A WordPress backup is a recoverable copy of relevant files and data. For a full site recovery you normally need the database, content files and configuration, plus any separately managed dependencies. A local copy is still a backup, but an independent off-site copy protects against more failure modes. Test restoring it rather than relying only on a successful-job message.
The short answer
Automate it: daily for a busy site, more often for a store, plus an extra backup before every update. Keep one copy your host does not control, and restore to a staging site every quarter to prove it works. For most small business sites, the host’s backups plus an independent plugin such as UpdraftPlus, WPvivid or BackWPup covers it. For online stores, set the database backup frequency by how many orders you could afford to lose, and plan how you would recover orders taken after the last backup.
When my team takes over a website, we ask when the last backup was restored, not when it was taken. Too often nobody knows, and the backups turn out to be incomplete, stored on the same server, or years old. That is the gap this guide is about.
Why do you need to back up a WordPress website?
Backups support recovery from failed updates, compromise, hosting problems or accidental changes. Patchstack recorded 11,334 new WordPress vulnerability disclosures in 2025,91% in plugins. A clean recovery point can help, but the right response depends on the fault, the data changed since then and what must be repaired before reopening.
The numbers come from Patchstack’s State of WordPress Security in 2026, which also found that 46% of vulnerabilities had no developer fix by the time they were disclosed. Backups do not prevent attacks, but they limit the damage.
What should a WordPress backup include?
A complete WordPress backup includes the database, which holds your pages, posts, settings and users, and the files: the wp-content folder with themes, plugins and uploads, plus key configuration such as wp-config.php. A database-only or files-only backup will not restore a working site. For stores, orders and customers live in the database, so frequency matters.
| Backup type | What it covers | Best for |
|---|---|---|
| Full backup | All files and the database | A complete restore point, weekly or daily |
| Database backup | Content, settings, users, orders | Frequent backups of changing data |
| Incremental backup | Only what changed since the last backup | Large sites, saving storage and time |
| Real-time backup | Frequent or event-driven changes captured within the provider’s stated recovery limits | Online stores and busy membership sites |
| Off-site backup | Copies stored away from the web server | Surviving server failure or a hack |
Caption: WordPress backup types and when to use them.
What are the best WordPress backup plugins?
Compare actual backup and restore features, not installation count alone. Current directory pages describe free scheduled/cloud options for UpdraftPlus, WPvivid and BackWPup. Duplicator’s current free listing includes local and Duplicator Cloud storage, while scheduling and wider destinations are listed for Pro. All-in-One’s free import and paid restore/automation features differ. Check storage charges, size limits, encryption, retention and the restore path for the version and plan you will use.
| Plugin | Active installs | Last updated | Tested up to | Good for |
|---|---|---|---|---|
| All-in-One WP Migration and Backup | 5,000,000+ | October 2026 | WordPress 7.1 | Migrations and simple full backups |
| UpdraftPlus | 3,000,000+ | October 2026 | WordPress 7.1 | Scheduled backups to cloud storage |
| Duplicator | 1,000,000+ | October 2026 | WordPress 7.1 | Migrations and site packages |
| WPvivid | 900,000+ | September 2026 | WordPress 7.1 | Backups with staging |
| BackWPup | 400,000+ | October 2026 | WordPress 7.1 | Flexible scheduled jobs |
| BlogVault | 80,000+ | September 2026 | WordPress 7.1 | Real-time backups and staging |
| Jetpack VaultPress Backup | 20,000+ | August 2026 | WordPress 7.0 | Real-time backups for stores |
WordPress.org plugin API/listings checked 26 October 2026. Installation buckets and “tested up to” versions are publisher/directory metadata, not a compatibility or recovery test. The current API lists the first six plugins as tested up to 7.1.3 and Jetpack Backup to 7.0.7. Features, paid tiers and storage limits can change.
Are your hosting company’s backups enough?
Usually not on their own. Host backups are a good first layer, but they are often stored in the same company’s infrastructure, kept for a limited time, and restored only on request. If the host has an outage, suspends the account or the backups are compromised, you need an independent copy. Keep at least one backup the host does not control.
Independent recovery matters when an outage affects the host. In a B2B supplier case, the host’s data centre lost power with no restoration estimate while paid search sent visitors to product pages. My team used a backup on temporary hosting while the outage was addressed. That approved experience supports testing an independent recovery route; it does not mean a local copy is not a backup.
