The Ultimate Guide to WordPress Backup Plugins"

Last updated: November 6, 2026 · By Ryan Walsh

WordPress backups are copies of your website’s database and files that let you rebuild your site after a crash, a failed update, a hack, or a mistake. A complete backup needs both the database and the files, and it should be stored somewhere other than your web server. You can create backups by hand, or you can use a backup plugin that runs them on a schedule. This guide explains what to back up, how often to do it, how to choose a plugin, and how to test a restore so you know it works before an emergency.

Key Takeaways

• A full WordPress backup must include both the database and the files, because the database is stored outside the WordPress directory and a database-only copy cannot restore a whole site.
• WordPress guidance recommends backing up before you update core, themes or plugins, before you install new themes or plugins, before you migrate, and after major content changes.
• Free backup plugins such as UpdraftPlus, BackWPup and Duplicator cover most small sites, while paid services add features like hosted storage, staging and continuous backups.
• Store at least one backup copy off your server, such as in Google Drive, Dropbox or Amazon S3, so a server failure does not take your backups with it.
• A backup is only useful if you have restored it at least once, so test a restore on a separate site or staging copy before you rely on it.

What Should a WordPress Backup Include?

A complete WordPress backup includes two parts: the database and the files. WordPress stores your posts, pages, comments and settings in the database, while your themes, plugins, uploads and configuration live in the file system. If you back up only one of these, you cannot fully restore your site.

What Does the Database Contain?

The database holds your content and most of your site settings. According to the WordPress Developer Resources guide to backups, a typical site has two parts, the database and the files, and both are needed for a full restore because the database is stored outside the WordPress directory. A database-only backup captures posts, pages, comments and settings, but it does not include themes, plugins, uploads or wp-config.php, so it cannot serve as a full-site backup on its own.

Which Files Matter Most?

The most important folder is wp-content. It holds your uploaded images and media, any themes you have edited, and any plugins you have installed. The WordPress guide to backing up files also notes that wp-config.php contains your database connection details, so it needs particular attention in any backup. Core WordPress files can be downloaded again from WordPress.org, but your custom content cannot.

How Often Should You Back Up Your WordPress Site?

Back up your site before every major change and on a schedule that matches how often your content changes. For most sites that publish a few times a week, a daily database backup and a weekly full backup is a practical starting point. Sites with frequent orders or comments may need more frequent backups.

WordPress.org Learn advises backing up before you update the WordPress core, themes or plugins, before you install new themes or plugins, before you migrate a site, and after significant content updates. Those moments are when most problems happen, so a manual backup just before them is a simple habit that prevents many headaches.

• Before any WordPress core, theme or plugin update
• Before installing a new theme or plugin
• Before moving your site to a new host or domain
• After publishing a large batch of content or changing site settings
• On a recurring schedule, such as daily for the database and weekly for full files

How Do You Choose a Backup Plugin?

Choose a backup plugin based on how it stores backups, how it restores them, and whether it fits your hosting setup. The best choice for a small blog may be different from the best choice for a store with daily orders. A plugin is a software add-on that extends WordPress, and you can learn more about how these add-ons work in our guide to understanding WordPress plugins and how they work.

Pricing and features change often, so check each plugin’s current plan details before you buy. Free versions usually cover scheduled backups, but cloud storage and advanced restore features may require a paid upgrade.

What Are the Best Free WordPress Backup Plugins?

UpdraftPlus, BackWPup and Duplicator are widely used free options for WordPress backups. Each one can create scheduled backups and store copies outside your server, though the free feature set differs between them. Start with one of these if you want to protect a small site without spending money.

When Is a Premium Backup Plugin Worth It?

A premium plugin is worth considering when you need hosted storage, staging copies, faster restores or backups that run continuously. Paid tools also make sense if you manage several client sites and need consistent reporting. If your site earns revenue, compare the cost of a plan with the cost of a day offline.

What Should Your Backup Plugin Checklist Include?

