How to Back Up Your WordPress Site: The Complete 2026 Guide

If your WordPress site disappeared right now — hacked, botched update, hosting failure — could you get it back by tomorrow? If the answer involves crossed fingers, learning how to back up your WordPress site properly is the most important thing you’ll do this week.

Backups are the least glamorous part of running a website, and the one site owners regret skipping the most. I’ve seen owners lose months of content because they assumed their host “had it covered,” only to discover the host’s backup was just as corrupted as the live site — or stored on the same failing server.

This guide covers the whole picture: what to back up, how often, which plugin to use, where to store copies, and — the step almost everyone skips — how to prove your backups actually restore.

What a WordPress Backup Actually Includes

Before you set anything up, it helps to know what you’re protecting. A WordPress site lives in two places:

1. The files — everything inside wp-content: your theme, your plugins, and your uploads (images, PDFs, videos). WordPress core itself doesn’t need to be backed up; you can always re-download it.
2. The database — your posts, pages, comments, settings, user accounts, and everything that makes your site yours.

Both halves matter. Files without the database give you a design with no content. A database without the files gives you text with no design, no images, and no functionality. Every backup you make must include both.

One more thing to keep in mind: your wp-config.php file contains your database credentials. It usually gets swept up into backups, which means wherever you store your backups, someone who gets hold of them gets the keys to your database. Keep that in mind when we talk about off-site storage below — it’s also why backups belong in every serious WordPress security hardening checklist.

How Often Should You Back Up Your WordPress Site?

The right schedule depends on how often your site changes. A static brochure site that updates twice a year needs far less than a store taking orders every hour. Here’s a sensible starting point:

The database changes constantly — new orders, comments, form submissions — while your theme and plugin files only change when you update them. That’s why the database deserves the more aggressive schedule. If you publish or take orders daily, daily backups are the floor, not the ceiling.

One practical gotcha: most backup plugins rely on WP-Cron to run their schedules, and WP-Cron only fires when someone visits your site. If your site gets very little traffic, scheduled backups can quietly drift. If you run a low-traffic site with critical content, consider setting up a real server cron job to hit wp-cron.php on a timer.

The 3-2-1 Rule for WordPress Backups

Professional system administrators live by the 3-2-1 rule, and it applies perfectly to WordPress:

• 3 copies of your data (the live site plus two backups)
• 2 different storage media or locations (for example, your server and a cloud drive)
• 1 copy off-site — somewhere completely separate from your hosting

The off-site part is the one that saves people. If your hosting account gets compromised, hacked, or suspended, every backup stored on that same server is compromised too. When you back up your WordPress site, the copy that actually rescues you is the one your attacker, host, or hardware failure can’t touch.

Choosing a WordPress Backup Plugin

The WordPress plugin directory has dozens of backup tools. In practice, the choice comes down to four well-tested options:

A few notes to help you choose:

• UpdraftPlus is the safe default. The free version schedules backups, sends them to your cloud storage of choice, and restores with one click from the dashboard. With millions of active installs, it’s the most battle-tested option in the directory.
• WPvivid is the dark horse — generous free cloud destinations and even staging features at no cost.
• Duplicator is what I reach for when a backup and a migration might be needed together, since moving a WordPress site between hosts often starts from a Duplicator archive. Its free version produces a portable archive with an installer script, but scheduling and cloud storage are paid features.
• VaultPress (Jetpack Backup) is the only mainstream option with true real-time backups. If you run a WooCommerce store where losing an hour of orders costs real money, it’s worth pricing.

Whichever you pick, reading this hands-on backup plugin test from WPSymposium is worth it before you commit — they actually broke and restored test sites with each plugin.

Setting Up Automated Backups with UpdraftPlus

UpdraftPlus is my default recommendation because the free version does everything most sites need. Here’s the full setup, start to finish:

1. Install the plugin. In your dashboard, go to Plugins → Add New, search for “UpdraftPlus,” click Install, then Activate.
2. Open the settings. Go to Settings → UpdraftPlus Backups, then click the Settings tab.
3. Set your schedules. Set the Files backup schedule to weekly and the Database backup schedule to daily (adjust for your site type using the table above).
4. Choose remote storage. Scroll to “Choose your remote storage” and select Google Drive, Dropbox, or whichever you use. Click Save, then follow the authorization prompts to connect your account. A backup that only exists on your server isn’t a backup — this step is the whole point.
5. Set retention. Choose how many backups to keep — for example, retain 7 database backups and 4 file backups. Enough to roll back a few weeks, not so many that you fill your cloud storage.
6. Run your first backup manually. Click “Backup Now,” check both “Include your database” and “Include your files,” and let it run. Then confirm the backup actually arrived in your Google Drive or Dropbox folder.
7. Turn on email reports. In the settings, enable backup completion emails so a silent failure doesn’t go unnoticed. A schedule that quietly stopped running is worse than no schedule, because you think you’re protected.

If you prefer the command line and have WP-CLI installed, a manual database snapshot is one command:

wp db export ~/backups/db-$(date +%F).sql

That gives you a timestamped SQL dump — handy before a risky update even when your automated schedule is running.

Where to Store Your Backups

Cloud storage is the sweet spot for most site owners: it’s cheap, it’s off-site, and the plugin handles the upload automatically. Google Drive and Dropbox are the easiest starting points — you probably already have an account. Amazon S3 is the better choice for larger sites, especially with a lifecycle policy that deletes old backups automatically.

Two rules for wherever you store them:

• Encrypt when you can. At minimum, protect the cloud account itself with a strong password and two-factor authentication. Remember, these archives contain your database credentials.
• Keep at least one copy somewhere the WordPress site itself can’t reach. If your admin account gets compromised, an attacker can log in and delete your backups from any destination your backup plugin can access. A second destination outside your site’s reach — even a monthly manual download to your own computer — is cheap insurance.

Your host’s built-in backups count as a bonus layer, not the plan. They’re convenient for quick rollbacks, but they live on the host’s infrastructure and on the host’s terms.

Testing Your Backups (The Step Everyone Skips)

Here’s the uncomfortable truth: a backup you’ve never restored is a hypothesis, not a safety net. Backup files can be incomplete, corrupted, or silently empty — and you only find out when you need them most.

Do a restore drill at least once a quarter:

1. Make a fresh backup of your live site.
2. Restore it somewhere safe — your host’s staging environment is ideal, or a local setup like LocalWP.
3. Check that everything works: content, media, logins, plugins, and key pages.
4. Re-save your permalinks (Settings → Permalinks → Save Changes) to rule out rewrite-rule weirdness.
5. Write down what worked and what didn’t, and keep it with your site documentation.

If your site were ever fully down, Hostinger’s restore walkthrough is a solid reference for the from-scratch process. The goal of the drill is to make sure you never need it in a panic.

5 Backup Mistakes to Avoid

• Storing backups only on the server. One compromised server takes the site and the backups together.
• Backing up the database but not the files (or vice versa). Half a backup restores half a site.
• Never testing a restore. Covered above — don’t skip this.
• Keeping every backup forever. Storage fills up, uploads get slower, and costs creep up. Set a retention policy and let the plugin enforce it.
• Assuming the host handles it. Host backups are a convenience layer. Your own automated, off-site, tested backups are the disaster recovery plan.

Final Word

Backing up a site takes about twenty minutes to set up and zero minutes to maintain once it’s running. The alternative — rebuilding from memory after a failure — takes weeks and never fully works.

Set up automated backups today, store them off-site, and test a restore this month. If you’d rather have it handled properly from the start, that’s exactly the kind of maintenance work I do — reach out through my contact page and I’ll get your site protected.