Every WordPress site needs automatic, off-site backups that you’ve actually tested restoring. Backup plugins are the easiest way to get there: they schedule backups of your database and files, and send them to cloud storage. Here’s how the popular options compare, what to look for, and when a server-level backup is better.

What a good backup setup needs

  • Both parts: the database (posts, settings, users) and wp-content (uploads, themes, plugins).
  • Off-site storage: a backup on the same server disappears with the server.
  • A schedule that matches how often content changes (daily for most sites; more often for shops).
  • Retention: keep several versions. Malware or a bad edit is often discovered days later.
  • Tested restores.

See backup strategy (3-2-1).

Plugin Free version Remote storage (free) Incremental Restore / migrate Notes
UpdraftPlus Yes Many (S3, Google Drive, Dropbox, FTP…) Paid add-on Restore in WP; migration is paid Most popular
BackWPup Yes Many (S3, Dropbox, FTP…) No Restore is paid (Pro) Good for scheduled archives
WPvivid Yes Several cloud options Paid Restore and migration in free version Includes staging (paid)
Duplicator Yes Paid for cloud Paid Excellent for migrations Installer-based packages
BlogVault No Its own cloud Yes Off-site restore, staging Backups run on their servers
Jetpack VaultPress Backup No Its own cloud Real-time One-click restore Automattic service

Features and plans change. Check current details before you choose.

Configuring a plugin well (UpdraftPlus example)

  1. Settings → UpdraftPlus Backups → Settings.
  2. Files backup schedule: daily (or weekly for static sites), and retain 14.
  3. Database backup schedule: daily or every 12 hours for active sites, and retain 30.
  4. Remote storage: an S3-compatible bucket (AWS, Backblaze B2, Wasabi, your own MinIO), Google Drive, or SFTP to another server. Use credentials limited to that bucket or folder.
  5. Exclude caches and other backup folders (wp-content/cache, other plugins’ backup directories) to avoid huge archives.
  6. Run a backup now, and check that it arrives in remote storage.

S3 setup with your own storage: see MinIO object storage and storage VPS.

Test a restore

At least every few months:

  1. Spin up a test site (a staging subdomain, or a small VPS). See WordPress staging site.
  2. Install WordPress plus the backup plugin, connect the same remote storage, and restore.
  3. Check pages, images, logins and forms.

Limitations of plugin backups

  • Backups run through PHP and WordPress. On large sites they can time out, use lots of memory, or slow the site while running.
  • If the site is broken (fatal error, hacked, database down), the plugin might not be able to run its own restore. Then you restore manually, from the archive files.
  • Plugins can’t back up things outside WordPress: server configs, other sites, cron jobs.

Server-level backups (VPS)

On a VPS you can back up outside WordPress, which is more robust for big sites. Use plugins and server backups together, or server backups alone:

Security notes

  • Backups contain your database, including user emails and password hashes. Protect remote storage with strong credentials, and encrypt where the plugin supports it.
  • Don’t store backups in a publicly reachable folder (for example a predictable path under wp-content) without protection. Check that your plugin denies web access.
  • Delete old backups from the server’s disk once they’re uploaded.

Quick reference

Need Good choice
Free, scheduled, cloud storage UpdraftPlus, BackWPup, WPvivid
Migrating to a new server Duplicator, WPvivid
Real-time, hands-off (paid) Jetpack VaultPress, BlogVault
Large sites, full control Server-level dumps + restic/Borg

Related: WordPress update safely and WordPress VPS hosting.

  • WordPress
  • Backup
  • Plugins