WordPress backup isn't "set and forget." A backup only makes sense if you can restore it. Many admins discover this only after an attack – when the backup turns out corrupted, incomplete, or six months old.

What Must a Backup Include?

Files (wp-content, wp-config), database – everything. Plugins like UpdraftPlus, BackWPup, or BlogVault create full copies. Ensure the backup includes uploads, plugins, and themes, not just the database.

Where to Store?

Off-site – Dropbox, Google Drive, S3, another server. If the backup is on the same disk as the site, hardware failure or ransomware destroys both copies. 3-2-1 rule: 3 copies, 2 media types, 1 off-site.

Restore Test – Mandatory

Quarterly (minimum) verify restore works. Launch a test site from the backup. If you don't test, treat the backup as non-existent – until verified, you don't know if it works.

Automation

Daily backups (at night), before every major update – manual backup is forgotten backup. Keep at least 7–14 days of history to roll back before infection.

Full checklist: WordPress Security 2026