Backup WordPress Site: Three Layers You Can Restore

Backup WordPress site: what you need to save

Your website is more than its visible pages: it may hold orders, inquiries, bookings and the settings that send them to your team. A backup should let you recover those business functions, not just display an old homepage. Start by listing what changes and where each record lives.

• Files

  Save uploads, themes, plugins, custom code and configuration needed to rebuild the site. Include files outside the usual folders if your developer has added custom integrations or private documents.

• Database

  Save content, settings, users and all relevant plugin tables. WooCommerce orders and many stored form entries live here, so copying the uploads folder alone will not recover them.

• Recovery notes

  Record hosting requirements, DNS access, external services and the restore method. Keep credentials in a secure password manager, with recovery access available if WordPress itself is down.

The WordPress backup handbook confirms that a complete recovery needs files and database. Check the actual backup contents, including exclusions, rather than assuming a job labeled full includes every dependency.

WordPress backups in three independent layers

Layer one creates a portable site backup inside the WordPress workflow and sends it off the server. Layer two captures the hosting environment independently of the plugin. Layer three keeps recoverable copies in a separate storage account owned by your business, such as Google Drive, Dropbox, Amazon S3 or Backblaze B2.

The 3-2-1 rule explained by Backblaze calls for three copies, including the live original, on two media, with one off-site. Three folders on the same disk do not meet that goal. Our three layers describe responsibilities; count actual copies and storage locations separately.

Why host-only WordPress backups fall short

Hosting backups are valuable, but they are still part of a commercial account you may lose access to. Account suspension, a provider closing, a billing dispute or a compromised administrator can leave you unable to reach both the site and its copies. Ransomware may also reach backups accessible with the same credentials.

• Recovery may involve a queue

  Ask whether you can restore yourself or must open a support request. A backup can exist while your booking page stays offline waiting for someone with permission to use it.

• Retention may be too short

  A problem discovered late can outlive the oldest available clean copy. Ask for the actual recovery dates and retention policy, not just a promise that backups run daily.

• Access may be shared

  A snapshot under the same account is useful for rollback but may share the account's risks. Keep an independent copy and recovery credentials outside the host's control.

On cPanel hosting, a provider may offer a tool such as JetBackup; a VPS may use snapshots and scheduled database exports. Confirm what your plan actually includes, where copies are stored and whether database consistency is handled. A running server snapshot is not automatically proof of a working store restore.

Set your limits for data loss and downtime

Backup frequency is a business decision before it is a plugin setting. A brochure site edited occasionally has different needs from a store accepting orders throughout the day. Choose two recovery targets and ask your provider how the proposed system will support them.

• RPO: how much recent work can you lose?

  This is your acceptable gap between the last usable backup and the failure. For example, if losing an hour of orders is unacceptable, a nightly database backup leaves too large a gap.

• RTO: how long can the site be down?

  This is your target for restoring service. Include noticing the outage, obtaining access, downloading data, rebuilding and checking the site, not just the restore button's processing time.

Keep several recovery dates, with daily and longer-term points chosen around your business and data retention needs. Take a fresh matching backup before risky changes as well. Schedule heavy jobs away from peak traffic and avoid overlapping exports that strain a small hosting account.

Backups support recovery, but they do not prevent every outage. Pair this plan with safe WordPress updates, the WordPress security checklist and the business priorities in our WordPress web design hub. An unavailable form cannot collect a lead, and an unavailable page cannot be crawled normally by Google.

Backup WordPress site: set up the three layers

Use this setup sequence with your host or technical team. Agree on what successful recovery means before choosing tools, then validate each layer rather than installing several plugins that all depend on WordPress working.

1. Step 1

   Map the site and agree on recovery targets

   List files, database, orders, forms and external systems. Write down acceptable data loss, downtime, backup retention and the person responsible for recovery.

2. Step 2

   Create storage in an account you own

   Choose an independent destination, enable two-factor authentication and arrange secure recovery access. Give the maintenance team only the access it needs, with encryption keys stored separately and recoverably.

3. Step 3

   Configure the WordPress backup layer

   Choose a maintained backup plugin, include files and database, and connect the off-server destination. Run an initial backup and inspect the remote files and timestamps rather than stopping at a connection success message.