The 3-2-1 principle means three copies, two storage types and one off-site. Do not assume three folders or cloud accounts meet it. Map which copies share a provider, account, region, credentials or deletion risk, then choose independent storage and retention that fit the recovery requirement. Restrict access and protect encryption/recovery keys because a backup can contain customer data and secrets.
My guide to the best WordPress hosting in Australia covers which managed hosts include daily backups.
How often should you back up WordPress?
Back up as often as your site changes. A brochure site that changes monthly may be fine with weekly full backups. A blog with daily posts needs daily backups. An online store should start from a different question: how many hours of orders could you lose and re-enter by hand? Set the database backup frequency to that answer, which for a busy store usually means hourly or real-time. Even real-time backups do not promise zero lost orders: if you restore to a point before a problem started, every order placed after that point is gone from the site, so check orders against your payment gateway afterwards. Always take an extra backup before updates, migrations or major changes. My guide to WooCommerce performance and uptime covers the rest of the store routine.
| Site type | Full backup | Database backup | Before changes |
|---|---|---|---|
| Brochure site | Weekly | Weekly | Always |
| Blog or content site | Daily | Daily | Always |
| Lead generation site | Daily | Daily | Always |
| Online store or membership | Daily | Real-time or hourly | Always |
Caption: Suggested backup frequency by site type. My recommendation, adjust to how often your site changes.
How do you restore a WordPress backup?
Start by establishing the last known good recovery point and what changed afterward. Test a compatible files/database restore in isolation. Before a live restore, preserve fresh orders, accounts and payments, agree the data-loss window and obtain restore authority. A targeted rollback may be safer; a full point-in-time restore needs transaction reconciliation. After a hack, contain access and clean/patch the restored copy before reopening it.
- Choose a restore point from before the problem started.
- Restore to staging first if you can, and check it works.
- Choose a compatible targeted rollback or authorised full restore; preserve and reconcile new transactions rather than blindly replacing the live database.
- Clear appropriate caches and test pages, forms, login and checkout. Reconcile orders, gateway payments, inventory and subscriptions since the recovery point.
- After a hack, preserve evidence, revoke compromised access, clean and patch the isolated restore, then rotate credentials and verify before public release. My security checklist covers the sequence.
Should you back up before letting AI agents change your site?
Yes. If you let AI tools or agents edit your WordPress site, through the MCP Adapter, a plugin or a coding agent, take a backup first and make sure every change can be rolled back. Agents work fast, which means mistakes can spread fast. Start agents with read-only access and add write access one action at a time.
A backup is not a permission boundary. Some current backup products now expose MCP management, including BackWPup 5.7. If you connect one, explicitly limit who can list, create, download, restore or delete backups; protect customer data and credentials, log actions and require appropriate approval. Test the server-enforced permissions, not just a prompt telling the agent to be careful.
The same discipline applies to every change. Whoever makes it, human or agent, the question is the same: if this goes wrong, which restore point do we go back to, and what data would we lose?
What to do next
- Check when your last full backup was taken and where it is stored.
- Make sure at least one copy is off the web server and outside your host’s control.
- Restore your latest backup to a staging site and confirm it works.
- Set backup frequency to match how often your site changes.
- If nobody owns backups on your site, see my guide to WordPress management, or book a free call with my team.
Frequently asked questions
What is the best free WordPress backup plugin?
For free scheduling and supported cloud destinations, assess UpdraftPlus, WPvivid or BackWPup against the exact job. Duplicator’s current free listing also offers Duplicator Cloud, with scheduling and other destinations in Pro; separate storage or service costs may apply. Pick an option you can configure, monitor and restore, rather than assume “free” includes every recovery feature.
Where should I store WordPress backups?
Store backups off the web server, in cloud storage such as Google Drive, Dropbox, Amazon S3 or your backup provider’s storage. Keep at least one copy your hosting company does not control. Never rely only on backups stored on the same server as the website.
How long should I keep WordPress backups?
Keep several versions, typically at least 30 days of daily backups, plus older weekly or monthly copies. Problems such as hacks are sometimes discovered weeks later, and you need a clean restore point from before the problem started.
Do WordPress backups slow down my site?
Large backups can use server resources while they run. Schedule them for quiet hours, use incremental backups for large sites, and choose a host with enough resources. Managed hosts and services that back up from outside the server reduce the impact further.
Can I back up WordPress manually?
Yes. Download the site files over SFTP or your host’s file manager and export the database through phpMyAdmin or your host’s tools. Manual backups are useful as an extra copy, but automatic, scheduled backups are far more reliable for a business site.
