WordPress Backup Strategy Before Disaster Strikes

Originally published on the Bug Circuit blog.

Back up your WordPress site automatically at least once a day (hourly or real-time if you take orders or leads), store copies offsite in at least two separate places, and actually test a restore every few months — a backup you've never restored isn't a backup, it's a guess.

This is for small business owners and site admins running WordPress — a shop, a blog, a local service site, an agency's client sites — who don't have an IT department and want a backup routine that will genuinely save them the day something goes wrong. You'll get a realistic cadence by site type, the "3-2-1" rule explained in plain terms, a short plugin comparison, and the exact steps for a disaster-recovery test you can run this month.

How often should you back up your WordPress site?

The honest answer is "it depends on how much you'd lose if today's backup were the last one you ever had." Work backward from that.

Site type	Backup frequency	Keep how long
Static/brochure site, rarely edited	Weekly	4 weeks
Blog or content site, posting regularly	Daily	30 days
WooCommerce store, bookings, or lead-gen forms	Real-time or hourly	30–90 days, plus a few monthly archives
Site under active development	Before every deploy, plus daily	Keep at least the last 5 releases

If you can't answer "what changed on my site since the last backup?" without checking, you're backing up too rarely. For a store taking orders all day, losing 24 hours of data means losing 24 hours of orders and customer records — that's the real cost, not an abstraction.

Do I need offsite backups?

Yes — a backup stored only on the same server as your live site isn't a real backup. If your host has an outage, your hosting account gets suspended, or an attacker gets into your WordPress admin, a local backup sitting in the same environment can be deleted, encrypted, or corrupted right along with everything else.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) makes this explicit in its ransomware guidance: organizations should "maintain offline, encrypted backups of data and regularly test your backups," specifically because attackers who get administrative access will look for and destroy backups they can reach (CISA #StopRansomware Guide). WordPress.org's own backup documentation makes the same point for site owners specifically — backups should live somewhere separate from the hosting account they protect (WordPress.org: WordPress Backups).

"Offsite" in practice means cloud storage that isn't tied to your hosting login — Dropbox, Google Drive, Amazon S3, or a backup service's own storage. Most backup plugins can push there automatically, so this isn't a manual chore once it's set up correctly.

The 3-2-1 rule, adapted for WordPress

CISA's data backup guidance popularized the 3-2-1 rule, and it maps cleanly onto a WordPress site:

• 3 copies of your data — the live site, plus at least two backups.
• 2 different storage types or locations — e.g., your host's built-in backup and a separate cloud storage account.
• 1 copy offsite — physically and logically separate from your hosting account, so a compromised host or hosting login can't take it out too.

For most small WordPress sites, a workable version looks like: your host's daily snapshot (convenient, fast to restore, but tied to your hosting account) + a backup plugin pushing a second copy to Dropbox or S3 on its own schedule, using its own login credentials.

Building a disaster recovery plan for a small WordPress business

A "disaster recovery plan" sounds like something only enterprises need, but for a small site it can be one page. NIST's contingency planning guidance frames it as answering four questions before you need the answers under pressure (NIST SP 800-34: Contingency Planning Guide):

1. What are we protecting? List the site's database, uploads/media folder, theme, plugins, and any files outside the CMS (invoices, exported leads, custom scripts).
2. Where do backups live, and who can reach them? Write down the storage location and who has the login — not just "the plugin handles it."
3. Who restores it, and how? Name a person (even if it's just you) and write the restore steps, including your host's support phone number or chat link.
4. How long can the site be down, and how much data can you afford to lose? These are two different numbers — recovery time and recovery point — and they should drive your backup frequency from the table above.

Put this on a single page in a shared doc. If you ever get hacked, you will not want to be researching your own backup setup while the site is down — check out this walkthrough on what actually happens (and what it costs) when a website gets hacked for a sense of how fast that clock runs.

What a real disaster-recovery test looks like

A backup file sitting in cloud storage tells you it exists — it doesn't tell you it works. Untested backups fail silently: a missing database table, an expired storage API key, a backup that only captured files and not the database (or vice versa). Test the restore, not just the backup job.

Here's a test you can run in under an hour, ideally every quarter:

1. Spin up a throwaway environment. Use a local tool like LocalWP, a free subdomain, or your host's built-in staging feature — never test a restore on your live site.
2. Pull your most recent offsite backup, not a fresh one — you want to know the backup you'd actually reach for in a real incident is good.
3. Restore both pieces: the database (via your plugin's restore button, or wp db import backup.sql with WP-CLI) and the files (theme, plugins, uploads).
4. Log in and check the details: does the homepage load without errors? Can you log into wp-admin? Are the last few orders, posts, or form submissions actually there?
5. Time it. Write down how long the whole restore took — that's your real recovery time, not the number on the plugin's marketing page.
6. Fix what broke, then repeat the test next quarter. A DR plan that's never been rehearsed is a guess wearing a plan's clothing.

Backup plugin options compared

Tool	Offsite storage	Automatic schedule	Best for
UpdraftPlus	Yes (free tier: Dropbox, Google Drive, S3, etc.)	Yes, on a schedule you set	Budget-friendly sites wanting real offsite storage without a subscription
Jetpack VaultPress Backup	Yes, built-in (paid)	Real-time, as changes happen	WooCommerce stores where losing even an hour of orders matters
BlogVault	Yes, built-in (paid)	Real-time or daily	Agencies managing several client sites from one dashboard
Duplicator	Manual export to your own storage	Manual on the free version; scheduled on Pro	One-off migrations and snapshots before a big change
Host-level backups (managed WordPress hosts)	Usually tied to the host's own storage	Yes, daily	A second layer — pair with a plugin backup for true offsite redundancy

None of these is "set and forget forever." Whichever you choose, put the quarterly restore test in a calendar reminder — that's the step people skip, and it's the one that actually matters.

Key takeaways

• Match backup frequency to how much data you'd lose: weekly for a static site, daily for a blog, real-time or hourly for a store or lead-gen site.
• A backup stored only on your hosting account isn't offsite — use the 3-2-1 rule: 3 copies, 2 storage types, 1 copy offsite.
• Write your disaster recovery plan down as one page: what's backed up, where it lives, who restores it, and your acceptable downtime.
• Test a full restore in a staging environment at least quarterly — an untested backup can fail exactly when you need it.
• Backups protect your data after an incident; they don't stop the incident. Pair a solid backup routine with a free passive security check or a manual audit to catch the vulnerability before it's used.

Backups are your insurance policy — they won't tell you how someone could get in. If you want that answer, Bug Circuit's Circuit audit is a real person manually reviewing your WordPress site for $49, with a written report of every issue found, severity, and the exact fix. It's not a substitute for backups, and it's not a compliance certification — it's the honest next step once your safety net is actually in place.