4. Step 4

   Add a separate server recovery route

   Ask the host to configure snapshots or account backups with documented retention. On a VPS, arrange server-side scheduling and consistent database exports; record how recovery works if the WordPress dashboard is unavailable.

5. Step 5

   Set schedules, retention and failure alerts

   Match database frequency to new transactions and file frequency to site changes. Keep multiple recovery dates, monitor missing as well as failed jobs, and send alerts to someone who will act.

6. Step 6

   Restore an independent copy to staging

   Download a matching backup set and rebuild on a private test site. Disable live integrations before running tests, then measure the total recovery time and verify the visitor actions your business relies on.

7. Step 7

   Document and schedule the next drill

   Save the tested procedure, access owners, backup date and unresolved gaps. Put a quarterly restore test on the calendar and repeat after major changes to hosting, backup tools or the site's business functions.

Best WP backup plugin: choose by recovery needs

The best WP backup plugin for your business is one your team can restore from under your hosting limits. Check supported storage destinations, archive size limits, scheduling, encryption options and recovery without dashboard access. Confirm which features belong to the edition you will actually use.

A practical starting point for backup on WordPress

UpdraftPlus on WordPress.org documents scheduled backups and destinations including Google Drive, Dropbox and Amazon S3. It is one option for the WordPress layer, not a substitute for server backups or independent ownership. Test it against your actual site before committing to a recovery plan.

Google Drive and other independent destinations

Google Drive or Dropbox can suit a business that wants familiar account management; Amazon S3 or Backblaze B2 may suit a team managing storage policies. Choose the destination around access, capacity, recovery and retention. Connecting cloud storage does not automatically provide encryption you control, immutable copies or a separate deletion policy.

Keep WordPress backups private and recoverable

For a VPS, a technical team can automate database exports with WP-CLI and send them to Google Drive through rclone. The example below assumes an already configured encrypted remote named gdrive-crypt, using rclone crypt over a Google Drive destination. It illustrates the database part only.

set -eu
umask 077
cd /srv/www/example
backup_dir=/srv/private/wp-backups
stamp=$(date -u +%Y%m%dT%H%M%SZ)
job_dir="$backup_dir/$stamp"
mkdir -p "$job_dir"
wp db export "$job_dir/database.sql"
rclone copy "$job_dir" "gdrive-crypt:example/$stamp"

Separate storage credentials reduce shared risk, but a compromised server may still misuse its upload credentials. Review deletion permissions and consider protected retention or an offline copy where appropriate. Encryption protects confidentiality; it does not stop an attacker from deleting an accessible backup.

Restore WordPress from backup on staging first

Test a restore quarterly and after significant platform changes. Use an isolated staging site, a private copy where mistakes will not overwrite live orders or send customer messages. Restore from the independent destination so the exercise proves you can recover without the original host.

Backup date and independent destination:
Files and database restored:
Access and decryption verified:
Forms, pages and order checks:
Total recovery time and blockers:
Owner, next action and next test date:

What a WordPress backup service should deliver

Ask for evidence you can understand: the last independent backup, available recovery dates, who receives failure alerts and the last successful restore test. A service should name who acts when a backup stops arriving. Owning a subscription is different from having someone responsible for recovery.

• A written scope

  Specify included sites, data, schedules, retention and restore responsibilities. Record storage or licensing costs and any recovery work outside the agreed scope before work starts.

• Checks with follow-through

  Review completion, independent copies and alerts, then investigate failures. The quarterly restore record should show working business functions and unresolved issues, not only an archive's size.

• A clean agency handoff

  Keep the client's storage ownership clear and document agency access. Use staging on the agency domain and a report your team can pass on under its own brand.

Our WordPress maintenance service starts at $250 per month per site, with a fixed written quote before work. We set up and test the three-layer plan within the agreed scope; agencies can use white-label WordPress support, with NDA and non-solicitation available. Use our maintenance checklist to connect backups with updates, security and visitor checks.

If your site sells online, also review WooCommerce optimization so order handling, checkout and recovery are planned together. Send us your site address, hosting provider and current backup arrangement; those details let us identify the gaps before quoting.