A WordPress Backup Strategy That Actually Works

Everyone agrees WordPress sites need backups, and surprisingly few have a plan that would survive a real disaster. A backup that sits on the same server as the site, that nobody has tested and that stops working after a plugin update gives a false sense of safety. Here is how to build one that actually works.

What needs to be backed up

A WordPress site has two parts, and you need both:

• Files: WordPress core, themes, plugins and the wp-content/uploads folder with your media, plus wp-config.php.
• Database: all posts, pages, settings, users, orders and comments.

If you also host email on the same account, remember mailboxes are separate from the site and need their own backup plan.

The 3-2-1 idea

A widely used rule of thumb is to keep three copies of your data, on two different types of storage, with one copy kept off-site. For a WordPress site that might mean the live site, a backup on the server for fast restores and a second copy in remote storage that an attacker or a server failure cannot reach. The key point is that at least one copy lives somewhere else.

Frequency and retention

Ask how much work you could afford to lose. For a brochure site that changes monthly, a daily or weekly backup may be fine. For a shop taking orders or a site with active comments, you may want several backups a day, or at least a database backup much more often than files. Match the frequency to the rate of change.

Site type	Suggested rhythm
Static brochure site	Weekly, plus before any change
Blog or news site	Daily database, weekly files
Online shop	Database several times a day, daily files

These are starting points, not rules. Adjust to your own tolerance for lost data.

How long to keep copies

Malware or a bad update sometimes goes unnoticed for days. If you only keep yesterday's backup, you may only have an infected one. Keep a rolling set, for example daily copies for a couple of weeks and a few older monthly ones, balanced against your storage space.

Methods and storage

Plugin-based backups

Backup plugins are flexible and can send copies to remote storage. They run inside WordPress, so on a very large site they may hit time or memory limits.

Control panel backups

Hosting control panels such as Plesk offer backup tools that capture the site and database together from outside WordPress. Check what your plan offers and how restores work.

Manual exports

For small sites, downloading the files and exporting the database before big changes is a reasonable extra step. It should not be your only protection.

Where to store them

Store at least one copy away from your web hosting account, in a different service and under different credentials. Encrypt backups that contain customer data, and restrict who can access them. Never leave backup archives in a publicly accessible folder on your website.

Testing and recovery

This is the step most people skip. Once, and then at regular intervals, restore a backup to a staging site or a spare location and check that:

1. The site loads and images appear.
2. You can log in.
3. Forms and, for shops, the checkout work.
4. The database content is recent enough.

Time the process. Knowing it takes forty minutes is far better than discovering it under pressure.

Back up before risky changes

Take a fresh backup before core updates, major plugin updates, theme changes and migrations. It is cheap insurance, and it gives you a precise point to return to.

Common backup mistakes

• Keeping backups only on the same server as the site.
• Backing up files but not the database, or the reverse.
• Never checking whether scheduled jobs are still running.
• Ignoring email notices from the backup tool that something failed.
• Forgetting that a shop's orders change between backups.

Write a one-page recovery plan

List where backups live, how to get access to them, who can restore and what the steps are. Include your hosting login location and your domain registrar details. If the person who knows the plan is unavailable, someone else should be able to follow it.

Backing up shops and membership sites

Sites where visitors create data need extra care. If you restore a day-old backup to a shop, orders placed since then disappear from WordPress, even though customers have already paid. For these sites, take frequent database backups, keep payment provider records as a second source of truth and decide in advance how you would reconcile orders after a restore.

Finally, remember that a backup strategy covers people as well as software. Make sure at least two trusted people know where backups are stored and how to start a restore, and that the credentials for backup storage are kept in a password manager rather than in someone's memory.

Backups and your hosting plan

A host's own backups are a useful safety net but should not be your only copy. With WordPress hosting from Zebra Hosting you get Plesk to manage your site and databases, and you can keep your own off-site copies on top. If you are not sure what you need, ask in the knowledgebase or contact support.