WordPress Backup Plugins Compared, and How to Set One Up Properly

A WordPress backup plugin is the least visible part of a website and one of the most important. While nothing goes wrong, you barely notice it exists. When something does go wrong, that plugin decides whether you are back online in ten minutes or spending the next few days reconstructing posts, orders and member records from memory. This article covers why backups matter, how the 3-2-1 rule works, which plugins are worth a look, and how to set one up rather than just switch it on and hope.

What actually goes wrong

Most site owners think about backups after the first incident. There are at least three situations that reach every WordPress site eventually.

Hacks and malware

WordPress is the most used CMS in the world, which makes it a standing target. An outdated plugin, a weak password or a hole in a theme is often enough for malicious code to get in. Without a clean backup you are left cleaning a database that is already compromised, which is slow work and rarely complete. You never quite know whether you got all of it.

Updates that fail

The WordPress core, themes and plugins update constantly. That is good for security, because updating WordPress plugins is what closes flaws that are already public, and it carries its own risk. An incompatible plugin version, a theme update that collides with a page builder, or a jump to a new PHP version can take a site down in seconds. With a current backup that is a setback of a few minutes. Without one it turns into a day of guesswork.

Hosting outages

Reputable hosts still have server failures, botched migrations and, rarely but genuinely, complete data loss. If your only plan is that the host takes care of it, you have handed control of your own data to someone else. An independent backup of your own is the one piece of insurance that actually belongs to you.

The 3-2-1 rule, applied to WordPress

Classic IT backup practice has a simple rule of thumb that transfers to WordPress without any changes:

• 3 copies of your data: the original plus at least two backups, not just one.
• 2 different kinds of storage: for example not only on the hosting server, but also in cloud storage or locally.
• 1 copy off the hosting server: because a backup sitting in the same directory as the website is gone with the site when the server is.

The last point is the one people skip. A backup stored locally on the server protects you against a broken update. It does not protect you against a hosting outage or against an attacker who has the whole server. Off-site storage, whether that is cloud storage, a separate server or a download to your own machine, is the actual core of a working backup strategy rather than a refinement of it.

The usual options, fairly compared

There are a lot of WordPress backup plugins and, honestly, none of them is doing anything fundamentally wrong. The differences are in the handling, the storage targets, the restore process and what each plugin was originally built for. Here is where each one sits.

UpdraftPlus

One of the most installed backup plugins there is, and a solid all-rounder for regular automated backups.

• Strengths: a very wide range of cloud storage connections including Google Drive, Dropbox and S3, straightforward scheduling, and a user base big enough that any problem you hit has been written about already.
• Weaknesses: the free version covers the basics, while a lot of the comfortable restore and migration features sit behind the paid premium version.

Duplicator

Less a specialist in ongoing automatic backups and more a tool for cloning and moving whole WordPress installations.

• Strengths: excellent at transferring a complete site one to one onto a new server or a new domain, producing a package of files and database together.
• Weaknesses: automatic schedules and cloud connections are more limited in the free version than with the dedicated backup tools. For daily safety backups it is second choice, for migrations it is strong.

BackWPup

Another established classic with a solid feature set.

• Strengths: flexible backup jobs, connections to various cloud services and FTP servers, and good control over exactly what gets saved.
• Weaknesses: the interface feels more technical and less tidy than some alternatives, so beginners need longer to get it configured.

All-in-One WP Migration

As the name suggests, the focus here is migration rather than ongoing safety backups.

• Strengths: a very simple export and import workflow, handy for moving between hosts or between a staging and a live environment.
• Weaknesses: file size limits in the free version become an obstacle on larger sites, and automated schedules are not a core feature of the free plugin.

Backups from your host

Many hosts offer their own backup service, sometimes automatic, sometimes as a paid add-on.

• Strengths: convenient, often without any extra plugin, and it runs server side so it costs your site nothing in performance.
• Weaknesses: this is exactly where the 3-2-1 rule bites. A backup held only at the same host is not an independent copy. If you lose access to the hosting account, or the host has a larger incident, the backup can be caught up in it too.

Setting a backup up, step by step

Whichever plugin you pick, the sequence is much the same.

1. Install and activate the plugin. Search for it under Plugins and Add New, then activate it.
2. Choose a storage target. Deliberately pick somewhere external: Google Drive, Dropbox, S3 or another cloud service. Do not leave backups sitting only on the server.
3. Check the scope. A complete backup has two parts, the database with your content, settings and user records, and the files with uploads, theme and plugins. Make sure both are included. A file backup without the database is worthless in an emergency.
4. Set a schedule. More on how often in the next section.
5. Run one manually. Trigger a first backup by hand instead of waiting for the next scheduled run to tell you whether it works.
6. Test the restore. This is the most important step and the one people skip. A backup you have never restored is a bet rather than a safety net. Use a staging environment or a separate test install and put the backup back there once. Only after a restore has demonstrably worked can you rely on it.

How often to run it

The right schedule depends on how often your site changes:

• A company site with no shop: a weekly backup is usually enough.
• A blog with regular new posts: daily database backups, files less often.
• A shop or a membership area with ongoing transactions: daily, and with high order volume several times a day, because new business critical data is being created constantly.

Retention matters as much as frequency. Keep several generations of backups instead of only the most recent one. Problems often surface a few days after the change that caused them, and if the only backup you have already contains the problem, it is not much use.

The part membership sites get wrong

If your WordPress site runs a membership area or online courses, a data loss costs you more than posts. It costs member records, course progress and the record of who paid for which access. Plugins that keep this information in their own database tables cannot be covered by a file backup. The backup strategy has to include the complete database, not just uploads and theme files.

That applies to every membership or course solution regardless of vendor. With our own plugin MemberJet it is not a cause for concern, but it is worth saying plainly: MemberJet is not a backup plugin and does not replace one. It is a free, lean membership plugin with a native Digistore24 connection, and its data sits locally in its own manageable tables inside your normal WordPress database. Any decent backup plugin that saves the whole database picks that up cleanly and completely, with no separate cloud service you have to remember. For how a membership area and Digistore24 fit together in the first place, see setting up Digistore24 IPN in WordPress, and if you also sell courses, create an online course in WordPress covers that side. A comparison with a well-known alternative is in MemberPress alternative.

No backup plugin here is a wrong choice

For most sites the rule is simple: a plain backup that runs regularly and has been tested beats the perfect solution that never gets configured. UpdraftPlus and BackWPup suit ongoing automated backups with an external storage target. Duplicator and All-in-One WP Migration are at their best for moves and clones. Host backups are a sensible extra layer, and because of the 3-2-1 rule they are not a full substitute for an independent off-site copy.

What matters more than the choice of plugin is the discipline behind it: a realistic schedule, an external storage target and, without negotiation, a restore you have actually tested. If you want a hand setting that up around a membership area, get in touch or take a look at our pricing.

Common questions about WordPress backups