WordPress backups that actually work when you need them

Almost every site owner I talk to says they have backups. Far fewer have tried restoring one. The difference only shows up on the worst day: the site is hacked or an update breaks the checkout, and the backup turns out to be a week old, stored on the same server, or missing the database.

Here's how I set up backups so they work when they're needed.

Back up both halves

A WordPress site is two things, and you need both:

• The files: WordPress itself, themes, plugins, wp-config.php and, most importantly, wp-content/uploads, where every image and document lives
• The database: posts, pages, settings, users, and on a shop, every order and customer

A backup of only one half is close to useless. Files without the database give you an empty site; a database without the uploads gives you pages full of broken images.

Match the schedule to how often things change

• A brochure site that changes a few times a month is fine with a daily backup.
• A busy blog may need backups after every publishing day.
• A WooCommerce shop takes orders around the clock. A daily backup means a restore can lose up to a day of orders, so shops need the database backed up much more often, ideally in near real time.

Always take an extra backup right before updates, plugin installs and design changes. Most problems happen straight after one of those.

Keep copies somewhere else

A backup stored on the same server as the site disappears with it. If the server fails, the account is suspended or an attacker deletes files, those backups go too.

I keep copies in at least two places, with one of them off the server entirely: cloud storage like Amazon S3, Backblaze B2 or Google Drive, or the host's separate backup system plus an off-site copy. The common rule of thumb is 3-2-1: three copies, on two kinds of storage, with one off-site.

Keep enough history

Hacks are often discovered weeks after they happen. If you only keep the last seven daily backups, every one of them may already contain the infection. Keep at least 30 days, and a few monthly copies on top for older restore points.

Don't leave backups where anyone can download them

Some backup plugins save zip files inside wp-content, which is publicly reachable. A backup contains wp-config.php, with your database password in it. Store backups outside the web root or off the server, and delete old zips that plugins left behind.

Test the restore

A backup you've never restored is a guess. A few times a year, restore the latest backup to a staging copy of the site and check that:

• pages, images and menus all load
• you can log in
• forms send and, on a shop, orders and products are there

Time how long it takes, too. Knowing a restore takes 20 minutes is very reassuring when the real thing happens.

When a backup isn't the answer

Restoring after a hack is tempting, but it usually puts back the same vulnerability that let the attacker in, and sometimes the backup already holds their backdoor. A backup is your safety net during a cleanup, not a replacement for one. Here's how I clean a hacked WordPress site.

Backups and test restores are part of every care plan. If you're not sure yours would work, ask me to check.