Every failure described on this blog ends with the same conclusion - whoever had a tested backup was back within the hour, whoever did not was counting losses. A failed update, a break-in, a dead server: different scenarios, identical ending. A backup is not a task for “someday”. It is the difference between a coffee break and rebuilding the site from zero.
The good news: a decent backup system is set up once and then runs on its own. I will show you how to put it together - and how to check whether it will genuinely save you on the day it all goes wrong.
A file backup is only half of it - the other half is the database
WordPress keeps your site in two places. The files on the server are the engine, the theme, the plugins and the images you uploaded. The database is everything else: posts, pages, products, orders, customer accounts, settings. A copy of the files without the database is a hollow shell of a site - it looks the part but remembers nothing. A copy of the database without the files is memory with no body.
A full WordPress backup always contains BOTH. When you evaluate any solution - host-provided, plugin-based or manual - the first question is: does it take the files and the database? If you do not know, assume it does not, and go and check.
Does your host make backups
Most hosts do - and it is good that they do, but do not build your whole safety net on it. Three traps I see regularly:
- Retention - hosts keep copies for a limited window, often somewhere around 7-30 days. If you discover a break-in or a silent bug later than that, the clean copy no longer exists
- All-or-nothing restores - some panels can only restore the entire account at once, not a single site or the database alone; you then lose everything that changed since the backup date
- One basket - the copy sits on the same server or in the same data centre as the site; a hosting failure takes both at once
A host backup is a good last resort. It cannot be the only one.
What helps: write to your host’s support with two questions - how long do you keep backups, and can I restore just the database without overwriting the files. It will take them a moment to answer, and you will find out where you actually stand BEFORE anything is on fire.
A backup plugin - schedule and off-server storage
The second layer is a backup plugin inside WordPress itself. I will not name a specific one, because the market shifts - what matters more is what to demand from it. Popular backup plugins have free versions that are perfectly enough to start with, and configuring a schedule takes a few minutes.
Two things are non-negotiable:
- A schedule - the backup has to run by itself, on a cycle, with no input from you; a backup you have to remember is a backup that will not happen
- Off-server storage - the plugin has to send the copy to external cloud storage, not park it next to the site; a copy on the same server disappears along with the site in a serious failure or a break-in
A manual copy before every change
The third layer is the simplest and the most often skipped: a manual backup immediately before every significant change - a plugin update, a theme switch, poking around in the store settings. The schedule takes a copy overnight, and you break the site at midday - without a copy from just before the change you go back a full day, and in a store that means lost orders.
That habit is part of a wider ritual I wrote out in the safe update checklist: backup before, update, test after.
The 3-2-1 rule in plain language
Technical people talk about the 3-2-1 rule: three copies of the data, on two different media, one of them off-site. It sounds corporate, but for an ordinary website it boils down to a simple set: the host’s copy, a plugin copy in the cloud, and now and then a copy pulled down onto your own computer. Three places, different technologies, at least one well away from the server - so that no single disaster can take all of them at once.
How to restore a site from a backup - and why you have to rehearse it
Here is the heart of it: a backup you have never tried to restore is not a backup, it is a hope. I have seen backups made diligently for months that on the day of the failure turned out to be empty, cut off halfway, or missing the database entirely. You find out at the worst possible moment.
So every so often, run a restore test. Not on the live site - restore the copy onto a test subdomain or locally on your computer. Check three things: does the site open, can you log into the admin panel, and are the latest content and orders there. If that passes, you have a real backup. And along the way you learn the restore procedure calmly, rather than at midnight in a panic.
When there is no backup and the site is down
If you are reading this too late and your site is down right now, not everything is lost. If you see a failure message, work through the critical error step by step - the data is usually intact, you just have to unplug the culprit. If you see signs of a break-in, follow the recovery plan for a hacked site. And once the site is back up, come back here and set the backups up, so that next time it is hours, not days.
You can also take it off your plate entirely: with ongoing site care the backups run by themselves, off-server, with a regular restore test - and when something breaks, I am the one restoring the site, not you.
FAQ
How often should I back up WordPress? As often as the site changes. A store with daily orders - daily; a brochure site updated once in a blue moon - less often, plus always a manual copy before every change.
Does my host back up for me? Most do, but with limited retention - often somewhere around 7-30 days - and sometimes only restoring the entire account at once. Treat it as an emergency reserve, not your only protection.
Which WordPress backup plugin is best? The one that copies files and the database on a schedule and sends them off the server. Popular backup plugins have free versions that handle that comfortably.
How do I restore a site from a backup? Through the hosting panel, through the backup plugin, or manually: you upload the files and import the database. The key is to rehearse it once on a test version, before you have to do it under pressure.
Not sure whether your current backups work at all? Send me a link to the site - I will check how it is protected and tell you what I would improve.
Would rather not watch over it every month yourself? I take sites and stores under ongoing care - backups, updates, monitoring, and priority when something breaks. Tell me what you run and I will send back scope and price.