WordPress Backup: How Often and Where To?

A backup is your website’s insurance – but only if it actually works when it matters. This guide shows how often you should back up your WordPress website, where the backups need to be stored, how long you should keep them, and how to check that restoring really works.

In short: Business websites should be backed up at least daily, online shops with ongoing orders more often. Backups belong in at least one location outside the web server, are kept for 30 days or longer, and are regularly verified by a test restore. The 3-2-1 rule has proven its worth: three copies, two storage types, one of them off-site.

Why is a backup not the same as a restore?

Having a backup does not yet guarantee a working restore. In practice, an emergency often reveals that backups are incomplete, contain only the database, are corrupted, or sit on the very server that has just failed or been compromised. What matters, therefore, is not that backups are made, but that the website demonstrably runs again from the backup.

That is why we distinguish two metrics: How much data may be lost in the worst case (Recovery Point Objective)? And how long may the website be offline at most (Recovery Time Objective)? These two answers determine backup frequency, storage location and restore process.

What must a complete WordPress backup contain?

A complete WordPress backup consists of the database and all files of the installation. If either part is missing, the website cannot be fully restored. These components belong in it:

Database: Pages, posts, settings, users, form entries and, for shops, all orders and customer accounts.
Uploads: Images, PDFs and all other media files in the wp-content/uploads folder.
Plugins and themes: including premium plugins and custom modifications in the child theme.
Configuration: the wp-config.php file and server rules such as .htaccess.
Email mailboxes: If they are with the same host, they are usually backed up separately – clarify whether that happens.

How often should a WordPress website be backed up?

The right frequency depends on how often content and data change. As a rule of thumb: back up at least as often as you can afford to lose data. For most business websites that means a daily backup; for shops and booking systems, more frequent backups of the database.

Website type	Changes	Recommended frequency	Retention
Brochure website	rare	daily, at least weekly	30 days
Business website with blog	weekly	daily	30 days
Online shop	ongoing due to orders	full backup daily, database additionally several times a day	30 to 90 days
Booking or members area	ongoing	full backup daily, database several times a day	30 to 90 days
Before updates and rebuilds	planned change	additional backup immediately beforehand	until sign-off

A practical example: an online shop with 20 orders per day that only backs up at night will, in the worst case, lose a whole day’s order data if it fails in the late afternoon. An additional hourly database backup reduces that loss to at most one hour – with hardly any additional storage needed, because the database usually makes up only a fraction of the total size.

Where should WordPress backups be stored?

Backups must be stored in at least one location outside the web server. If they sit only on the same server, they are lost together with the website in the event of a hardware failure, a hack or termination of the hosting. The 3-2-1 rule has proven its worth: three copies, on two different storage types, one of them at an external location.

Storage location	Advantage	Disadvantage
Same web server	quickly available	lost along with the server in case of failure or hack
Hosting provider’s backup	runs automatically	often short retention, restore usually only via support
External cloud storage	independent of the server, can be automated	one-time setup, ongoing storage costs
Local copy	full control	manual and error-prone

With external storage, pay attention to data protection: backups contain personal data such as form entries or customer accounts. A storage location within the EU, a data processing agreement and encrypted transfer should be a given.

How long should backups be kept?

Keep backups for at least 30 days, for shops preferably 60 to 90 days. The reason: hacks and faulty changes are often only noticed days or weeks later. If you keep only the last three backups, you may then have nothing but already infected copies. Multiple versions make it possible to roll back specifically to the last clean state.

How do you check that restoring works?

Verify backups by regularly performing a test restore – ideally on a staging environment so that the live website remains untouched. This is the only way to spot in time whether files are missing, the database is damaged or the restore process takes longer than expected. Here is how to proceed:

Select a current backup and restore it on a staging environment or test server.
Open the homepage and important subpages and check for display errors.
Log in to the backend and check that content, media and settings are complete.
Test contact forms and, for shops, place a test order.
Note how long the restore took and document the result.
Repeat the test at least quarterly, monthly for shops.

What backup methods are there for WordPress?

There are four common ways to create backups for WordPress: a backup plugin, the hosting provider’s backup, server-level snapshots, and an external maintenance service. They differ mainly in how independent the backup is from the web server and who handles the restore in an emergency.

Method	How it works	Suited for
Backup plugin	A plugin backs up files and database on a schedule and uploads them to cloud storage	Websites with a technically skilled administrator
Hosting backup	The host automatically backs up the entire web space	Basic protection as a second layer
Server snapshot	Image of the entire server at a point in time	Dedicated servers and VPS, fast full restore
Maintenance service	External, monitored backup with tested restore	Companies without in-house IT, shops

Full or incremental backup?

A full backup copies all files and the complete database every time. This is simple, but slow and storage-intensive with large media libraries. After an initial full backup, incremental backups transfer only the changed files. They put less load on the server and allow more frequent backups – provided the chain of partial backups remains intact. Good solutions combine both: regular full backups with incremental versions in between.

Checklist: Is your backup strategy sufficient?

The website is backed up automatically at least daily.
At least one copy is stored outside the web server.
Database and files are backed up completely.
Backups are kept for at least 30 days.
You are notified if a backup fails.
An additional backup is created before every update.
Restoring has been tested within the last three months.
The storage location meets GDPR requirements.

What are the most common mistakes with WordPress backups?

Backups are stored exclusively on the same server as the website.
Only the database is backed up, not the media files.
The backup plugin itself is outdated or deactivated.
Storage space is full, and new backups fail silently.
Nobody has ever tried a restore.
Access credentials for the external storage are not documented.

Frequently asked questions about WordPress backup strategy

Is my hosting provider’s backup enough?

Usually not on its own. Host backups are often kept for only a few days, sit in the same data center, and can often only be restored in full and via support. An additional, independent backup at an external location closes this gap.

Should I create a backup before every update?

Yes. A backup right before the update is the fastest way back if a plugin or theme update causes errors. With professional maintenance, this happens automatically.

How long does a restore take?

For a typical business website, restoring from a complete backup usually takes between 15 minutes and a few hours – depending on data volume, storage location, and whether the procedure has been tested beforehand.

Are backups relevant for data protection?

Yes. Backups contain personal data and are therefore subject to the GDPR. They should be transferred encrypted, stored in the EU and deleted once the retention period expires. A data processing agreement is required with external storage providers.

How many backup versions should I keep?

For a website backed up daily, 30 daily versions are a good standard. For shops, additional weekly or monthly versions that are kept longer are recommended.

Conclusion

A good backup strategy answers three questions: how often, where to and for how long – and it is tested regularly. Daily backups, an external storage location in the EU, at least 30 days of retention and documented restore tests turn blind data backup into reliable protection. Our WordPress Backups include all of this – including verified restoration in an emergency.

Updates, backups and security – handled by us

From €39/month, cancel monthly, hosting-independent.

Start maintenance now Free consultation