Backups are the boring part of running a blog until you need one. Then they become the most important thing in the world. A site without working backups is one bad update, one hacked plugin, or one host failure away from being gone entirely. This post is the practical setup for making sure that never happens to you.

A backup dashboard showing daily backup history, storage destinations, and restore options

What to back up

A complete WordPress backup includes several distinct pieces:

  • Database: all posts, pages, comments, users, settings, and metadata.
  • wp-content folder: uploads (images, videos), themes, and plugins.
  • WordPress core files: the WordPress software itself.
  • Configuration: wp-config.php and .htaccess.

Most backup tools handle all of this automatically, so you rarely need to think about it piece by piece.

Frequency

Match your backup frequency to your publishing and activity cadence:

  • Daily: for active blogs, meaning posts published weekly or more, with frequent comments.
  • Weekly: the realistic minimum for any blog.
  • Real-time or hourly: for e-commerce or membership sites, where every order matters and can’t be recreated.

Ask yourself: if you lose a day’s data, can you reconstruct it? If yes, weekly backups might be fine. If no, go daily.

The 3-2-1 backup rule

This is standard data protection guidance, endorsed by CISA as a baseline for protecting any kind of business data, blogs included:

  • 3 copies of your data: the original plus two backups.
  • 2 different storage types, for example your host plus cloud storage.
  • 1 off-site copy, meaning not on the same server as your blog.

The off-site copy matters because if your host has a catastrophic failure, any backups stored only on that host die along with the site.

Backup destinations

Cloud storage

  • Google Drive: free 15GB, simple to set up.
  • Dropbox: free 2GB, with paid tiers that scale up.
  • Amazon S3: around $0.023/GB/month, the cheapest option at scale.
  • Backblaze B2: S3-compatible, with cheaper egress fees.
  • Wasabi: another cheaper S3 alternative.
  • OneDrive: convenient if you’re already tied to Microsoft 365.

Plugin-provider storage

UpdraftPlus Vault, BlogVault, and similar tools offer dedicated backup storage as part of their paid plans, so you don’t have to configure a separate cloud destination.

Host backups

Managed hosts like WP Engine, Kinsta, and SiteGround include automated backups as part of the plan.

One concern worth flagging: these backups live on the host’s own infrastructure. If the host suffers a catastrophic failure, its backups may fail right along with everything else. Treat host backups as supplemental, not as your only line of defense.

Backup plugins

UpdraftPlus

  • The most popular free WordPress backup plugin, with over 3 million active installs.
  • Scheduling, multiple destinations, and restore capabilities built in.
  • Free tier covers scheduling and the main storage destinations.
  • Premium tier (roughly $70 for the first year) adds incremental backups, multisite support, and multiple simultaneous destinations.

BackWPup

  • A solid free option with good scheduling controls.
  • Supports S3, Dropbox, and Google Drive as destinations.

Duplicator

  • Focused on manual full-site snapshots.
  • Useful for migrations as well as backups.
  • Offers both free and Pro tiers.

BlogVault

  • A premium SaaS backup service, starting around $89+/year.
  • Incremental backups that are faster and smaller.
  • One-click restore.
  • Staging site integration built in.

WP Time Capsule

  • Incremental, near real-time backups.
  • Restore individual files or the full site as needed.

Jetpack VaultPress Backup

  • Built by Automattic, the company behind WordPress.com.
  • Real-time backups suited to high-activity sites.
  • Starts around $4.95/month for 10GB of storage.

Retention strategy

How long you keep old backups matters as much as how often you make them:

  • Daily backups: keep 14 to 30 days.
  • Weekly backups: keep 8 to 12 weeks.
  • Monthly archives: keep 6 to 12 months.

Some problems, like hacks or data corruption, aren’t noticed for weeks. You need a backup from before the issue started, which is exactly why longer retention windows matter.

Tip: Set a recurring calendar reminder to actually open your backup plugin’s log once a month, not just to trust the email notifications. Notification emails get missed or filtered more often than people expect, and a silently failing backup is worse than no backup plugin at all, because you think you’re covered when you’re not.

Testing restores

An untested backup isn’t really a backup. It’s a hope.

Once or twice a year, run through this process:

  1. Download a backup.
  2. Restore it to a staging environment or a local install.
  3. Verify that everything actually works.

You’ll find issues, like incomplete backups, missing tables, or broken paths, before you ever need the backup for real. That’s the entire point of testing it now instead of during an emergency.

