Backing up WordPress means copying the site's files and database, then storing those copies away from the original server, using a dedicated plugin, your host's tool or a manual procedure.
WordPress powers 43.5% of websites worldwide according to W3Techs (2026), which makes it the favorite target of automated attacks.
NEXUS SYNERGY, a WordPress agency that runs daily backups for its clients under maintenance, explains how to protect your site and restore it without panic.
A complete WordPress backup copies both halves of your site: the files (theme, plugins, images) and the database (posts, settings, orders). It is stored away from the original server, so you can bring everything back online after a hack, a failed update or a hosting outage.
At NEXUS SYNERGY, a WordPress agency, half of our projects are redesigns or takeovers of existing sites, and the first thing we check when we arrive is whether a usable copy exists. This guide covers the backup methods, the 3-2-1 rule, the right frequency for your site and the procedure for restoring everything under real conditions.
Why is a WordPress backup so important?
A reliable WordPress backup is the only protection that still works once the firewall, the updates and the passwords have failed. It turns a total disaster into a mere interruption of a few hours, because it makes every incident reversible.
And incidents are not in short supply. WordPress powers 43.5% of websites worldwide according to W3Techs (2026), so malicious bots scan its vulnerabilities around the clock. Patchstack estimates, moreover, that more than 9 out of 10 vulnerabilities recorded in the ecosystem come from plugins, not from WordPress core. Even a perfectly maintained site remains exposed to physical hazards: the fire at OVHcloud's Strasbourg data center, in March 2021, took roughly 3.6 million sites offline overnight.
- Hacking: code injection, defacement or ransomware that encrypts your files
- Failed update: a plugin or theme conflict that leaves you with a white screen
- Human error: a deleted page, a wrong move in the database
- Hosting incident: hardware failure, fire, suspended account
Yet, on the sites we take over for maintenance, the off-site backup is missing far more often than you would imagine. The reflex usually shows up after the first crash. Better to develop it before.
What does a complete WordPress backup contain?
A complete WordPress backup always pairs the site's files with its database, because one without the other makes any restoration impossible. It is the point most tutorials skim over, even though it explains a good share of failed restorations.
The files include WordPress core, your theme, your plugins and above all the media folder. The MySQL database, for its part, holds everything else: content, user accounts, settings, and the orders if you run WooCommerce.
- wp-content: themes, plugins and uploaded media, the hardest part to rebuild
- wp-config.php: the database connection file, specific to your server
- .htaccess: the URL rewriting and security rules
- Database: posts, pages, comments, settings and transactions
WordPress core itself can be re-downloaded in thirty seconds from wordpress.org. If you have to prioritize, protect wp-content and the database: that is where everything irreplaceable lives.
Which method should you choose to back up your WordPress site?
Three approaches let you back up a WordPress site: a dedicated plugin, your host's tool and a manual copy via FTP and phpMyAdmin. A fourth option, outsourced maintenance, delegates the whole job to a provider who monitors and tests the copies.
Each has its home turf, and the following table compares them on the criteria that really matter when it is time to restore.
| Method | Cost | Automation | Restoration | Best for |
|---|---|---|---|---|
| Dedicated plugin (UpdraftPlus, WPvivid) | Free to ~$80/year | Schedulable, from hourly to monthly | A few clicks from the admin | Self-managed blogs and brochure sites |
| Host backup tool | Included or ~$5/month | Automatic, 7 to 30 days of retention | Via the panel or support, sometimes slow | Complementary safety net |
| Manual (FTP + phpMyAdmin) | Free | None | Technical, 1 to 3 hours of handling | Technical profiles, one-off needs |
| Outsourced maintenance | From $150/month | Daily, monitored and tested | Handled by the agency | E-commerce and business-critical sites |
Our reading of this comparison is fairly blunt. The plugin covers brochure sites whose content rarely changes, as long as the copies are sent to remote storage. The host's backup remains an excellent net, but a net only: its short retention and its sometimes laborious restoration disqualify it as the sole protection. As for the manual method, it mostly serves to understand what happens under the hood. As soon as the site generates revenue, outsourced WordPress maintenance becomes the rational option, because a daily backup verified by a human costs less than a single day of your store being offline.
