Skip to content

Answer · WordPress Web Design

How Do I Back Up WordPress?

14 days kickoff → live $3K–$15K+ scope-tiered WCAG 2.1 AA baseline

The short answer

Use BlogVault ($89/yr) or UpdraftPlus Premium ($70/yr) for automated daily off-site backups. Three rules: daily cadence, off-site storage (different provider from your host), tested restores quarterly. Host-included backups are useful as a secondary but not sufficient as primary.

№ 01The longer answer

BlogVault is our default. Daily off-site automatic backups stored on BlogVault’s infrastructure, incremental (only changed files transfer), one-click restore, can clone to staging on their servers for testing. Setup takes 5 minutes; runs autonomously after that.

UpdraftPlus Premium is the alternative when you want backups in your own cloud storage (Amazon S3, Google Drive, Dropbox, Backblaze B2). More setup overhead than BlogVault but you control where backups live. Cheaper too ($70/yr vs $89/yr).

Three rules of real backups: (1) Daily, automated — not weekly, not manual. (2) Off-site — on a different provider from your production host. (3) Tested — restore the backup quarterly to confirm it works. Skip any one and the backup is theater.

What gets backed up: database (all content, settings, options), WordPress core files, themes, plugins, and uploads directory. Real backup tools handle all four. Backups that only cover the database or only the files are incomplete.

№ 02Is the host’s built-in backup enough?

Useful but not sufficient. Kinsta and WP Engine both back up daily, but those backups live on the same provider as your site — same risk. Use them as secondary; have a real off-site primary.

№ 03How long should I keep backups?

90 days is the standard. Some teams keep weekly snapshots for a year and monthly snapshots indefinitely. The math depends on your incident-detection lag — some hacks aren’t noticed for weeks.

№ 04What does ‘tested restore’ mean?

Restore the most recent backup to a staging environment, verify content matches expectations, verify integrations work. Do it quarterly. The first time you discover the backup is corrupted is during a real incident.