WordPress backups explained: what to back up, how often and where

What a WordPress backup must contain

A WordPress site is made of two parts, and a backup needs both:

• The database. Your pages, posts, settings, users, form entries, menus and most of what you edit in the dashboard. For a shop, it also holds orders and customers.
• The files. WordPress itself, your theme, your plugins, the wp-config.php file and the uploads folder with your images and documents.

A database-only backup brings back your words but not your images or plugins. A files-only backup brings back the design but not the content. If you are unsure what your current backup includes, assume it is incomplete until you have checked.

The uploads folder is usually the largest part, and some backup tools exclude it by default to save space. Check the settings.

How often to back up

The right frequency depends on how much you would lose between backups. Ask: if the site broke right now and I restored last night's copy, what would be missing?

• Brochure site that rarely changes: weekly is often enough, plus a manual backup before any change.
• Site with a blog or regular updates: daily.
• Site that takes enquiries, bookings or orders: daily at minimum, and consider more frequent database backups, because new orders and form entries arrive all the time.

Whatever the schedule, always take a fresh backup before updating WordPress, a theme or a plugin, before installing something new and before editing code. This one habit prevents most backup regrets.

How long to keep backups

Keeping only the most recent backup is risky. Problems are not always noticed straight away: a hack can sit unnoticed for weeks, and a plugin can quietly break a page nobody visits often. If your only backup was taken after the problem started, it contains the problem.

A sensible approach is to keep a run of recent daily backups plus a few older weekly or monthly ones, so you can go back further if you need to. Check how long your host keeps backups, because that sets the limit on how far back you can go.

Where backups should be stored

A backup stored on the same server as the website protects you against a bad update, but not against the server failing, the account being suspended or an attacker deleting files. A widely used principle is to keep several copies, on more than one type of storage, with at least one away from the main server.

In practice, for a small business site:

1. Rely on your host's backups for quick restores.
2. Keep a second copy somewhere else, such as cloud storage you control, using a backup plugin or a periodic manual download.
3. Protect that off-site storage with a strong password and two-factor authentication, because a backup contains everything about your site, including user details.

There are three common ways to take backups, and most sites use more than one:

• Host backups. Taken automatically at server level. Convenient and usually fast to restore, but stored by the same company that runs your server, and sometimes only restorable on request.
• Backup plugins. Run inside WordPress on a schedule you set and can send copies to cloud storage. Flexible, but they rely on WordPress working and on the plugin being kept up to date.
• Manual exports. Downloading the files and a database export yourself, for example before a big change. Useful as an extra copy, but easy to forget, so do not rely on it alone.

Whichever you use, write down where each copy lives and who has the login. A backup nobody can find during an emergency is as good as no backup.

If your site holds personal data, such as enquiries or customer accounts, your backups hold it too. The ICO's guidance at ico.org.uk covers security of personal data, and our guide to UK GDPR and WordPress explains what it means for a typical site.

Testing a restore

An untested backup is a hope, not a plan. Test a restore at least occasionally, and whenever you change your backup method. The safest place to do it is a copy of the site, not the live one.

1. Create a staging site or a temporary test install. Our guide to WordPress staging sites shows how.
2. Restore your most recent backup onto it.
3. Log in and check the dashboard loads.
4. Open the home page and several inner pages, and check images appear.
5. Check that recent content, such as your latest post or most recent form entries, is present.
6. Submit a test form and, for a shop, look at a recent order.
7. Write down how long the restore took and any steps that were not obvious.

That last step matters. When a real problem happens you will be under pressure, and short written instructions save time and mistakes.

Common backup mistakes

• Assuming the host does it. Some do, some do not, and some only keep backups for their own disaster recovery. Ask whether you can restore them yourself.
• Backups that silently stopped. Plugins can fail after an update or when storage fills up. Check the date of the latest backup each month.
• Only one copy. If it is on the same server, it is not enough on its own.
• Restoring over a hacked site without fixing the cause. The attacker comes straight back. See what to do if your WordPress site is hacked.
• Never testing. Corrupt or incomplete backups are usually discovered at the worst possible moment.

Backups on our plans

Every WP Web Hosting plan includes regular backups, from WP Start upwards. Even so, we recommend keeping your own occasional off-site copy as well, because no single backup should be your only safety net.

Frequently asked