, the only thing that matters is whether you can get back to a working version quickly. Many site owners believe they are covered because “the host does backups”, then discover that the backups are only kept for a few days, cannot be downloaded, or were never tested. A reliable backup strategy takes an hour to set up and can save weeks of work.
This article is part of our complete guide: How to Build a WordPress Website for Your Business (2026 Guide).
What a WordPress backup must include
A complete WordPress backup has two parts:
- Files: WordPress core, themes, plugins, and most importantly
wp-content/uploads(all your images and documents), plus configuration files such aswp-config.phpand.htaccess. - Database: all posts, pages, products, orders, users, settings and page builder layouts.
Backing up only the database loses your images; backing up only files loses your content. You need both, taken at the same time so they match.
The 3-2-1 rule
A simple, proven principle:
- 3 copies of your data (the live site plus two backups).
- 2 different storage types or providers.
- 1 copy off-site, away from your hosting account.
If your only backups live on the same server as the site, a server failure, account suspension or hack can take them all at once.
How often to back up
Match frequency to how often your site changes:
- Brochure sites that change monthly: weekly backups plus a manual backup before any update.
- Active blogs and business sites: daily backups.
- WooCommerce stores and membership sites: daily full backups and more frequent (hourly or real-time) database backups, because orders and accounts change constantly.
Always take an on-demand backup before updating WordPress, themes or plugins, and before major edits.
How long to keep backups (retention)
Keep at least 30 days of backups, ideally longer. Why? Hacks are often discovered weeks after they happen. If you only keep seven days of backups, every copy may already contain the malware. A mix works well: daily backups for 30 days, plus weekly or monthly backups kept for several months.
Where to store backups
- Hosting backups: convenient for quick restores, but not enough on their own.
- Cloud storage: a backup plugin can send copies to services such as Google Drive, Dropbox, Amazon S3, Backblaze or similar. Use a dedicated account with strong security.
- Managed backup services: some tools store backups on their own infrastructure and offer one-click restores.
Protect backup storage with strong passwords and two-factor authentication. Backups contain your whole site, including customer data.
Choosing a backup method
Host-level backups
Many hosts include automatic daily backups. Check how long they are kept, whether you can download them, and whether restores are free. Treat them as your first layer.
Backup plugins
Plugins such as UpdraftPlus and others can schedule backups and send them off-site. Configure them to exclude cache folders and old backups inside backups, which can bloat archives.
Managed services
Some services provide incremental, real-time backups with off-site storage and easy restores. Useful for stores and larger sites.
Staging sites and backups
A staging site is a private copy of your website where you can test updates, design changes and new plugins before applying them to the live site. Many hosts offer one-click staging. Combined with backups, it removes most of the risk from maintenance: you test on staging, take a backup of live, apply the change, and check. If anything goes wrong, you restore in minutes. Make sure staging sites are password protected and set to noindex, so search engines never index a duplicate copy of your website.
Common backup mistakes
- Relying on a single backup location.
- Keeping only a few days of history.
- Storing backups in a public folder on the server, where anyone who guesses the file name can download them.
- Never testing a restore.
- Backing up the database but not the uploads folder.
Test your restores
A backup you have never restored is a hope, not a plan. At least twice a year:
- Restore a backup to a staging site or a local environment.
- Check that pages, images, forms and (for stores) products and orders work.
- Note how long the restore took and any steps that were confusing.
- Write down the process so anyone on your team can follow it.
Restoring after a failed update
If an update breaks the site, restore the backup you took immediately before the update. Then test the update on staging to find the conflict, or wait for a fix from the plugin developer before updating again.
Restoring after a hack: be careful
Restoring a backup does not fix the vulnerability that let the attacker in. If you restore without updating plugins, changing passwords and closing the entry point, you are likely to be hacked again. Backups taken after the infection started may also contain hidden backdoors. Identify when the hack began, restore from before that date if possible, then harden the site immediately. See signs your WordPress site is hacked and our security checklist.
WooCommerce: special considerations
Restoring an old database on a store can wipe out orders and customer accounts created since the backup. Before restoring, export recent orders, or restore only files if the problem is in code. This is why frequent database backups matter so much for stores. See our WooCommerce guide.
Backups and SEO
Backups protect your SEO too. A site that is down for days, or that has to be rebuilt from scratch after a hack, can lose rankings and indexed pages. A quick restore minimises downtime, and restoring clean content after spam injection speeds up recovery in Google. See removing hacked spam URLs.
A simple backup checklist
- Automated backups of files and database.
- Frequency matched to how often the site changes.
- At least 30 days of retention.
- At least one copy off-site.
- Backup storage protected with 2FA.
- Manual backup before every update.
- Restore tested twice a year and documented.
How we handle backups
Backups are part of every WordPress maintenance arrangement we set up, alongside updates, security hardening and monitoring. When we rebuilt or recovered sites such as those in our case studies, a reliable backup was always the first step before changing anything.
Related guides and services
- WordPress security checklist: the hardening steps we apply to every WordPress site.
- Signs your WordPress site is hacked: the warning signs and what to do in the first hour.
- Remove hacked spam URLs from Google: how to clear spam pages from search results after a hack.
- WordPress services: fast, secure WordPress builds and maintenance.
- WordPress malware removal: emergency clean-up and hardening for hacked WordPress sites.
Get expert help
We can set up automated, off-site WordPress backups, test restores and combine them with updates and security monitoring so you can always recover. Start with our WordPress services, browse real client results in our case studies, or contact us for a free, no-pressure review of your website.
Frequently asked questions
Are my host’s backups enough?
They are a good first layer, but keep at least one off-site copy you control, with longer retention.
How often should I back up WordPress?
Weekly for rarely updated sites, daily for active sites, and more often for stores.
Where should I store WordPress backups?
At least one copy off-site, such as secure cloud storage, separate from your hosting account.
Can I restore only part of a backup?
Many tools allow restoring files or database separately, which is useful for stores.
