WordPress backups: set them up and test them

What a WordPress backup must contain, how often and where to keep it, what two backup plugins state, and how to test that the restore works.

Key points

A WordPress site has two parts: the files and the database. A backup needs both, because a copy of the files does not contain the database.
WordPress advises a backup every week for small sites, every day for busy ones, and always before an update.
Keep 3 to 5 recent backups in different places, and try a restore before you need one.

What a backup must contain

WordPress keeps your site in two places:

The database holds the posts, pages, comments, users, and settings.
The files are WordPress itself, the plugins, the themes, the uploaded images and documents, and the files wp-config.php and .htaccess.

You need both to bring a site back. Not every host’s backup contains both. Ask yours what its backups contain.

How often and where

The WordPress documentation gives this advice:

	WordPress advises
Small sites with few posts	a backup once a week
Busy sites with many posts	a backup every day
Before an update	always a backup of the database
How many	3 to 5 recent backups
Where	in different places, such as on the server, in cloud storage, and on your own computer

A backup that stays only on the hacked or broken server may be lost with it. Keep at least one copy elsewhere.

Two backup plugins

The page on web security tools lists two backup plugins. This is what their makers state, together with the figures this archive collected:

	UpdraftPlus	BlogVault
Free version	yes, with scheduled backups from every 2 hours to monthly	no, 7-day trial
Where backups go	Dropbox, Google Drive, Amazon S3, FTP, email, and more	its own storage off your server, “nine encrypted copies across two providers”
Active installs on WordPress.org	4,000,000+	80,000+
Own CVE entries since 2021	12	1

A backup plugin is code like any other plugin and needs updates too.

Test the restore

A backup helps only if it can be restored. The WordPress documentation recommends checking automatic backups with a manual one once in a while. To restore, put the files back first and then the database.

Make a backup now with your host or a plugin, and download one copy.
Restore it on a test copy of your site. Many hosts offer a staging site for this. A local test installation works too.
Open the test site and check the newest posts, the images, and the login.
Write down how long it took. That is how long your site would be down after an attack.
Repeat the test after big changes, such as a new host or a new backup plugin.

Next step

The page Web security tools lists both backup plugins with what their makers state.

The figures in this guide come from the archive and change with every data update. As of November 13, 2026.