WordPress backup: complete guide 2026

What a WordPress backup must include

A complete backup has two parts. If either is missing, the restore isn't complete — and many plugins only do one of the two: files without a database aren't much use, the database without files gives you an empty site with structure but no themes or plugins.

• The files: everything in wp-content (themes, plugins, uploads), the wp-config.php file with credentials, the .htaccess file with server rules.
• The database: all WordPress tables, including content, settings, WooCommerce options and form data.

How often to do backups

It depends on how much the site changes. The rule: the backup must be more recent than the data you can't afford to lose. If a customer orders at 10am and the nightly backup is at 3am, you've lost 7 hours of orders — you decide if that's acceptable.

• Static site, content unchanged for weeks: once a week is enough.
• Blog with daily articles: daily backup.
• WooCommerce with orders every hour: database backup every 12 hours, weekly full backup.

Backup plugins: pros and cons

The problem with free plugins: they work until they don't. If the plugin has a conflict with something else, if an update breaks something, if the backup file exceeds a server limit, the backup stops coming out and you don't notice until it's needed.

• UpdraftPlus: the most used. Free version does what's needed — full backups, restore, storage on Google Drive, Dropbox, S3. Premium adds incremental backups and support.
• Duplicator: creates a complete package for migration, less convenient for regular backups.
• WPvivid: good interface, works without complicated setup.
• WP Staging (paid, a few euros/month): what I use for extra reliability on business sites. Copies the site to an internal staging environment, does full backups with one-click restore, and lets you test every update before pushing to production — backup, staging and migration in one place.

Hosting-side backup: what to ask

Most professional hosts do automatic backups — SiteGround, Kinsta, WP Engine do daily backups with 30 days of history. The problem: they're automated, nobody manages them. If your site's plugin has an error and the database gets corrupted, the next day's backup contains the same corrupted database — having a backup before every manual intervention is what's almost always missing. Ask your hosting:

• Do backups actually exist.
• How frequent are they.
• How long are they kept.
• Can you restore them yourself, without calling them.

Where to save backups

Never on the server itself: if the server goes down or gets hacked, you lose the site and the backup together. UpdraftPlus lets you send backups wherever you want.

• Google Drive (15GB free).
• Dropbox (2GB free).
• Amazon S3 (a few cents per month per GB — with multiple sites, a storage lifecycle moves old backups to a cheaper tier automatically).
• Your own external hard drive with sync.

How to test that the backup works

An untested backup is a backup that doesn't exist. The right way: restore the backup to a staging environment, verify the site works, check that all data is there. Do it at least once every 3 months. WP Staging makes this step trivial: it creates an identical copy of the site (database + files) on an internal subdomain, lets you update plugins and theme on the copy without touching the live site, and with one click you push everything to production if it went well. It's the cleanest way I know to sleep soundly after a critical update. Backup plugins have a 'test restore' function but it only works with backups managed by the same plugin: if you use UpdraftPlus for backup, test restore works. If you switch plugins, the old backup often won't import to the new one.