The WordPress backup strategy that actually works (3-2-1 rule + monthly restore tests)

Everyone has a backup plugin installed. Almost nobody has tested restoring from it. When the site breaks and you reach for the backup - that is the worst time to discover it has been silently failing for 3 months, or that it backs up files but not the database, or that the backup file is corrupted.

An untested backup is not a backup. It is a file that makes you feel safe until you need it.

Here is the backup strategy I run on 50+ WordPress sites. It is based on the 3-2-1 rule, adapted for WordPress, with monthly restore tests.

The 3-2-1 rule (adapted for WordPress)

The 3-2-1 rule is the gold standard for backups:

• 3 copies of your data
• 2 different storage media
• 1 copy off-site

For WordPress, this translates to:

• Copy 1: Your live site (the original)
• Copy 2: A backup on your hosting server (same datacenter, different disk)
• Copy 3: An off-site backup (cloud storage - Amazon S3, Google Drive, Dropbox, or a VPS in a different region)

The key is off-site. If your hosting provider has a hardware failure (or you get banned, or your account is compromised), the on-server backup is gone too. The off-site copy is your real safety net.

What to back up

A WordPress backup is not one thing - it is two:

• Files: wp-content/ (uploads, themes, plugins, custom code). Skip wp-admin/ and wp-includes/ - these are WordPress core and can be re-downloaded from wordpress.org.
• Database: The entire wp_ database (posts, pages, settings, users, WooCommerce orders, etc.).

Some backup plugins only do one or the other. Check your plugin settings - you need both.

Backup frequency: how often is enough?

• Static brochure site (rarely updated): Weekly backup is fine.
• Active blog (new content weekly): Daily backup.
• E-commerce (WooCommerce): Daily, or even twice-daily. Every order is database data you cannot afford to lose.
• Membership/community site: Daily, minimum. User-generated content is the most valuable data on the site.

Retention: keep 30 days of backups. Longer than that is rarely useful (if a hack went undetected for 60 days, your old backups are also compromised) and costs storage.

Backup tools (what I use and recommend)

UpdraftPlus (best all-around)

The free version handles scheduled backups to Google Drive, Dropbox, Amazon S3, and other cloud storage. Premium adds incremental backups and site migration. Most sites do fine with the free version.

Configure: Settings → UpdraftPlus Backups → Settings. Set schedule to daily, choose remote storage, set retention to 30 days.

Host-level backups (WP Engine, Kinsta, Cloudways)

Managed WordPress hosts include daily backups in their plans. These are server-level (more reliable than plugin-level) and usually restore in one click from the host dashboard.

But: host backups are on the same server as your site. If your hosting account is compromised, the attacker can delete the backups too. Always run an off-site backup (UpdraftPlus to cloud storage) in addition to host backups.

Server-level backups (VPS / dedicated)

If you run a VPS, set up rsync or borg to back up to a remote server nightly. This is the most reliable approach - it does not depend on WordPress or PHP, so it works even if WordPress is completely broken.

Example cron job: 0 2 * * * rsync -az /var/www/wpservicelab/ backup@remote-server:/backups/wpservicelab/

The part everyone skips: restore testing

A backup you have never restored from is an untested assumption. I have seen backup plugins that:

• Reported "backup successful" every day for 6 months, but the backup files were 0 bytes (database connection failed silently)
• Backed up files but not the database (plugin misconfiguration)
• Created backups that could not be restored because the zip file was corrupted
• Backed up to cloud storage where the API key had expired

You will only discover these problems when you try to restore. So: test the restore before you need it.

How to test a restore (without taking down your live site)

1. Create a staging site. Most managed hosts (WP Engine, Kinsta) let you create a staging copy in one click. If you do not have staging, use the WP Staging plugin (creates a clone in a subdirectory).
2. Download a recent backup from your backup plugin or cloud storage.
3. Restore it on staging. Use the backup plugin's restore function, pointing at the staging database.
4. Verify the restore: Load the staging site. Check: homepage loads, a few inner pages load, admin login works, recent posts are present, WooCommerce orders are present (if applicable).
5. Note any errors. If the restore fails, you have found a problem with your backup before it matters. Fix the backup configuration and re-test.

This takes 15 minutes. Do it once a month. It is the most boring 15 minutes of your month - until the day it saves your business.

What to do when you need to restore (for real)

If your live site is broken or hacked and you need to restore from backup:

1. Identify when the problem started. Check access logs, error logs, or the last known-good state. You need a backup from before the problem.
2. Download the backup from that date.
3. Restore on staging first (if you have time). Verify it works before touching production.
4. Restore on production. Most backup plugins let you restore in one click. For manual restores: upload files via FTP, import database via phpMyAdmin or WP-CLI (wp db import backup.sql).
5. Update wp-config.php if the database credentials changed.
6. Flush permalinks: Settings → Permalinks → Save Changes (even without changing anything). This fixes 404 errors after restore.
7. Test: Homepage, inner pages, forms, checkout (if WooCommerce).

The monthly backup audit (5 minutes)

Once a month, check:

• Are backups still running on schedule? (Check the last backup date in your plugin)
• Are backup files arriving in cloud storage? (Log into Google Drive / S3 and check)
• Are backup file sizes reasonable? (A sudden drop to 0 KB = something broke. A sudden increase to 10x normal = possible compromise or huge upload)
• Run one restore test on staging (15 minutes)

If you have a WordPress site (or a network of sites) and want backups set up properly - daily off-site, monthly restore-tested, with monitoring that alerts you if a backup fails - this is part of my maintenance retainer. Single site from $49/month. Message @wpservicelab on Telegram.