Most sites that lose data had a backup plugin installed. The plugin was not the problem.
Where the backups were stored, whether they were still running, and whether anyone had ever restored one were the problems.
This covers the failure modes first, then the tools, because choosing a plugin is the easiest part of this and the least important.
Why Most Backups Fail Quietly
Backup plugins run inside WordPress. That single fact explains nearly every failure.
Because they run inside WordPress, they depend on WordPress cron actually firing, which on a low traffic site it often does not. They can break when WordPress updates. They can conflict with another plugin. And when any of that happens, nothing tells you. There is no alert, no red banner, no email. The site keeps working and the backups quietly stop.
The people who write about maintaining sites for a living describe the same scenario repeatedly: someone installs a backup plugin, sees a green checkmark, assumes they are covered, and discovers years later that the last successful backup was from 2 years ago.
Go check right now. Open your backup plugin and look at the date of the last successful backup. Not the schedule, the actual completed backup. This takes 30 seconds and a surprising number of people are about to have a bad afternoon.
The Same-Server Trap
This is the one that turns an inconvenience into a disaster.
Unless you deliberately configure cloud storage, most backup plugins save your backups to the same server as your website, usually inside your WordPress folder. That protects you from a bad plugin update. It protects you from nothing else.
If the server fails, the backups fail with it. If the account is suspended, you lose access to both. If the site is compromised, the attacker has your backups too, and ransomware operators specifically look for local backup folders. Backups on the same server as the site are not a second copy. They are the same copy in a different folder.
This is also the most common configuration in the wild, because it is the default and the setup wizard does not insist.
The 3-2-1 Rule
The industry standard, and it is simple enough to check in a minute.
- 3 copies of your data, including the live site
- 2 different storage types
- 1 copy stored off-site, meaning somewhere your web server cannot reach
For a typical WordPress site that means the live site, an automated backup going to Google Drive, Dropbox or Amazon S3, and ideally a periodic manual copy you download and keep yourself. If all 3 of your copies are on your host’s infrastructure, you have 1 copy in 3 places.
How Often You Actually Need Them
Daily is the minimum standard for a business site, with at least 30 days of retention. Weekly is the absolute floor and not something worth recommending.
Retention matters as much as frequency and gets far less attention. If you keep 7 days of backups and discover a problem 3 weeks after it started, every copy you hold already contains the problem. Thirty days is the sensible minimum, and a monthly archive kept for a year costs almost nothing in storage.
Real-time backups, which capture every change as it happens, are worth paying for in exactly 1 situation: when your site is the only record of data you cannot recreate.
A store taking orders, a booking system, a membership site. If your content lives in a document somewhere and could be re-uploaded in an afternoon, daily is enough. More on the store side under e-commerce web design.
Plugin, Host, or Service
3 genuinely different approaches, and most people only consider the first.
Backup plugins
Free or cheap, and you control where the files go. They run inside WordPress, so they carry every failure mode described above, and they consume your server’s resources while running.
Best when you have your own cloud storage and will actually check on them.
Your host's backups
Many hosts run server level backups, which do not depend on WordPress working at all. The critical questions are whether you can access and restore them yourself without opening a support ticket, how far back they go, and whether they are stored off your server.
If the answers are good, a plugin adds overhead and another dependency for no gain. Worth asking before you install anything, and covered in our guide to WordPress hosting providers.
Dedicated backup services
Services like BlogVault and Jetpack VaultPress Backup run the backup process on their own infrastructure rather than yours.
Nothing to configure, no server load, and they keep working when WordPress is broken, which is the moment you need them most. You pay monthly for that.
The Plugins Worth Using
UpdraftPlus, free with premium from about $70 a year
Installed on over 3 million sites and the safe default. The free version does scheduled backups, remote storage to Google Drive, Dropbox, Amazon S3 and FTP, and one click restore, which is more than most paid competitors give away.
Where it fails: no real time backups, only scheduled snapshots. It can time out on sites over about 4 GB, and it can produce silent partial backups. Do not trust the green checkmark alone, check the backup log.
Best for: most sites, if you configure remote storage on day 1 and check it monthly.
Jetpack VaultPress Backup, from about $4.95 a month
Formerly VaultPress. Runs entirely on Automattic’s infrastructure, so it puts no load on your server and keeps working when your site does not. Daily backups with a 30 day archive at the entry tier, real time on higher tiers. Restore is the smoothest of any option here, including restoring individual posts.
Where it fails: no Multisite support, and the per site cost adds up if you manage several.
Best for: people who want it handled with zero configuration, and stores that need real time.
BlogVault, premium only
Backups run off-site on their servers with incremental syncing, so large sites do not re-upload everything nightly.
