The 3-2-1 Backup Rule: How to Back Up Your WordPress Website Properly
Most website owners think their host's backups are enough — until they need them. Here is how to set up WordPress backups you can actually restore from.
Websites break. A plugin update goes wrong, a hacker gets in, someone deletes the wrong page, or a hosting account is suspended. When that happens, the only thing that matters is whether you have a recent backup you can restore quickly.
Many site owners assume their hosting company has it covered. Sometimes it does. But host backups are often kept for a limited time, stored on the same infrastructure as the site, or only restorable by support ticket. This guide shows you how to set up backups you control.
In this article
The 3-2-1 backup rule
The 3-2-1 rule is the standard for data protection, and it works well for websites:
- 3 copies of your data: the live site plus two backups.
- 2 different storage types or locations, so one failure cannot destroy both.
- 1 copy off-site, away from your hosting company entirely (for example Google Drive, Dropbox, Amazon S3 or Backblaze B2).
For a typical WordPress site, that means: your live site, your host's automatic backups, and your own backups sent automatically to cloud storage.
What a WordPress backup must include
A WordPress site has two parts, and you need both:
- The database — all your posts, pages, comments, users and settings.
- The files — the
wp-contentfolder (themes, plugins and uploaded images), pluswp-config.phpand any custom files such as.htaccessorads.txt.
A backup of only the database loses all your images. A backup of only the files loses all your writing. Check that your backup tool captures both.
How often should you back up?
Match backup frequency to how much work you could stand to lose:
| Type of site | Database | Files |
|---|---|---|
| Blog publishing a few times a week | Daily | Weekly |
| Busy blog or site with many comments | Daily or more often | Daily |
| Online shop with orders | Hourly or real-time | Daily |
| Brochure site that rarely changes | Weekly | Weekly |
Always take a manual backup immediately before updating WordPress, your theme or major plugins.
How long to keep backups
Keep at least 30 days of history. This matters more than people expect: hacks are often discovered days or weeks after they happen, and if you only keep three days of backups, all of them may already be infected.
Setting up automatic backups
Option 1: A backup plugin
Plugins such as UpdraftPlus, BlogVault, Jetpack VaultPress Backup and Duplicator can schedule backups and send them to cloud storage. A typical setup:
- Install the plugin and open its settings.
- Set a schedule for files and database separately (see the table above).
- Connect a remote storage destination such as Google Drive or Dropbox.
- Set how many backups to retain.
- Run the first backup manually and confirm the files appear in your cloud storage.
On shared hosting, choose a plugin that splits large backups into chunks, as big sites can hit server time limits.
Option 2: Your hosting control panel
Most hosts offer automatic daily or weekly backups and a one-click restore. Find out exactly how long they are kept and whether you can download them. Treat these as your second copy, not your only copy.
Option 3: Manual backups
Export the database from phpMyAdmin and download wp-content via the file manager or FTP. This is good to know how to do, but anything manual eventually gets forgotten. Automate wherever you can.
Protect the backups themselves
- Use a separate account for cloud storage with two-step verification switched on.
- Do not store backups in a public web folder. A backup zip sitting in your site's root directory can be downloaded by anyone who guesses its name, and it contains your database credentials.
- Remember they contain personal data (user emails, comments). Store them as securely as the site itself.
Test your restore — the step everyone skips
A backup you have never restored is a hope, not a plan. At least every few months:
- Create a staging site (many hosts offer one-click staging) or a local copy using a tool like LocalWP.
- Restore your latest backup into it.
- Check that pages load, images appear and you can log in.
- Write down how long it took and any problems.
Doing this once when nothing is wrong makes a real emergency far less stressful.
If your site breaks right now
- Do not start changing things at random. Note what happened just before (an update, a new plugin).
- If it was an update, restore the backup taken just before it.
- If you suspect a hack, restore from a backup dated before the infection, then immediately update everything and change all passwords (WordPress admins, hosting, FTP and database).
- If you have no usable backup, contact your host's support right away; they may have a copy you can use.
A simple backup checklist
- Automatic backups of database and files: on.
- Copies stored off-site in cloud storage: yes.
- At least 30 days retained: yes.
- Manual backup before every major update: habit formed.
- Restore tested in the last three months: done.
Set this up once and it runs quietly in the background. The day you need it, it will be the best hour you ever spent on your website.
