A WordPress backup is a saved copy of your site’s files and database that lets you rebuild the whole thing if it breaks, gets hacked, or disappears. The short version of this guide: keep three copies of your site, on two kinds of storage, with one copy off your server, and test that you can actually restore them. Do that and no single failure, bad update, or attack can take your site away for good.
Most owners find out how much they need a backup on the day they do not have one. A plugin update white-screens the site, a hosting account lapses, or an attacker wipes the database, and the only question that matters is: where is the last good copy? This guide shows you what a real backup includes, how often to make one, which tools do it automatically, and how to restore fast when something goes wrong.
If you already run into trouble, our guides to the WordPress critical error and the white screen of death show how a recent backup turns a crisis into a two-minute rollback.
Key Takeaways
- A complete WordPress backup includes both your files (themes, plugins, uploads) and your database (posts, pages, settings). Miss either one and you cannot fully restore.
- Follow the 3-2-1 rule: keep 3 copies of your site, on 2 different storage types, with 1 copy stored off your server.
- WordPress powers 41.5% of all websites and 59.2% of sites that use a CMS, which makes it the most attacked platform on the web.
- Plugins are still the main security risk. Of the 11,334 new WordPress vulnerabilities discovered in 2025, 91% were found in plugins, showing that plugins remain the largest source of security problems in WordPress.
- Back up as often as your site changes: daily for stores and busy blogs, weekly for brochure sites. Always back up before any update.
- A backup you have never restored is a guess, not a safety net. Test a restore at least once so you know it works.
Why WordPress Backups Matter More in 2026
WordPress runs a huge share of the web, which is exactly why it draws so much attention from attackers. As of July 2026, WordPress powers 41.5% of all websites and 59.2% of every site built on a known content management system. Popularity is a feature for you and a target list for everyone trying to break in.
The weakest point in most WordPress websites is not the core software but the plugins and themes added to extend its functionality. According to Patchstack’s State of WordPress Security in 2026, 17% of the vulnerabilities discovered in 2025 were classified as high priority, meaning they were actively exploited or considered likely to be mass-exploited. This shows that even a single vulnerable plugin can expose an entire website to serious security risks.
Where WordPress Vulnerabilities Live, Share of 11,334 New Vulnerabilities in 2025 (Source: Patchstack, 2026)
| Component | Share of vulnerabilities |
| Plugins | 91% |
| Themes | 9% |
| WordPress core | <1% |
Attacks are only one way to lose a site. Sites go down after a bad update, a botched migration, an expired hosting bill, a corrupted database, or a simple human mistake while editing files. When ransomware does land, the cleanup is expensive: the average recovery cost in 2025 was 1.5 million dollars, and 49% of victims paid a ransom to get their data back. A current, off-server backup is the one control that lets you refuse to pay and rebuild on your own terms.
Despite all this, backups stay the job people skip. In a 2025 survey of 2,480 people across eight countries, 9% said they never back up their data at all, and only about two-thirds back up regularly. The gap between “I should” and “I do” is where sites die.
What a Complete WordPress Backup Actually Includes
A WordPress site is two things stored in two different places, and a real backup captures both. Save one without the other and your restore will fail.
- Your files. These live in the site directory on your server. They include the wp-content folder with your themes, plugins, and every image and document in uploads, plus your wp-config.php and the core WordPress files. This is the look of your site and everything you have uploaded.
- Your database. This is a MySQL database, separate from the files. It holds all your posts, pages, comments, users, and settings. Your written content is here, not in the files.
A backup that grabs files but skips the database restores an empty shell with no posts. A backup that grabs the database but skips the uploads folder restores your words with every image broken. You need both, from the same moment in time, so they match when you put them back.
[Our Insight] The single most common “my backup did not work” story is a mismatched pair: files from Tuesday, database from Sunday. When they come from different moments, references break, images point at missing files, and plugin settings expect tables that are not there. Any backup worth keeping saves files and the database together as one snapshot. If a tool lets you back up only one, treat it as a partial copy, not a real backup.
A complete WordPress backup contains both the site files (the wp-content folder with themes, plugins, and the uploads media, plus core files and wp-config.php) and the separate MySQL database that stores posts, pages, users, and settings. Restoring one without the other leaves an incomplete site, so both must be captured from the same point in time.
The 3-2-1 Backup Rule, Explained Simply
The backup industry has used one rule for about 20 years because it survives almost any single disaster. It is the 3-2-1 rule:
- 3 copies of your site: the live site plus two backups.
- 2 different storage types, so one failure cannot destroy both. For example, your host plus a cloud drive.
- 1 copy off your server, kept somewhere your hosting account cannot reach.
That last point is the one people get wrong. A backup saved on the same server as your live site is convenient and nearly worthless in the worst cases. If the server dies, the account is suspended, or an attacker gains full access, they take your backup with the site. Off-server storage, a cloud drive or a separate backup service, is what saves you when the whole hosting account goes dark.
