How to back up a WordPress site (and actually test the backup)
Learn to properly back up your WordPress site with offsite storage and test your backups to ensure you can recover from any disaster. Don't risk it.
What a Complete WordPress Backup Contains
A functional WordPress backup consists of two distinct parts: your website files and your MySQL database. The files include your theme, plugins, uploads folder, and critical configuration files like wp-config.php. The database stores all your content, such as posts, pages, comments, and user data. A backup missing either of these components is incomplete and will fail to restore your site properly.
While many hosting providers offer automated backups, they are often stored on the same server as your live site. This provides a safety net against accidental file deletion but offers no protection from server-level catastrophes like hardware failure, malware infections, or a compromised hosting account. For true security, you need an independent, offsite backup solution.
The 3-2-1 Backup Strategy
Industry best practice follows the 3-2-1 rule: maintain at least three copies of your data, store them on two different types of media, and keep at least one copy offsite. For a WordPress site, this could mean one backup from your host, a second automated backup sent to a cloud service like Google Drive or Amazon S3 via a plugin, and a third copy downloaded to your local machine periodically.
Relying solely on your host's backups is a significant risk. If a billing dispute arises, your account is suspended, or the host's infrastructure is breached, you could lose access to both your live website and your only method of recovery simultaneously. An offsite backup ensures you always have a viable restoration point under your control.
How to Create an Offsite Backup with a Plugin
Using a plugin is the most accessible way to manage automated, offsite backups. After installing and activating a trusted plugin like UpdraftPlus, navigate to its settings panel within your WordPress dashboard. From there, you can easily connect to a variety of remote storage services, including Dropbox, Google Drive, and Amazon S3, by following the on-screen authentication prompts. This ensures your backups are stored safely away from your web server.
Once you have configured your remote storage, you can set a schedule for both file and database backups. For most content sites, a daily database backup and a weekly file backup is a reasonable starting point. After saving your settings, initiate your first manual backup to confirm the entire process works as expected and that the backup files appear in your chosen cloud storage location.
The Crucial Step: Testing Your Backup
At least once per quarter, you must test your backup by performing a full restoration on a non-production environment. Use a staging site provided by your host or a local development tool like LocalWP to create a safe sandbox. Attempt to restore both the files and the database from your latest backup file, then thoroughly check the restored site for missing images, broken links, database errors, or plugin conflicts.
The majority of untested backups fail during a real emergency due to issues that are invisible until the restoration process begins. An untested backup provides a false sense of security, not a reliable recovery plan. Regularly validating your backups is the only way to guarantee you can get your site back online when it matters most.
Questions readers ask about this topic
How often should I back up my WordPress site?
What is the best WordPress backup plugin?
Does WordPress have a built-in backup function?
Where to go next on Hostilo
One email a month. Hosting deals, new reviews, no fluff.
The WordPress performance checklist that actually works
Twelve changes that move real Core Web Vitals numbers, ranked by impact, not popularity.
How to speed up WordPress: the only checklist you need
Ten changes that actually move the needle on WordPress speed — ranked by impact, not by what plugin authors want you to install.