• Scheduled backups for both the database and the files
• At least one off-server storage option, such as cloud storage or an FTP destination
• Compatibility with your WordPress version, PHP version and hosting environment
• Clear one-click or guided restore process
• Backup retention settings so old copies are removed automatically
• Email alerts when a backup fails
• Encryption or password protection for stored backups
• Recent updates and active support

How Do You Create a WordPress Backup Step by Step?

You can create a full WordPress backup in about 15 to 30 minutes with a backup plugin. The steps below work with most free plugins, though menu names differ between them. Run the process once manually before you set up any schedule.

1. Install and activate your chosen backup plugin from the WordPress plugin directory.
2. Open the plugin’s settings and select both the database and the files, including wp-content and wp-config.php.
3. Choose an off-server storage destination, such as Google Drive, Dropbox or an FTP location.
4. Run a manual backup and wait for the confirmation message.
5. Download a copy of the backup to your computer as a second safeguard.
6. Set a recurring schedule that matches your publishing and update habits.
7. Set a retention limit, such as keeping the last 7 to 14 daily backups, so storage does not fill up.

For a broader routine that covers backups along with updates and checks, see our guide to automating WordPress maintenance with a 15-minute weekly routine.

How Do You Test and Restore a WordPress Backup?

To restore a WordPress backup, use your plugin’s restore tool or import the backup on a test copy of the site. Test restores matter because a backup that cannot be restored gives you no protection. Restore to a staging site or local copy first, so your live site stays untouched while you check the results.

1. Create a test environment, such as a staging site or a local install.
2. Install the same backup plugin on the test site, or import the backup file using the plugin’s restore option.
3. Restore the most recent backup and wait for the process to finish.
4. Log in and check your homepage, a few posts, your media library, forms, and checkout pages if you sell products.
5. Confirm that your theme and plugins are active and that no error messages appear.
6. Record how long the restore took and note any steps that were unclear, so you know what to do during an emergency.

If you plan to move your site, a backup is the safest starting point. Our walkthrough on moving WordPress to a new host explains the steps in more detail.

How Do WordPress Backups Help With Security?

WordPress backups protect your content after a hack, malware infection or accidental deletion, but they do not stop attacks by themselves. A clean backup lets you roll back to a version of the site from before the problem started. You still need to find and close the vulnerability, or the same issue may return.

Keep backups for several weeks, not just the most recent copy, because an infection may exist in the latest backup before anyone notices it. If your site is compromised, follow the steps in our guide on what to do if your WordPress site gets hacked. For prevention, review the security practices that matter most in 2026.

Frequently Asked Questions

Do I need my own backup if my host already makes backups?

Yes, it is wise to keep your own copy in addition to your host’s backups. Host backups are often kept for a short time and may not be easy to restore, and they can be lost during an account problem. A separate off-server copy that you control gives you a second option.

Can a database backup alone restore my WordPress site?

No, a database backup alone cannot restore your full site. It does not include your themes, plugins, uploads or wp-config.php file. You need both the database and the files for a complete restore.

How much storage do WordPress backups need?

The storage needed depends on the size of your uploads and database. A small blog with few images may need only a few hundred megabytes per backup, while a media-heavy site can need many gigabytes. Set a retention limit so older copies are removed automatically.

Are free WordPress backup plugins reliable enough?

Free backup plugins can be reliable for many sites if you schedule backups, store copies off-server, and test restores. Paid plans usually add features like hosted storage, staging and faster support. The most important factor is whether the backups actually complete and restore correctly.

How long should I keep old WordPress backups?

Keep at least several recent daily backups and a few older weekly or monthly copies. This gives you a way back if an issue, such as malware, is not discovered right away. Delete very old copies to save space once you no longer need them.

Conclusion

WordPress backups are the most reliable way to recover from crashes, failed updates, hacks and mistakes. Back up both the database and the files, store copies off your server, and schedule them to match how often your site changes. Test a restore before you need one, and review your plugin and schedule every few months so your protection keeps up with your site.