Most WordPress “backup” setups are theatre. There’s a plugin installed, a daily cron running, a green checkmark somewhere — and when the site actually goes down, the backup won’t restore. I’ve cleaned up too many of these. Here’s the 2026 disaster recovery playbook that survives a real hack, a fatal update, or a hosting company vanishing.
The 3-2-1 Rule, Applied to WordPress
Three copies of the data. Two different storage media (server disk + cloud object storage counts). One offsite. For a client site: (1) hosting’s built-in backup, (2) plugin-driven backup to S3/B2/Google Cloud, (3) a monthly manual archive on your local drive. If any single system fails, you still have two. This is the minimum for production.
What “Backup” Actually Means
A full WordPress backup = database + wp-content/uploads + wp-content/themes + wp-content/plugins + wp-config.php + .htaccess (or nginx equivalent). Miss any of these and restore is partial. Do not rely on database-only backups — you’ll rebuild the site from screenshots when uploads are gone.
Backup Frequency: Match RPO to Risk
Recovery Point Objective (RPO) = how much data you can afford to lose. Brochure site: 24 hours is fine. Blog with 10 posts/week: 6-hour backups. WooCommerce store: real-time database replication + hourly file backups. Set RPO before picking a backup plugin — the plugin drops out of a lot of shortlists once you require sub-hourly frequency.
Storage Destinations That Work
Backblaze B2 (cheapest per GB, S3-compatible), Wasabi (flat pricing, no egress fees for restore), AWS S3 with Glacier lifecycle (cheapest for long retention), Google Cloud Storage. Avoid Dropbox and Google Drive for site backups — API limits and folder structures fail at scale, and neither is designed for machine-driven restore.
Plugin Stack in 2026
UpdraftPlus (mature, boring, works — pay for Premium for incremental backups). BackWPup (free, S3 destinations built in). WP Time Capsule (real incremental, cheapest per site at scale). Duplicator Pro (best for migration + full-site archives). ManageWP or MainWP if you run 10+ sites. Pick one and standardise across the portfolio — mixed backup tools multiply failure surface.
Hosting-Level Backups: Trust But Verify
Kinsta, WP Engine, SiteGround, Cloudways all offer daily backups. Great as one leg of the 3-2-1 stool. Do not rely on them alone: if the host has a billing dispute, an outage, or you migrate away, those backups vanish. Always maintain an independent copy in your own storage account.
The Untested Backup Is No Backup
Once a quarter, restore a site to a staging environment from the offsite backup. Time it. If restore takes 4 hours and you promised a 1-hour RTO, either commit to faster storage or renegotiate the RTO. Untested backups fail at the worst moment — I’ve seen 18-month-old backup archives that were silently corrupt because no one tried to restore one.
Ransomware and Hack Recovery
When a site is compromised, your backup is only useful if it predates the infection. Malware often sits dormant for weeks. Keep retention long: 7 daily + 4 weekly + 6 monthly minimum. Before restoring, scan the backup itself with Wordfence or MalCare — restoring an infected backup puts you back in the same hole.
After restore: rotate every credential (WP admin, database, hosting, SFTP, all connected services), regenerate salts in wp-config, run a full malware scan, review recently modified files. Change nothing else until the site is verified clean.
Database Failsafes
For WooCommerce or membership sites, add point-in-time recovery via a hosting provider that supports it, or set up MySQL binary logging. This lets you rewind minutes rather than restore hours. It’s the difference between “we lost the last 15 minutes of orders” and “we lost yesterday’s orders and the day before”.
The Documentation That Saves You
Write a one-page runbook per site: where the backups live, the credentials location, the restore steps, the RTO/RPO commitments, and the contact list for hosting and domain registrar. Store it outside the site. When a real incident hits at 2am, you won’t remember which S3 bucket holds the latest full archive — but a colleague reading the runbook will. That’s what turns backup theatre into actual disaster recovery.
