Key takeaways
- A complete backup includes files (themes, plugins, uploads, wp-config) and the database.
- Follow the 3-2-1 rule: 3 copies, 2 different storage types, 1 off-site.
- A backup you haven’t test-restored is a hope, not a backup.
Hacks, failed updates, accidental deletions, hosting problems — every site eventually needs a backup. The question is whether you have a recent, complete, restorable one when it happens. Here’s how to set up backups that actually save you.
What to back up#
| Part | Contains |
|---|---|
| Database | Posts, pages, settings, users, comments, orders, form entries |
wp-content/uploads |
Images, PDFs and media |
wp-content/themes and plugins |
Your theme (especially custom ones) and plugins |
wp-config.php, .htaccess |
Configuration, custom rules |
WordPress core files can be re-downloaded, but including them makes restoring simpler.
How often?#
| Site type | Frequency |
|---|---|
| Brochure site, rarely updated | Weekly + before any change |
| Active blog | Daily |
| WooCommerce / membership | Real-time or hourly database backups |
Backup options#
- Host backups: convenient, but they live on the same company’s infrastructure — don’t rely on them alone.
- Plugins: UpdraftPlus, BlogVault, Jetpack VaultPress Backup, Duplicator — schedule backups to Google Drive, Dropbox, S3 or similar.
- Server-level / developer: WP-CLI (
wp db export) plus rsync or restic to remote storage.
Need a hand with this?
Get a quick, honest review of your website’s SEO.
Set up a solid routine#
- Pick a plugin or service that supports off-site storage and incremental backups.
- Schedule database and files according to the table above.
- Keep at least 30 days of history — infections are often discovered weeks later.
- Store backups in a separate account from your hosting, with 2FA enabled.
- Back up manually before updates, theme changes or migrations.
- Test a restore on a staging site every few months.
Restoring a site#
- Identify the last clean backup (before the problem started).
- Restore via your plugin or host panel, or manually: upload files and import the database with phpMyAdmin or
wp db import. - If the domain changed, run a search-replace on URLs (
wp search-replace). - Clear caches, check key pages, forms and logins.
- If it was a hack, update everything and change passwords before going live.
Don’t store backups in your web folder Backup ZIPs inside
public_html can be downloaded by anyone who guesses the filename — exposing your whole database.WordPress backup FAQ#
Are host backups enough?#
They’re a useful layer, but keep an independent off-site copy you control.
How big will my backups be?#
Mostly the uploads folder. Compressed incremental backups keep storage manageable.
Can backups slow my site?#
Large backups can use server resources. Schedule them at low-traffic times or use services that back up incrementally.