Newer guidance stretches this to 3-2-1-1-0: add 1 immutable or offline copy that cannot be altered, and aim for 0 errors by verifying each backup actually restores. For most WordPress sites, plain 3-2-1 with one verified restore is already a strong position.
The 3-2-1 backup rule, a roughly 20-year industry standard, calls for 3 copies of your data on 2 different storage types with 1 copy kept off your server. The off-server copy is critical for WordPress because a backup stored on the same hosting account is lost alongside the site if the server fails or the account is compromised.
How Often Should You Back Up WordPress?
The right frequency matches how often your site changes. A store taking orders every hour needs a very different schedule than a five-page brochure site that updates twice a year. Back up too rarely and a restore rolls you back to stale content; back up more often than your site changes and you just store duplicates.
Use this as a starting point, then adjust for your own pace of change:
| Site type | How often it change | Recommended backup frequency |
| WooCommerce store, membership, or forum | New orders, users, and posts every hour | Real-time or hourly, plus a daily full backup |
| Active blog or news site | New posts and comments most days | Daily |
| Small business or brochure site | Occasional edits, few times a month | Weekly |
| Archival or rarely touched site | Rarely changes | Monthly, plus before any update |
One rule sits above the schedule: always back up right before you change anything. Before you update WordPress, a plugin, or a theme, before you edit functions.php, before you migrate hosts, take a fresh backup first. Most self-inflicted site breaks happen during exactly these moments, and a pre-change backup turns a failed update into a one-click undo. Our WordPress staging environment guide pairs well here, since testing updates on a copy first means you rarely need the backup at all.
[Personal Experience] The audits where we find no backup at all almost always also have no staging site and a stack of plugins two years out of date. It is the same mindset: change things live and hope. The fix is not complicated. Turn on daily automatic backups, send them off-server, and take a manual one before you touch an update. That single habit has saved more sites we work on than any security plugin.
WordPress backup frequency should match content change rate: hourly or real-time for stores, memberships, and forums; daily for active blogs; weekly for small business sites; and monthly for archival sites. Regardless of schedule, always take a fresh backup immediately before updating WordPress, a plugin, or a theme, since updates are when most avoidable breakage happens.
How to Back Up a WordPress Site: 3 Methods
There are three practical ways to back up WordPress, from easiest to most manual. Most owners should use a plugin. The others are useful as a second layer or for one-off snapshots.
| Method | Best for | Trade-off |
| Backup plugin (UpdraftPlus, Solid Backups, BlogVault, Jetpack VaultPress) | Almost everyone. Scheduled, automatic, off-server, one-click restore. | Free tiers limit storage and frequency; heavy backups can strain small hosting plans. |
| Host backup (built into your hosting panel) | A convenient second copy, often automatic on managed hosts. | Usually stored on the same provider, so it fails the “off-server” test if the account is lost. |
| Manual backup (download files by FTP + export database via phpMyAdmin) | A one-time snapshot before a big change, or when you want full control. | Easy to forget, easy to do incompletely, and no automatic schedule. |
Method 1: A backup plugin (recommended)
A backup plugin is the simplest reliable option. You install it once, set a schedule, connect an off-server destination like Google Drive, Dropbox, or Amazon S3, and it runs on its own. Good plugins back up files and database together, keep several versions, and restore with one click. This is the method that satisfies the 3-2-1 rule with almost no ongoing effort, which is why it suits nearly every site.
When you choose one, check three things: does it store copies off your server, does it back up files and database together, and does it offer a tested one-click restore. A plugin that only saves to the same server it is protecting is missing the point of a backup.
Method 2: Your host’s backup
Many hosts, especially managed WordPress hosts, take automatic daily backups for you. Use them, but treat them as a bonus rather than your whole plan. Host backups usually live on the same provider, so if your account is suspended, billing lapses, or the provider has an outage, that copy may be out of reach when you need it. Keep a host backup and an independent off-server copy.
Method 3: A manual backup
For a one-off snapshot, you can do it by hand. Download your site files over FTP or your host file manager, then export the database from phpMyAdmin in your hosting panel as a .sql file. Store both together, labeled with the date. This is fine before a single risky change, but it relies on you remembering, and it is easy to grab the files and forget the database. It is a backup method, not a backup strategy.
Where to Store WordPress Backups
Where a backup lives matters as much as whether you have one. The goal is to keep at least one copy somewhere your hosting account cannot take down with it.
- Cloud storage (recommended): Google Drive, Dropbox, Amazon S3, or a dedicated backup service. This is your true off-server copy, and most backup plugins connect to one directly.
- A dedicated backup service: Some plugins store copies on their own cloud, separate from your host, which keeps backups safe even if your server is fully compromised.
- Your local computer: A useful extra copy, but not a primary plan on its own, since it is easy to forget and easy to lose with the machine.
