WordPress Backups Done Right – and Testing the Restore

Backups are every website’s life insurance – and at the same time the area where most sites are secretly poorly set up. The most common mistake isn’t failing to back up at all, but relying on backups that don’t work when it counts.

What a Complete Backup Includes

A WordPress backup is only complete if it covers both parts:

• Files: the entire /wp-content/ folder (themes, plugins, uploads) plus wp-config.php.
• Database: the whole content – posts, pages, settings, users, WooCommerce orders.

If either part is missing, the site can’t be restored cleanly. A database-only export without the uploads gives you the text back but no images; a file backup without the database gives you the structure but no content.

How Often to Back Up

That depends on how often things change:

• Static site (rare changes): weekly is often enough.
• Active blog/editorial: daily.
• WooCommerce shop: at least daily, more often with many orders – because every lost hour means lost orders.

Plus: always make a fresh backup before every update – especially before a major release.

The 3-2-1 Rule

A proven principle: three copies, on two different media, with one off-site. A backup that sits on the same server as the site is gone too in a server failure or hack. Keep at least one copy in an external location – cloud storage, a second server or a GDPR-friendly German provider.

The Most Important Step: Test the Restore

This is where most backup strategies fail – not at backing up, but at restoring. A backup you’ve never restored is a guess, not security. Test the restore regularly, ideally into a staging environment, where you can safely check whether the backup really produces a working site. Only a backup that has been successfully restored once is a real backup.

What a Backup Isn’t

A backup doesn’t replace security. It helps you after an incident, but doesn’t prevent it. Two pitfalls that are often overlooked:

• A backup of an already-hacked site restores the hack along with it. If malware has been sitting there unnoticed for weeks, the backups are infected too. That’s why a sufficient retention period matters – see below – and, in an emergency, targeted cleanup instead of a blind restore.
• A backup without monitoring helps little if no one notices something is broken. Backup and monitoring belong together.

Practical Implementation

• Use an established backup plugin or your host’s backup function – ideally both as two layers.
• Automate it – manual backups get forgotten.
• Set a retention period (e.g. the last 30 days), so even a late-noticed hack still has a clean version.
• Run through the restore in full at least once – and again at intervals afterwards.

Exactly this trio of a complete backup, an external copy and a tested restore is part of any serious WordPress maintenance.

---

Want to be sure your backups actually work when it counts? Drop us a line – we’ll set up backups and a tested restore.