The strongest restore record of the group and the usual recommendation for anything over about 1 GB or running WooCommerce. It also offers test restores natively, which almost nothing else does.
Best for: stores and sites where a failed restore would be a genuine business event.
BackWPup, free with premium
A genuinely capable free tier with scheduled full site backups, database only jobs, and remote storage to Dropbox, S3, Google Drive, FTP and email. Less polished than UpdraftPlus, and a reasonable alternative if you prefer it.
Best for: a free option with real remote storage, particularly on Multisite.
Tools That Are Not Backup Tools
Two names appear on nearly every backup list and belong on a migration list instead.
Duplicator Lite has no scheduled backups and no cloud storage. It packages a site so you can move it, which is genuinely useful, but a manual package you have to remember to create is not a backup strategy. The free version can also fail silently on scheduled runs above a certain size.
Migrate Guru is a migration tool. It moves sites between hosts extremely well. It is not designed to be your ongoing backup.
Also worth knowing: All-in-One WP Migration’s free import limit of 512 MB is real, and finding out at the point of restore is an expensive way to learn it.
How to Test a Restore
A backup is only worth what its last successful restore proved. Most people have never done one, which means most people have an untested assumption rather than a backup.
- Create a staging site. Most decent hosts include a 1-click staging environment. If yours does not, that itself is worth knowing.
- Restore your most recent backup onto it, not onto your live site.
- Check 5 things: the homepage loads, a form submits, images appear, the admin login works, and recent content is present.
- Note how long it took. If the answer is 4 hours, that is your real recovery time, and it is worth knowing before an emergency rather than during one.
- Delete the staging site and put a reminder in your calendar to repeat this quarterly.
Quarterly is the sensible cadence. Once a year is better than never, which is where most sites currently sit.
What Backups Do Not Cover
Backups restore your site to a previous state. They do not do any of the following, and assuming otherwise is a common and costly mistake.
- They do not remove malware. If your site was compromised 3 weeks ago and you restore from last week, you restore the compromise. You need to know when the infection started, which requires monitoring you probably do not have.
- They do not fix the cause. Restore after a bad plugin update and the same update will break it again next month.
- They do not include your email if it is hosted with your web host. Different system, separate backup.
- They do not cover your domain registration. An expired domain cannot be restored from a site backup.
- They do not protect against you. Deleting a page and not noticing for 45 days means every backup you hold is missing that page.
What to Do Right Now
4 things, in order, and all of them free.
- Check the date of your last successful backup. Not the schedule. The last completed one.
- Check where it is stored. If the answer is your own server, fix that today by connecting cloud storage.
- Check your retention. If it is under 30 days, extend it.
- Do 1 test restore onto staging. If you have never done this, you do not yet know whether you have backups.
If that list sounds like something you will genuinely never get around to, that is a fair assessment and a common one. Backups are the maintenance task with the worst ratio of importance to interest, which is exactly why they are part of a care plan along with updates and monitoring.
Common Questions
Does WordPress have built-in backups?
No. WordPress core includes no backup functionality at all. Any backups you have come from a plugin you installed, a service you subscribed to, or your hosting provider. If you have never set one up and your host does not include them, you currently have none.
What is the best free WordPress backup plugin?
UpdraftPlus, with BackWPup a close second. Both offer genuinely usable free tiers with scheduled backups, off-site cloud storage and working restores. The important step is connecting remote storage during setup, because without that the free tier saves backups to the same server as your site.
How often should I back up my WordPress site?
Daily for a business site, with at least 30 days of retention. Weekly is the floor and not recommended. Real time backups are only necessary when your site holds data you cannot recreate, such as orders or bookings, where losing a few hours of records means losing actual transactions.
Where should WordPress backups be stored?
Somewhere your web server cannot reach. Google Drive, Dropbox, Amazon S3 or your backup provider’s own infrastructure. Backups stored in your WordPress folder disappear with the server, are inaccessible if the account is suspended, and are visible to anyone who compromises the site.
Are my host's backups enough?
Sometimes. Ask 3 questions: can you restore them yourself without a support ticket, how many days do they retain, and are they stored off your server. If all 3 answers are good, you may not need a plugin at all. If your host cannot answer clearly, assume the backups are not something to rely on.
How do I know if my backups are actually working?
Restore one. There is no other way to know. Check the last completed backup date monthly and run a test restore to a staging site quarterly. A plugin reporting success is reporting that a process finished, not that the resulting file is complete and restorable.
The Short Version
The plugin matters least. What matters is that backups are running, stored somewhere your server cannot reach, kept for at least 30 days, and restorable, which you only know because you have tried.
Most sites fail on the second and fourth. Go and check yours, it takes 5 minutes, and it is the highest return 5 minutes available on your website today.
