A backup you have never restored is not a backup
Ask a site owner whether they have backups and the answer is usually yes. Ask when they last restored one and the answer is usually silence. A backup only has value at the moment you restore it, and that is the worst possible moment to discover it does not work.
The 3-2-1 rule
This is a long-standing rule from IT practice, and it applies neatly to websites:
- 3 copies of your data
- on 2 different kinds of storage
- with 1 copy kept off-site
For a WordPress site, that typically means the live site, a backup held by your host, and a separate copy in independent cloud storage that your host cannot touch.
The most common mistake
Storing backups on the same server as the website. If the server fails, the account is suspended, or an attacker gains access, the site and its backups disappear together.
A WordPress backup has two halves
A complete backup needs both:
- The database, which holds your pages, posts, orders, users and settings
- The files, which hold your uploads, theme and plugins
One without the other will not rebuild your site.
How often is enough
It depends on how much you can afford to lose. A brochure site that changes monthly is fine with a daily backup. A shop taking orders every hour is not, because restoring last night’s copy would erase today’s orders. Match the frequency to how quickly your content changes.
Test the restore
This is the step almost everyone skips. On a schedule, take a backup and restore it to a staging site. Check that it loads, that you can log in, and that recent content is there. It takes a few minutes and it is the only way to know.
The goal is not to have backups. The goal is to be able to restore.
Restore testing is part of every maintenance plan we run, for exactly this reason.