WordPress backups that actually restore: a tested routine

By Axyra Nova Editorial · 2 September 2026 · 5 min read · WordPress

Most site owners believe they have backups. Fewer have ever restored one. The gap between those two groups only becomes visible on a bad day: a failed update, a hacked site, a deleted page, a host that disappears. On that day, an untested backup can turn out to be incomplete, corrupted or stored in the same place as the broken site.

This routine for WordPress backups is built around one idea: a backup counts only once you have restored it.

What a complete backup includes

A WordPress site has two halves, and you need both.

The database

Posts, pages, settings, users, orders, form entries and most plugin data live in the database. Without it, you have a theme and some images but no content.

The files

The wp-content folder holds your theme, plugins and uploaded media. The root folder holds WordPress core and the wp-config.php file, which contains database connection details and security keys. Core files can be re-downloaded, but wp-config.php and anything you customised cannot.

A backup that captures only one half is not a backup of your site.

Where to store backups

Follow a simple version of the widely used 3-2-1 approach:

• Three copies: the live site plus two backups.
• Two different places: for example, your host's backup system and a cloud storage account.
• One copy off-site: somewhere completely separate from your hosting account.

If your hosting account is compromised or closed, backups stored only inside it may be lost too.

How often to back up

Match frequency to how often the site changes:

Always take an extra backup before updates, theme changes or major edits.

Tools for the job

You have three broad options:

1. Your host's backups. Convenient and often automatic. Check how long they are kept, whether you can download them, and how restores work.
2. A backup plugin. Many reputable plugins can schedule backups to cloud storage. Choose one that is actively maintained; the plugin directory shows update history and active installs.
3. Manual exports. Download files over SFTP and export the database from your host's control panel. Useful as an occasional extra copy.

Most small businesses do well with host backups plus a plugin sending copies to separate cloud storage.

The restore test

This is the step most people skip. Every three months:

1. Create a staging site or a local copy.
2. Restore your latest backup to it using the same method you would use in an emergency.
3. Check the restored site: log in, open recent posts, place a test order or submit a form, view images.
4. Time it. Knowing a restore takes twenty minutes is reassuring; discovering it takes two days is a warning.
5. Write down the steps so anyone on your team can repeat them.

If the restore fails, you have found the problem on a calm day instead of a crisis.

Backups and security incidents

If your site is hacked, restoring the most recent backup may simply restore the infection. Before restoring:

• Work out roughly when the problem started.
• Choose a backup from before that point.
• After restoring, change every password, update everything, and replace the security keys in wp-config.php.

The WordPress hardening guide explains the follow-up steps. Our article on WordPress security basics covers prevention.

Backups and updates

The safest update routine is short:

1. Back up.
2. Update on staging if you have it.
3. Test key pages.
4. Update live.
5. Test again.

The official Updating WordPress guide covers core updates, and our maintenance checklist puts backups and updates on a regular schedule.

Keep a backup log

A small log removes guesswork:

• Date of the last successful backup and where it is stored.
• Date of the last restore test and how long it took.
• Any problems found and fixed.

A spreadsheet is enough. When the day comes, you will know exactly which copy to use.

How long to keep backups

Keep at least two weeks of daily backups and a few monthly snapshots. Some problems, such as malware or accidental deletions, are noticed weeks later. If your site holds personal data, make sure your retention also respects your privacy policy and any applicable data protection rules.

When to get help

If restores feel intimidating, ask your host or a developer to walk through one with you on a staging site. Watching it once makes the process far less frightening. Our team handles this as part of WordPress maintenance; see what's included or get in touch.

A worked example

A small charity's WordPress site was hacked through an outdated plugin. Spam links appeared on several pages, and the host suspended the site after visitors reported warnings.

The charity had host backups, but they were only kept for seven days, and the infection had started earlier. Fortunately, the volunteer who managed the site also had a monthly backup routine sending copies to separate cloud storage. The team:

1. Identified roughly when the infection started from the host's file logs.
2. Restored the most recent clean monthly backup to a staging site and checked it carefully.
3. Re-entered the few posts published since that backup.
4. Updated every plugin and theme, removed unused ones, and changed all passwords and security keys.
5. Asked the host to restore service after confirming the site was clean.

Without the off-site monthly backups, the charity would have had to rebuild the site from scratch. The routine took the volunteer twenty minutes a month and saved weeks of work.

Choosing what to back up more often

Not every part of a site changes at the same rate. Think about:

• Orders, bookings and form entries, which change constantly and matter most.
• Posts and pages, which change whenever you publish.
• Uploads, which grow steadily.
• Themes and plugins, which change mainly during updates.

Matching backup frequency to how often each part changes keeps backups small while protecting the data that would hurt most to lose.

Frequently asked questions

Are my host's backups enough?

They are a good first layer, but keep at least one copy outside your hosting account. If the account is compromised, suspended or closed, host-only backups may be unavailable.

How big are WordPress backups?

It depends mostly on your media library. Text and settings are small; thousands of large images make backups big. Optimising images before uploading keeps backups manageable.

Should I back up before every update?

Yes, especially for theme updates, major plugin updates and WordPress core updates.

How do I know a backup works?

Restore it to a staging site and check that pages, logins, forms and media all work. That is the only reliable proof.