"How often should I back up?" is the wrong question. The right question is: how much content can you afford to lose?
The actual rule
Back up before any change you cannot undo, plus on a schedule that matches your content velocity:
- Brochure site that updates a few times a year: weekly backup is enough.
- Blog publishing 1-2 posts a week: daily backup. Losing more than a day of new content is annoying.
- WooCommerce or membership site with daily transactions: hourly database backup, daily full backup. Losing customer orders is unforgivable.
- News site or anything publishing many times a day: real-time database replication plus hourly file backup.
Whatever the schedule, take a manual backup before every WordPress update, every plugin install, and every theme change.
Where backups must live
This is the part most owners get wrong. A backup stored only on the same server as the site is not a backup — it is a coincidence. If the server gets hacked, deleted, or has a hardware failure, you lose the site and the backup at the same time.
The minimum standard is: one off-site copy. Better: 3-2-1 — three copies of the data, two different storage media, at least one of them off-site.
Practical off-site options for WordPress:
- Amazon S3 — about 2.3¢ per GB per month. Reliable, extremely durable.
- Backblaze B2 — about 0.6¢ per GB per month, S3-compatible API.
- Google Drive or Dropbox — fine for small sites, expensive at scale.
- BlogVault, UpdraftPlus Premium, or your host's premium backup service — they handle the off-site storage for you and bundle restore tooling.
The backups you forget to take
People remember to back up files. They forget two equally important things:
1. The database
WordPress files without the database are an empty shell — no posts, no users, no settings. Some backup tools default to "files only" and you do not notice until you try to restore. Always include the database.
2. The hosting account configuration
Email forwarders, DNS records, server-side includes, cron jobs — none of this is in WordPress. If your hosting account is compromised or you have to migrate, you need this configuration documented separately. Take a screenshot of every configuration screen monthly.
The test that proves backups work
A backup you have never restored is hope, not protection. Once a month — every month, no exceptions — restore last week's backup to a staging environment. If the restore fails, fix it now, while the live site is still working.
The most common failure modes:
- The backup completed but was empty (zero-byte file). The backup tool reported success because it wrote the file successfully, not because the file had content.
- The backup is missing the database, or has the database but no files.
- The backup is from before the most recent migration and references the wrong domain or paths.
How long to retain
This depends on the kind of content, but a safe default for most sites:
- Daily backups for the last 14 days.
- Weekly backups for the last 2 months.
- Monthly backups for the last year.
This pattern means you can roll back almost anything — recent mistakes, recent hacks, even a slow corruption that happened 4 months ago and nobody noticed at the time.