Which WordPress backup plugin should you choose in 2026?
UpdraftPlus dominates the category with more than 3 million active installations, and that popularity is deserved: scheduling, cloud upload and built-in restoration, all in the free version. It is therefore our default recommendation for a self-managed site.
Other plugins hold up in comparison, each with a specialty. Here are the ones we come across most often on our clients' sites:
- UpdraftPlus: the versatile standard, uploads to Google Drive, Dropbox or Amazon S3 from the free version onward
- WPvivid: backup, migration and staging clones in a single tool, with a clear interface
- BackWPup: very thorough on scheduling and export formats, with more technical settings
- Duplicator: built for migration and cloning, handy for creating a test environment
In practice, which WordPress backup plugin you choose matters less than how you configure it. Three settings make the difference: a schedule aligned with your publishing rhythm, automatic upload to remote storage, and the explicit inclusion of the database and wp-content in every copy. A backup plugin installed and then forgotten gives a false sense of security, which is worse than no plugin at all.
The 3-2-1 rule: the principle that saves sites
The 3-2-1 rule requires keeping 3 copies of your data, on 2 different media, including 1 away from your server. This standard, recommended in particular by the French government's Cybermalveillance program, comes from professional photography and applies perfectly to WordPress.
Why this redundancy? Because each copy covers the failure of another. If your server burns down, the cloud copy survives. If your cloud account is compromised, the local copy remains. Concretely, for a WordPress site, it looks like this:
- Copy 1: the host's automatic backup, on its own infrastructure
- Copy 2: the plugin's archive sent to a third-party cloud, Google Drive or Amazon S3 for example
- Copy 3: an export downloaded every month to your computer or an external drive
The classic mistake is letting the plugin write its archives into a folder on the server, then stopping there. The day the server goes down or gets encrypted by ransomware, the backups disappear along with the site they were supposed to protect. Off-site, or nothing.
How often should you back up your WordPress site?
An e-commerce site gets backed up at least once a day, a brochure site once a week, and every site before every update. The right question to ask yourself: how much content, or how many orders, can I afford to lose?
That maximum acceptable loss dictates everything else. A blog that publishes two posts a month can tolerate a weekly copy. A WooCommerce store taking orders every hour cannot, and some even justify backing up the database every hour.
- Low-activity brochure site: full weekly backup
- Blog or editorial site: daily database, weekly files
- E-commerce and form-heavy sites: daily backup at minimum, hourly database if the volume justifies it
- Before every update: a full copy, systematically, whatever the site
Full or incremental? A full backup copies the entire WordPress site on every run, whereas an incremental one records only what has changed since the day before. On a large site, the latter greatly reduces server load and storage space, which is why nearly all premium plugins offer it. Our practice: one full backup per week, daily incrementals in between.
Think about retention too. Keeping 30 days of rolling copies, plus a monthly archive over 6 to 12 months, lets you roll back to before a hack discovered late. That is the rhythm we apply at NEXUS SYNERGY in our maintenance plans, with daily backups included from $150/month.
How do you restore a WordPress backup?
Restoring a WordPress backup always follows the same logic: put the files back in place, reimport the database, then check that the two reconnect. The difficulty, however, varies enormously depending on the method used to create the copy.
With a plugin like UpdraftPlus, the operation comes down to a "Restore" button in the admin, selecting the elements to put back. With a host, everything goes through the panel, cPanel or equivalent, sometimes with a support ticket and a delay of a few hours. Manual restoration, for its part, demands method:
- Step 1: upload the site files via FTP or SFTP, overwriting the corrupted ones
- Step 2: import the database's SQL file via phpMyAdmin, after emptying the existing tables
- Step 3: check the connection credentials in wp-config.php
- Step 4: test the key pages, the admin login and the checkout funnel
A piece of advice few guides give: test a full restoration at least once a year, on a staging environment, stopwatch in hand. You will discover your true time-to-recovery on a calm day, rather than on a Sunday night in crisis mode.
What mistakes make your backups unusable?
A backup that has never been restored under real conditions is not a backup, it is a hypothesis. Most of the disasters we see do not come from a total absence of copies, but from a copy that turns out to be unusable at the critical moment.