- The same server as your site: Convenient for quick rollbacks, but never your only copy. If the server or account goes, so does this backup.
Aim for at least two destinations, with one of them fully off-server. That is the practical version of “2 different storage types, 1 off-site” from the 3-2-1 rule.
Store at least one WordPress backup off-server, in cloud storage such as Google Drive, Dropbox, or Amazon S3, or with a dedicated backup service. A copy kept only on the same hosting account is lost with the site if the server fails or the account is compromised, so on-server backups should never be the sole copy.
How to Restore a WordPress Backup
A backup is only worth what its restore delivers, and restoring is straightforward once you know the two routes.
If you used a backup plugin, restoring is usually a single screen. Open the plugin, find the backup dated just before things went wrong, and click Restore. The plugin puts your files and database back to that moment. If you can still reach your dashboard, this is often a two-minute fix. If the site is fully down, most quality plugins let you restore from their cloud or reinstall WordPress, add the plugin, and pull the backup from your connected storage.
If you are restoring manually, upload your saved files over FTP to replace the current ones, then import your .sql database file through phpMyAdmin, replacing the existing tables. Make sure the files and database come from the same backup so they match. This is more involved, which is another reason a plugin is worth it for most owners.
[Unique Insight] The restore you never test is the one that fails when it counts. Backup files can be corrupted, incomplete, or saved with the wrong database credentials, and you find out only when you try to use them. Run one restore on a staging copy after you set up backups. It takes 15 minutes and converts your backup from a hopeful guess into a proven safety net. A tested restore is the difference between “we have backups” and “we are covered.”
If a bad update, not a lost site, is the problem, our guides to common WordPress mistakes and WordPress security best practices cover the fixes that go hand in hand with a clean restore.
Common WordPress Backup Mistakes to Avoid
Even sites that run backups often make one of these errors, and each one quietly breaks the safety net:
- Storing backups on the same server as the site. The most common mistake. If the account goes, the backup goes with it.
- Backing up files but not the database, or the reverse. A partial backup cannot fully restore the site.
- Never test a restore. An untested backup is an assumption. Prove it works once.
- Backing up too rarely for how the site changes. A monthly backup on a daily store loses a month of orders.
- Keeping only one copy. One backup that turns out to be corrupt leaves you with nothing. Keep several versions.
- Forgetting to back up before updates. The riskiest moment is exactly when people skip the pre-change snapshot.
Fix these six and you are ahead of most sites on the web, including many run by professionals.
Frequently Asked Questions
How do I back up my WordPress site?
The easiest way is a backup plugin such as UpdraftPlus, Solid Backups, or BlogVault. Install it, set a schedule, connect an off-server destination like Google Drive or Dropbox, and it backs up your files and database automatically. You can also back up manually by downloading files over FTP and exporting the database from phpMyAdmin, but a plugin is more reliable for ongoing protection.
What does a WordPress backup include?
A complete WordPress backup includes both your site files (the wp-content folder with themes, plugins, and uploaded media, plus core files and wp-config.php) and your MySQL database, which stores all posts, pages, users, and settings. Both must come from the same point in time so they match when you restore.
How often should I back up my WordPress site?
Match the frequency to how often your site changes: real-time or hourly for stores and membership sites, daily for active blogs, and weekly for small business sites. Always take an extra backup immediately before updating WordPress, a plugin, or a theme.
Where should I store my WordPress backups?
Keep at least one copy off your server, in cloud storage like Google Drive, Dropbox, or Amazon S3, or with a dedicated backup service. Following the 3-2-1 rule, keep 3 copies on 2 storage types with 1 off-server, so no single failure can destroy every copy.
Are host backups enough on their own?
Not usually. Host backups are convenient and worth keeping, but they typically sit on the same provider as your site, so they can be out of reach if your account is suspended or the provider has an outage. Pair a host backup with an independent off-server copy.
How do I restore a WordPress backup?
If you used a backup plugin, open it, pick the backup from just before the problem, and click Restore. If you are restoring manually, upload your saved files by FTP and import the database .sql file through phpMyAdmin, making sure both come from the same backup. Test a restore once on staging so you know it works before you ever need it.
Conclusion
A WordPress backup is the cheapest insurance you will ever buy for your site, and the one most owners only value in hindsight. The plan is not complicated: keep three copies on two storage types with one off your server, back up as often as your site changes, always snapshot before an update, and test a restore once so you know it works. Follow that and no hack, bad update, or hosting failure can end your site.
Set it up today while everything is fine, because the day you need a backup is the worst day to discover you do not have one. Turn on automatic off-server backups, take a manual copy before your next update, and run one test restore this week.
If you would rather have backups, updates, and monitoring handled for you, our WordPress maintenance service keeps sites backed up and current, and our WordPress audit checks whether your current backup setup would actually survive a real failure.
