WordPress Backups That Actually Restore

A WordPress site has two halves

A WordPress site is made of files and a database. The files include WordPress itself, your theme, your plugins and everything in the uploads folder, such as images and PDFs. The database holds your pages, posts, settings, users, and for shops, products and orders.

A backup that captures only one half will not restore the site. Database-only copies lose every image. File-only copies lose every page. The WordPress hardening guide recommends regular backups including your databases, kept as regular snapshots of both files and database ^[1].

Choosing a schedule

The question is not "how often is normal" but "how much work could I lose without real harm". A simple way to decide:

These are our suggestions, not a rule from any authority. The Australian Cyber Security Centre's guide simply asks businesses to create and implement a plan to regularly back up their information ^[2], and Business Queensland lists "back up your information" among its basic steps ^[3]. The right frequency is the one your plan can sustain.

Where to store backups

This is where most backup plans fall down. If the only copies live in the same hosting account as the site, an attacker who controls the site may be able to delete or alter them. Copies kept by your host can also disappear if the account is suspended or closed.

A widely used rule of thumb is 3-2-1: keep three copies of your data, on two different types of storage, with one copy away from the main location. For a small business website, that might mean the live site, the host's own backups, and a separate cloud storage account in the business's name.

The WordPress guide also recommends protecting backups, suggesting encryption, keeping hash records, or read-only media ^[1]. In plain terms: make it hard for anyone, including someone who has taken over the site, to change your copies without you noticing.

Keeping enough history

Many break-ins are not noticed for days or weeks. If your backups only go back seven days and the attacker got in three weeks ago, every copy you have contains the problem. Retention should reach comfortably past the time it might take you to notice something is wrong.

Keeping more copies costs storage, but storage is cheap compared with rebuilding a site from scratch.

Testing a restore

A backup is untested until it has been restored. A test restore does not need to touch the live site:

1. Create a private test location, such as a staging site from your host or a temporary subdomain protected by a password.
2. Restore the newest backup there, both files and database.
3. Check that pages load, images appear, you can log in, and forms or checkout work in test mode.
4. Write down every step you took, including where the backup was stored and what credentials were needed.
5. Delete the test site, or keep it locked down if you will use it again.

Repeat this at least twice a year and after major changes, such as a new theme, a host move or a large plugin change.

Choosing the restore point

When you do need to restore, the question is which copy. After a failed update or an accidental deletion, the newest copy from before the problem is usually right. After a hack, it is the newest copy from before the break-in, which may be weeks old. Restoring an older copy means losing anything added since, so export recent orders, enquiries or posts from the current site first, check them, and bring them back after the restore.

Write a one-page restore guide

When a site goes down, the person restoring it may not be the person who set up the backups. A single page that says where backups live, who has access, and the exact restore steps turns a stressful day into a manageable one. Keep a printed or offline copy, because the guide is no use if it lives only on the site that has failed.

What to ask your host about its backups

Host backups are a useful second copy, so it is worth knowing exactly what yours offer. Ask:

• How many days or weeks of copies are kept, and how often they are taken?
• Do they include both the files and every database for the site?
• Can you restore one site, or one database, yourself from the control panel, or does it need a support request?
• Is restoring included in your plan, or is there a fee?
• What happens to the copies if the account is suspended or cancelled?

Write the answers into your restore guide. If the host keeps only a short window, or restores need a support ticket that may take days, that is the strongest argument for a separate copy you control.

What a complete backup set includes

A backup that only holds the database, or only holds the files, will not bring a site back on its own. Before you trust any backup arrangement, open a recent copy and confirm it contains each of these:

• a database export that opens without errors and includes every table, not just the posts;
• the wp-content folder, with themes, plugins and the uploads folder that holds your images and documents;
• the wp-config.php file, or at least a private note of its settings, kept somewhere other than the website;
• any custom files at the top of the site, such as verification files, redirects in .htaccess or a custom robots.txt;
• a short note of the WordPress, PHP and plugin versions that were running when the copy was taken.

The version note matters more than it seems. If you restore an old copy onto a server running a much newer PHP version, a plugin that worked at the time may fail, and the site can look broken when the backup itself is fine. Knowing the versions lets you, or whoever helps you, work out quickly whether the problem is the copy or the server.

Keep the set together. Files from Monday and a database from Thursday rarely line up, because pages, orders and image links in the database point at files that may not exist in the older copy. A matched pair from the same moment is the unit to keep.

Using backups after a hack

When a site has been hacked, do not reach for last night's backup straight away. First work out when the break-in began, then choose the newest backup from before that point. Copy the damaged site first, so recent orders and content can be checked and brought forward. Our recovery service follows that process, and our backup service sets up everything on this page for you.