A usable WordPress backup must contain the database, required files and enough external information to rebuild the site. It must also be stored somewhere that remains available if the hosting account, administrator login or website itself is compromised.
Understand what must be protected
| Component | Why it matters |
|---|---|
| Database | Pages, posts, settings, users, orders and plugin data |
| Uploads | Images, documents and other media |
| Themes and plugins | Custom code, paid packages and exact deployed versions |
| Configuration | wp-config.php, server rules, redirects and scheduled tasks |
| External services | DNS, email, CDN, payment, licence and API configuration |
| Recovery information | Credentials, contacts, encryption keys and restoration instructions |
Choose backup methods that do not share one failure
Host snapshots are convenient but should not be the only copy. Add an independent backup under business control, ideally in a separate account or storage provider. A plugin backup can be useful, but confirm that it includes the whole database and required files, completes successfully and can be downloaded without relying on the broken website.
Set frequency from acceptable data loss
Ask how much new work the business can afford to lose. A monthly brochure-site backup may be sufficient only if content rarely changes; an active store may need frequent database protection because orders and stock change throughout the day. File and database schedules can differ, but they must form a coherent recovery point.
Create a complete manual checkpoint before risky work
- Confirm the business can access the hosting, WordPress administrator account and backup destination.
- Export or back up the complete database.
- Copy uploads, active themes, plugins and configuration files.
- Record WordPress, PHP, database and key extension versions.
- Download or replicate the backup to an independent location.
- Check the archive opens and contains expected files and database tables.
- Label the backup with site, time, method and purpose.
Protect the backup itself
- Limit access and use multi-factor authentication where available.
- Encrypt sensitive archives where appropriate and keep keys separately.
- Do not store public download links or backups inside a web-accessible folder.
- Retain more than one recovery point so a compromised or corrupted state does not replace every good copy.
- Document deletion and retention where backups contain personal data.
Verify by restoring
A successful job notification proves only that a process ran. Restore a representative backup into an isolated environment, log in, check media, pages, forms and database-driven functions, and record the result. For a shop, use test-mode payments and confirm recent orders expected at that recovery point are present.
Know what a WordPress export is not
Tools → Export creates a useful content XML file, but it is not a complete site backup. It does not by itself reproduce themes, plugins, server configuration or every external asset. Use it as an additional portable content copy, not the sole recovery method.
Common backup failures
- The database was backed up but uploads or custom code were omitted.
- Every copy is stored inside the same hosting account.
- Old backups were overwritten before corruption was discovered.
- The archive is encrypted but the key is held only by the former supplier.
- A plugin reports success while the remote destination is full or disconnected.
Build monitoring around these failure modes. The owner should receive a meaningful alert and know who is responsible for repair before the next risky change.
Practical next step
Create one independent full backup now, download it outside the hosting account and schedule a restoration test. Record the recovery point and the person authorised to use it.
Sources and date checked
This guide was checked on 21 July 2026. WordPress, plugins, hosting platforms and commercial terms change, so confirm the current documentation and licence details before making a material change.
Keep the decision under your control
Retain the relevant accounts, source material, supplier terms and recovery information. Recheck changing prices, interfaces and rules before acting.