A WordPress Backup Strategy That Actually Works

Why backups fail when you need them

Backups usually fail quietly. These are the causes behind most disasters.

• The backup job stopped months ago and nobody noticed.
• The only copy lives on the same server that was hacked or crashed.
• The backup is incomplete: it has the files but not the database, or the other way around.
• It was never tested, and the restore turns out not to work.
• It is too old to be useful, because the last good copy predates months of orders or posts.

What to back up

A complete WordPress backup has two halves: the database, which holds posts, pages, settings and users, and the files, which hold your plugins, themes, uploads and configuration.

• The full database, including custom tables created by plugins.
• Everything in wp-content: uploads, plugins, themes and must-use plugins.
• The wp-config.php file, kept somewhere safe because it contains secrets.
• Server files outside WordPress that your site depends on, such as custom rewrite rules.

The 3-2-1 rule

A simple rule that has saved many sites: keep 3 copies of your data, on 2 different kinds of storage, with 1 copy off site. A backup in the same hosting account does not count as off site, because a hack, a billing problem or a failed server can take both away.

Many hosts take their own backups. They are a useful extra layer, but treat them as a bonus, not your plan. You cannot always download them, and you do not control how long they are kept.

How often to back up

Decide how much work you can afford to lose. That is your recovery point. A brochure site that changes monthly needs a weekly copy. A shop taking orders needs the database backed up many times a day.

• Brochure or portfolio site: weekly, and before every change.
• Blog or news site: daily database, weekly files.
• Shop, membership or booking site: database at least daily, ideally more often, plus files weekly.
• Before any update, migration or major change: always, no matter the schedule.

Set up your WordPress backup strategy

The tool matters less than whether the plan is written down and checked.

1. 1Write down your recovery point (how much data you can lose) and your recovery time (how long you can be down).
2. 2Choose a tool that backs up both the database and the files, and shows you when the last backup succeeded.
3. 3Set the schedule that matches your recovery point.
4. 4Send copies off site, to storage that your web server account cannot delete.
5. 5Decide how long to keep copies. Keep several generations, not only the latest.
6. 6Make someone responsible for checking the backup status every week.
7. 7Write down how to restore, in plain steps, and keep the document somewhere other than the site.

Test your restore

A backup you have never restored is a hope, not a backup. Restore a copy to a staging site or a spare database at least a few times a year, and every time you change hosts.

Check that the pages load, that you can sign in, that images appear and that forms and checkout work. Time how long it takes, so you know your real recovery time.

# Export the database (store the file off the server, not in the web folder)
wp db export backup-$(date +%F).sql

# Check the export is a real SQL file, not an error message
head -n 20 backup-*.sql

Keep backups safe

A backup holds your whole database, including user details, so it is as sensitive as the live site.

• Never store backups in a public folder where anyone can download them by guessing the address.
• Use storage with its own login, and turn on two-factor sign-in for it.
• Encrypt copies that leave your control, if they contain personal data.
• Limit who can download or delete backups, and get notified when one is downloaded.
• Delete old copies you no longer need, especially those with customer data.

Before updates and big changes

Take a fresh backup before you update core, switch themes, install plugins or run a migration. If something breaks, restoring is faster than debugging. Prefer a restore process that checks the backup before it replaces anything, and lets you undo the restore if the result is worse.