This article is part of the WordPress Forensics series — practical guides for WordPress security, recovery, and migration.

Introduction

Most WordPress sites have backups. Few have backups that actually work when needed. The difference between a minor inconvenience and a catastrophic data loss is not whether you have backups — it is whether your backup strategy covers the real failure scenarios.

Why Most Backup Strategies Fail

  • Backups stored on same server — Server failure destroys backups too
  • Never tested restores — Backup file exists but restoration fails
  • Incomplete backups — Files backed up but not database (or vice versa)
  • Insufficient retention — Malware detected after only backup is infected
  • No offsite copy — Hosting account compromise affects backups

The 3-2-1 Backup Rule

  • 3 copies of your data
  • 2 different storage media/locations
  • 1 offsite backup

What to Back Up

Files

  • wp-content/uploads (media files)
  • wp-content/themes (theme files and customizations)
  • wp-content/plugins (plugin files)
  • wp-config.php (configuration)
  • .htaccess (server rules)
  • Any custom directories

Database

  • All WordPress tables (wp_posts, wp_options, etc.)
  • Custom tables from plugins
  • WooCommerce orders if applicable

Often Forgotten

  • Email accounts and forwarders
  • DNS records
  • SSL certificates (if custom)
  • Cron job configurations
  • Server-level configurations

Backup Methods

Method 1: WordPress Backup Plugins

Best for: Ease of use, automated scheduling

Recommended Plugins

  • UpdraftPlus — Free tier, multiple cloud destinations
  • BlogVault — Real-time backups, staging included
  • BackupBuddy — Migration features, Stash storage
  • Duplicator — Good for migrations, manual backups

Plugin Backup Limitations

  • Depend on WordPress functioning
  • Can fail on large sites (memory/timeout limits)
  • May not backup non-WordPress files

Method 2: Hosting Provider Backups

Best for: Server-level protection, no WordPress dependency

  • Usually automatic and included
  • Covers entire account
  • Independent of WordPress health

Limitations

  • Limited retention (often 7-30 days)
  • Stored with same provider (single point of failure)
  • Granular restoration may be limited

Method 3: Manual Command-Line Backups

Best for: Full control, large sites, custom requirements

File Backup

tar -czvf backup-files-20260225.tar.gz /path/to/wordpress

Database Backup

mysqldump -u username -p database_name > backup-db-20260225.sql

Compress Database Backup

gzip backup-db-20260225.sql

Method 4: Syncing Solutions

Best for: Real-time protection, developer workflows

  • rsync to remote server
  • Git for theme/plugin code
  • Cloud sync (Dropbox, S3) for uploads

Offsite Storage Options

  • Amazon S3 — Scalable, pay-per-use, versioning
  • Google Cloud Storage — Similar to S3, Google ecosystem
  • Dropbox/Google Drive — Simple, consumer-friendly
  • Backblaze B2 — Cost-effective S3 alternative
  • Second hosting account — Different provider
  • Local download — Your own storage

Backup Schedule Recommendations

Small Sites (Blog, Brochure)

  • Full backup: Weekly
  • Database only: Daily
  • Retention: 30 days minimum

Medium Sites (Regular Updates)

  • Full backup: Daily
  • Database: Every 6 hours
  • Retention: 60 days

High-Traffic/E-commerce Sites

  • Full backup: Daily with incremental hourly
  • Database: Real-time or hourly
  • Retention: 90+ days
  • Consider point-in-time recovery solutions

Testing Your Backups

Untested backups are not backups — they are hopes.

Monthly Test Protocol

  1. Download recent backup locally
  2. Set up test environment (local or staging)
  3. Restore files
  4. Restore database
  5. Verify site functions correctly
  6. Document any issues

Backup Security

  • Encrypt backups containing sensitive data
  • Secure cloud storage with strong credentials
  • Enable MFA on backup storage accounts
  • Limit backup access to necessary personnel
  • Audit backup access regularly

Documentation Checklist

  • Backup schedule and retention policy
  • Storage locations and access credentials
  • Restoration procedures step-by-step
  • Contact information for hosting/providers
  • Recovery time objectives (RTO)
  • Last successful restore test date

Conclusion

A backup strategy is only as good as its weakest link. Combine multiple methods, store copies offsite, test regularly, and document everything. When disaster strikes, you will be grateful for every minute spent on backup planning.