A restore wizard showing options to restore database, files, themes, plugins, or a complete site

Common backup failures

  • Backup ran but didn’t transfer to its destination: the network failed mid-upload.
  • Backup ran but the file is corrupted: it happens occasionally, for reasons that aren’t always obvious.
  • Backup is incomplete: some tables or files got excluded because of a timeout.
  • Backup destination ran out of storage: old backups weren’t cleaned up, so new ones failed silently.
  • Plugin stopped working: a license expired, or the plugin got deactivated by accident.

Verify weekly that backups actually completed successfully. Most plugins will email you status reports if you have notifications turned on.

Database vs file backups

Some sites benefit from splitting up their schedule:

  • Database: changes constantly, with every comment, post, and setting. Back it up daily.
  • Files (uploads, themes, plugins): change less often. Weekly backups are usually enough.

Split scheduling like this saves storage and bandwidth on larger sites.

Incremental vs full backups

A full backup makes a complete copy every single time.

An incremental backup captures only the changes made since the last backup.

Incremental backups are faster, use less storage, and put less load on your server. The tradeoff is that restoring may require applying several incremental backups in sequence rather than just one file.

Most modern backup plugins support incremental backups by default now.

Disaster scenarios

1. Bad plugin update breaks the site

The fix is to restore from a backup taken before the update ran.

Often, it’s simpler to just deactivate the plugin via SFTP than to run a full restore.

2. Site hacked, files modified

  • Identify when the compromise happened using your security plugin’s scan history.
  • Restore from a backup taken before the compromise occurred.
  • Update everything, change all passwords, and audit every user account on the site.

3. Host goes down or disappears

  • Migrate your backup to a new host.
  • Update DNS to point to the new host.
  • Restore the site from your backup.

This is exactly the scenario where off-site backups matter most, since anything stored only with the old host is gone.

4. Database corruption

  • Restore the database from a backup.
  • Sometimes only specific tables need restoring. Many backup plugins allow this level of granularity.

5. Accidentally deleted important content

  • Restore single posts or pages from a backup if your plugin supports granular restores.
  • Or restore the database only, leaving the rest of the files untouched.

How to restore

Plugin-based restore

Most plugins, including UpdraftPlus and BlogVault, offer one-click restore directly from the plugin interface.

The general steps:

  1. Go to the plugin settings.
  2. Browse the backup list.
  3. Select a backup and choose what to restore: database, plugins, themes, or uploads.
  4. Click restore, then wait for it to finish.

Manual restore

If WordPress is broken and you can’t access the admin dashboard:

  1. Download the backup files via SFTP.
  2. Unzip the backup.
  3. Upload the database to MySQL via phpMyAdmin.
  4. Upload the files to the WordPress directory via SFTP.
  5. Update wp-config.php if the database name changed.

This is more technical, but it works even when the WordPress admin itself is inaccessible.

Staging environments

Some hosts offer staging environments as part of the plan:

  • Clone your production site to a separate staging URL.
  • Test updates, theme changes, and new plugins there first.
  • If anything breaks, your production site stays untouched.

Used correctly, staging reduces how often you ever need to restore from backup in the first place. Making a habit of testing bigger changes on staging pairs naturally with a solid backup routine, whether you’re switching themes, like adopting Aurora, or making structural changes to your category structure.

Backup before risky changes

Take a manual backup before:

  • WordPress major version updates.
  • Theme changes.
  • Bulk plugin updates.
  • Database operations like search-replace or table edits.
  • Migration work of any kind.

It takes five minutes and can save you hours if something goes wrong.

What about WordPress.com?

WordPress.com hosts your site and handles backups internally, so you don’t need backup plugins if you’re on that platform.

Self-hosted WordPress, meaning WordPress.org software on your own hosting, puts backups entirely on you.

Storage cost estimates

Typical blog backup sizes look roughly like this:

  • Small blog without media-heavy uploads: 100 to 500MB per backup.
  • Medium blog with 200+ posts and images: 1 to 5GB per backup.
  • Large, photography-heavy blog: 10 to 50GB or more.

S3 storage for 5GB runs about $0.11/month, which is cheap enough that cost is rarely a good excuse to skip backups.

Where this leaves you

Backups feel boring right up until you need them. Set up automated daily backups through UpdraftPlus or a similar plugin, and store them off-site in cloud storage rather than relying on your host alone. Keep 30 days of rolling backups plus monthly archives, and test a restore at least once a year. Use staging for risky changes, and actually verify that backups complete successfully rather than assuming they do. The cost of doing this well is about one hour of setup. The cost of not doing it well can be your entire blog. Spend the hour, and if you haven’t set up backups yet, our guide to setting up automatic WordPress backups walks through the plugin setup step by step.