WordPress Backup Checklist

If your site ever gets toasted, after you stop screaming, you’ll want an easy way to fully restore it.

Your backup is THE last safety net in your site security, and may be the only way to get your site up and running again if it gets hacked or fried.

Follow this quick checklist to be sure your backup includes everything you need to save your site, and that you are prepared to restore it.

Identify Your Backup Method and Storage

Answer these quick questions:

1. What backup plugin or service are you using?
2. Where are your files stored?
3. How many backups, and over what timeframe, do you have?
   In other words, do you have 30 daily backups stored for 1 month, or 50 weekly backups stored for at least a year?

Frequency of Backup

How often do you need to back up your site?

That depends.

How much can you afford to lose?

• If you’re blogging once or twice a week, then you will only lose 1-2 posts and their comments if you backup weekly.
• If you have a transactional site, like e-comm or a member site, then you can’t afford to lose a single day. You need to be backing up daily.

Keep in mind that taking a backup can put a load on your hosting resources.

So, you want to backup as frequently as needed, but no more than necessary.

How Many Backups Do You Need to Keep?

That depends too.

The minimum is a month’s worth.

So, if you are backing up weekly, that would be 4 backups. If you’re backing up daily, that would be 30.

Can your storage handle enough backups?

Free storage solutions commonly have a limit of 5GB. That may not be enough to hold the minimum number of backups you need.

That’s why I use and recommend Amazon S3 for backup storage.

READ: Setup Amazon S3 Account for Backup and Media Storage

Files Outside WordPress

Is your backup getting everything you need?

There are several files in the public_html folder that are below WordPress, but are critical to your site’s function and involve things like your HTTPS directives and security. These files need to be included in your backups, or you need to manually download them at least once a year.

Those files include, but are not limited to:

• .htaccess
• robots.txt
• 3^rd party verification files (like Pinterest and Google)

You may also have theme related files loose, like:

• Favicon
• Social media icon set

Check Your Files by Backup Method

• If you are using a 3^rd party service like VaultPress, or the free version of UpdraftPlus, you are likely not getting anything outside of WP and the database.
• If you are using the paid version of UpdraftPlus or BackupBuddy, do you have them set to get files outside WP that you need?

How Does Your Restore Work?

WordPress is not friendly about having itself overwritten. The database is not too crazy about it either.

Many restore processes require that you:

• completely delete your WordPress files and database
• create a new database and install WordPress anew
• run the restore

Some backup methods include the WordPress core files too. This really cuts down on what you have to set up anew. And, it ensures you have the same WordPress version that your site last worked on. That’s important, in case a WordPress update is what toasted your site in the first place. Unlike plugins, you can’t easily just roll that back.

Review this checklist now, to keep yourself out of panic mode if you ever need to restore your site.

• Check with your backup method provider and read through the directions for restoring your site.
• Bookmark that page and copy the URL into your Site Info doc, for easy reference.
• Decide if you are okay with doing the restore yourself, or if you want to hire help. FYI, if you are not 100% positive that you can do the restore yourself, don’t. It will be faster and cheaper to outsource and get it done right the first time, instead of having to pay to clean up the mess, and then do the restore from scratch. And, there is a chance a tech may be able to restore the site without deleting your current one, just depends on what toasted it. But also know that you may have to wait for a tech to become available to do the restore.
• Decide if you want the host to try to restore their backup of your site. Most quality hosts take their own daily backups, but they are not guaranteed. And there is no telling how far back they may have to go to get a good backup. I generally don’t advise using a host backup. They are often glitchy, and you could lose too much. It’s a last resort type of thing. But you need to think through this now, so you don’t call on them out of panic and get yourself into a worse mess to clean up, or lose too much.
• Restore via cPanel. Some hosts provide a way for you to restore your site from their backups via your cPanel. You may want to have a look at their KnowledgeBase articles and become familiar with that function, if available. You’ll want to at least know where it is and how it’s supposed to work before you have to do it under duress.

Paid Host Backups

Some hosts offer a paid program for backing up your site, and allowing for individual file restoration.

I have not found these backups to be guaranteed any better than the free ones they automatically do, and I don’t think they are worth paying for.

They are certainly not worth relying on as your only backup!!!

Ask my client who got hacked at Bluehost and they’ll testify to what I’m saying. She had to step back 3 months to get a backup that worked. She was also down for 1.5 weeks. (She’s no longer on Bluehost and her site is now fully secured too.)

Automating Backups

Having your backups run on a regular, automated schedule, and sending them to storage automatically, is definitely the way to go.

But, you want to be careful about when these backups run, so you don’t slow down your site during peak visitor hours.

3rd Party Backup Services

Cloud backup services like VaultPress and BlogVault are continuously running backups.

They hit your site all day, every day, and do so from multiple IP addresses that have to be whitelisted in your IP firewall, like Cloudflare.

I don’t use them because they are so heavy on your hosting resources.

Backup Plugins

After years of testing multiple plugins, I only use UpdraftPlus for backups.

With the free version of UpdraftPlus, you can’t schedule when the backup is taken.

But with the paid version of UpdraftPlus, you can select the day and time of the backup. But, you can only have one backup scheme, which is fine for most site owners.

READ: UpdraftPlus Free vs Premium vs Migrator Plugin Features

UDP has an encrypted connection to AS3 and the ability to add a privacy policy to restrict access.

Need Help with Your Backup Setup?

Setting up an IAM user in AS3 can be a little challenging, no matter what plugin you use.

There is a wizard in UDP for it, but it does not create a secure policy that double enforces your security.

It can also be tricky to select all of the files you need outside of WordPress in these plugins.

I’m here to help, and it’s a quick thing to do.