During the WordPress redesigns we carry out, the audit of the existing site almost always reveals one of these traps:
- Everything on the same server: the archives live next to the site and die with it
- Never tested: the archive exists, but it has been corrupted or incomplete for months
- Database without files: the SQL export is there, the media and the theme are gone
- A single overwritten copy: impossible to roll back to before a hack detected three weeks later
- Badly configured exclusions: the uploads folder left out to "lighten" the archives
- Blind trust in the host: nobody read the contract's actual retention, often 7 days
The good news is that each point can be fixed in under an hour. The highest-payoff fix remains the restoration test: it exposes all the other problems at once, because an incomplete or badly stored archive fails the exercise immediately.
Frequently asked questions about WordPress backups
How do you back up a WordPress site for free?
Yes, it is possible without spending a dollar: the free version of UpdraftPlus schedules full backups and sends them to Google Drive or Dropbox. Install the plugin, connect a remote storage account, then set a frequency suited to your publishing rhythm. Complete the setup with a monthly manual export downloaded to your computer to respect the 3-2-1 rule. That said, the limits of free show up on large sites: no incremental backups, no priority restoration, and nobody checking that the archives are healthy. For a blog or a brochure site, it is more than enough. For a site that generates revenue, the time spent and the residual risk quickly justify a supervised solution.
Is my host's automatic backup enough?
No, it is not enough as your only protection. Your archives and your site then live with the same provider, on the same infrastructure: a major outage, a suspended account or a fire takes both down at once. Retention is a problem too, since most shared hosting plans keep 7 to 30 days of copies, which is short when a hack is discovered weeks after the intrusion. Finally, restoration depends on the panel or on support, with delays you do not control. Keep the host backup as a complementary net, and add at least one independent copy sent to a third-party cloud.
Where should you store WordPress backups safely?
Away from the server hosting the site; that is the one non-negotiable rule. The most reliable destinations are cloud storage services, Google Drive, Dropbox or Amazon S3, fed automatically by your backup plugin. Add a cold copy, meaning an export downloaded to an external drive or a NAS, disconnected from the network between backups: ransomware cannot encrypt an unplugged drive. Protect the cloud account with a unique password and two-factor authentication, because a WordPress archive contains sensitive data, including the database credentials. The combination of server, cloud and local copy satisfies the 3-2-1 rule with no special effort.
How long should you keep your backups?
Thirty days of rolling copies is the serious minimum, completed by a monthly archive kept for 6 to 12 months. That depth of history is not a luxury: many hacks settle in quietly and are only discovered weeks later, when Google flags the site or a customer reports something odd. If your retention is limited to 7 days, all your copies already contain the malicious code by the time you detect it. Then adapt the duration to your business: an e-commerce site subject to accounting obligations will benefit from keeping database exports longer, while a brochure site can stick to this standard scheme.
Should you back up WordPress before every update?
Yes, systematically, without exception. An update to WordPress, a theme or a plugin can trigger a conflict that breaks the display or locks you out of the admin, and it is the number one cause of restorations we observe at NEXUS SYNERGY. The copy takes five minutes with a plugin; the debugging night without a copy takes far longer. The right routine: full backup, plugin updates one by one, key pages checked between each, then the core update. On the sites we manage under maintenance, every update is preceded by a fresh backup and followed by a check, which makes the operation reversible in a few minutes.
How much does an outsourced WordPress backup cost?
At NEXUS SYNERGY, daily backups are included in WordPress maintenance plans from $150/month, along with updates, monitoring, security patches and support. That budget covers far more than the copy itself: someone verifies that the archives are healthy, tests the restorations and steps in immediately when an incident occurs. By comparison, self-managed solutions cost $0 to about $80/year for a premium plugin, plus your own monitoring time. The math works out quickly for a store: a single day of downtime often costs more than a full year of maintenance. For a small blog, a well-configured free plugin remains a reasonable choice.
Your site deserves better than a backup that is "probably fine somewhere at the host". Put the 3-2-1 rule in place this week, test a restoration, and if you would rather hand the whole thing to a team that does it every day, contact NEXUS SYNERGY: the first technical audit of your site is free, and we reply within one business day.
