A backup you’ve never tested isn’t a backup, it’s a hope. Most WordPress backup guides stop at “install a plugin and turn it on,” which handles maybe half the actual problem. Here’s the rest: how many copies you actually need, which plugin fits which kind of site, and how to find out your restore process is broken before a real disaster forces you to find out.
The 3-2-1 Rule
Keep 3 copies of your site (the live version plus two backups), on 2 different types of storage (your host’s disk plus a separate cloud provider, for example), with 1 copy off-site — meaning not on the same server or hosting account as the live site. WordPress’s own developer documentation recommends storing backups in at least two separate locations, with at least one entirely independent of your hosting environment. That last part is the one people skip: if your only backup lives on the same host as your live site, a host-level outage or account compromise can take both down at once.
Many hosts (WP Engine, Kinsta, SiteGround, and others) now include automatic daily backups. That’s a real layer, not a reason to skip a separate plugin-based one — it still lives on the same infrastructure as your site, so it doesn’t satisfy the off-site part of the rule on its own.
Full-Site vs. Database-Only Backups
A full-site backup captures your files (theme, plugins, uploads) and your database (posts, pages, settings, WooCommerce orders). A database-only backup captures just the content and settings, not the files. For most sites, you want full-site backups as the default — a database backup alone won’t restore your theme customizations or plugin configuration, and re-downloading and reconfiguring every plugin from scratch during a real outage is exactly the kind of delay a backup is supposed to prevent.
Which Backup Plugin to Actually Use in 2026
- Jetpack VaultPress Backup: stores backups on infrastructure independent of your host, which is precisely what the off-site part of the 3-2-1 rule calls for. It also does real-time backups for WooCommerce specifically, saving each new order and product update as it happens rather than waiting for the next scheduled run — worth it if a lost hour of orders is a real cost to you.
- UpdraftPlus: the most straightforward free option, scheduled backups to cloud storage (Google Drive, S3, Dropbox) with a one-click restore from the dashboard. A solid default if you don’t have a WooCommerce store’s real-time needs.
- Duplicator: built more for migrations and full disaster recovery than routine scheduled backups — strongest when you need to move or rebuild a site that’s already offline, not just restore a file that got corrupted.
- WPVivid: a capable option covering both scheduled backups and migration, with a free tier that includes cloud storage support.
If you already use Jetpack for other reasons, VaultPress Backup is the least additional overhead. If not, UpdraftPlus or WPVivid cover routine backups without adding a new ecosystem to manage.
How Often to Back Up
Match the frequency to how often the site actually changes. A WooCommerce store processing orders all day needs real-time or hourly backups — losing a day of orders is a real financial loss. A content site that publishes weekly is reasonably covered by daily backups. A brochure site that rarely changes can go weekly. The wrong default is picking one schedule for every site type; match it to how much you’d actually lose if the last backup were also lost.
Actually Test Your Restores
A scheduled backup that’s never been restored is unverified, not reliable. Restore it to a staging environment (not your live site) at least once a quarter, and check that the site actually loads, that forms submit, and that WooCommerce checkout works if you run a store. This is the step almost every backup guide mentions in passing and almost no one actually does — it’s also the one that determines whether your backup works when you need it or two hours into an outage.
Building a Real Recovery Plan
The plan itself needs to include specifics, not just “restore from backup”: your hosting login, your backup storage access (a separate credential from your hosting login if you use off-site storage), your domain registrar login, and the exact restore steps for whichever plugin you use. Store this outside WordPress itself — a password manager or a physically separate document — since a plan saved only inside the site you’re trying to recover is useless during the outage it’s meant to solve.
Backups are also the first real step in any WordPress site migration — you want a verified backup in hand before you touch DNS or move hosts, not partway through when something goes wrong. And if the disaster you’re recovering from is a hack rather than a server failure, securing your WordPress site against modern threats covers what to fix before you’re back online, so you’re not restoring into the same vulnerability. Backup setup is also worth adding to your post-launch checklist rather than something you get to eventually.
