WordPress backup plugin: how to back up and which one to pick

A WordPress backup plugin stores a full copy of the site, files and database, so you can restore if the site goes down, gets hacked, or breaks during an update. For a small business, that is often the difference between being back online in minutes and losing orders, copy, and form data.

The official WordPress.org handbook treats backup as two separate pieces: the files (core, themes, plugins, uploads) and the database (posts, pages, users, settings). A well-configured plugin covers both. Your host may keep copies too; the plugin is the copy you control.

If you are still choosing where the site will live, backup is one of the checks in our guide to best web hosting for a small business.

What has to be in the backup

The handbook says to copy the database first, then the files. On restore, the order flips: files first, then the database. If you reverse that, the site comes up with a theme or plugin from one version and content from another.

A complete backup includes:

• The MySQL or MariaDB database (wp_posts, wp_options, users, comments, WooCommerce orders).
• The wp-content/ folder (themes, plugins, uploads). Without it, the site comes back empty: posts exist, images do not.
• wp-config.php and, if you customized them, .htaccess or Nginx rules.

You can always download WordPress core again. Still, restoring is simpler when you have the whole folder.

The handbook also asks for a backup before any update of core, theme, or plugin. That is when sites break most often.

How often, and where to keep it

For a brochure site that rarely changes, the handbook suggests a weekly copy. For a store, a news site, or anything that gets new content every day, the recommendation is daily. Keep 3 to 5 recent copies, in different places.

The classic mistake is leaving the backup only on the same server as the site. If the account is suspended, the disk fails, or the host has an incident, the copy disappears with it. Send it to external storage: Google Drive, Dropbox, Amazon S3, or FTP on another host.

Hosting usually includes its own backups. That is a safety net, but restore can be slow, and on some plans only support can run it. The handbook treats host backups as a complement, not as the only plan. In our hosting guide, the question we tell you to ask the provider is exactly that: frequency, retention, whether the copy lives off the server, and whether you can restore it yourself from the panel.

How to choose a WordPress backup plugin

There is no single best plugin for every site. What changes is what the site needs and what the free version actually does. Before you install, check the official directory:

1. Full copy and restore. The plugin has to export files and database, and restore both from the dashboard. If restore only exists in the paid version, find that out now, not on the day of the incident.
2. Off-server destination. Dropbox, Google Drive, Amazon S3, or FTP. A backup that lives only in the site folder does not help when the server goes down.
3. Schedule. Daily or weekly, at a quiet hour, with a few versions retained.
4. A recent update. Backup plugins read and write files and the database, so they show up in security research. UpdraftPlus, BackWPup, and WPvivid shipped fixes in October 2026. Keep the plugin current.
5. Site size and upload limit. Some plugins build a single archive. If PHP upload_max_filesize is small, dashboard restore fails. Ask the host what the limit is.

Five plugins from the official directory

Install counts below come from each plugin’s WordPress.org page, checked on 5 Nov 2026. We do not list prices: paid tables change, and Amicatek does not republish a figure we have not seen at the vendor checkout.

UpdraftPlus. More than 3 million active installs, version 1.26.14 (26 Oct 2026). The free version sends copies to Dropbox, Google Drive, Amazon S3, FTP, or email, schedules backups, and restores in a few clicks. Paid adds OneDrive, SFTP, incremental backup, an automatic copy before updates, encryption, and UpdraftVault storage. It is the plugin most people run, and the one that shows up most often in security-fix notes: versions 1.26.9 through 1.26.13 in October 2026 were patches.

Duplicator. More than 1 million installs, 4.9/5, version 5.1.1 (3 Nov 2026). Lite builds a site package and one-click restore, and includes Duplicator Cloud. Pro adds scheduled backups, Dropbox, Google Drive, OneDrive, Amazon S3, FTP, and multisite. It needs PHP 7.4 or newer and WordPress 6.2 or newer. It is usually the pick when you are migrating a site, not only when you want a recurring copy.

BackWPup. More than 500,000 sites, version 5.7.8 (14 Oct 2026), from WP Media. The free version writes to local disk, Dropbox, FTP, Azure, Amazon S3, SugarSync, and Rackspace, on an hourly, daily, weekly, or monthly schedule. Paid adds Google Drive, OneDrive, encryption, and a restore that does not need WordPress running. In 2026 the plugin also shipped fixes (including an unauthenticated job trigger in 5.7.7). If you already use other WP Media products, the dashboard stays in the same family.

WPvivid Backup & Migration. More than 900,000 installs, 4.9/5, version 0.9.139 (30 Oct 2026). The free version does a full backup, files-only or database-only, scheduling, and sends copies to Dropbox, Google Drive, Amazon S3, OneDrive, DigitalOcean Spaces, FTP, and SFTP. It restores in one click and also migrates and creates staging. Versions 0.9.132 through 0.9.138 patched vulnerabilities. It is the free tier that covers the most: cloud destination, schedule, and restore with no paid extension.

All-in-One WP Migration. Version 7.113 (27 Oct 2026). The vendor cites “60 million websites”; that figure does not appear as active installs on WordPress.org, so we do not use it as an adoption metric. The free plugin exports a site of any size. Restore through Import hits the host’s upload limit; for large files and one-click restore, the vendor sells the Unlimited extension. It works well for moving a site from one server to another. For a daily routine with a copy in the cloud, the four plugins above cover more.

For most small-business sites, free UpdraftPlus or WPvivid is enough: schedule, off-server destination, and restore in the dashboard. Duplicator is for migration. All-in-One WP Migration is too, if the archive fits the upload limit. BackWPup is solid if you already live in the WP Media stack.

Install one backup plugin. Two running at once load the server and produce copies nobody knows which to restore.

Setup, step by step

The flow below works for any of the plugins above. Menu names change; the order does not.

1. Make a manual copy now, before you install the plugin. From the host panel, export the database (phpMyAdmin or the host’s exporter) and download wp-content/ over FTP or the file manager. If the plugin fails on first setup, you still have that copy.
2. Install from the directory. Plugins → Add New, search the exact name, and check the author (UpdraftPlus.com, Duplicator, WP Media, WPvivid, ServMask). Skip lookalike forks.
3. Run a full backup immediately. Do not wait for the first scheduled job. Check that the file arrived at the external destination and that the size looks right: a site with many images does not produce a few-megabyte archive.
4. Set the schedule and retention. Brochure site: weekly, 3 to 5 versions. Store or daily publisher: daily. Delete old copies on purpose, or Drive fills up and the job starts failing.
5. Test the restore. The handbook is explicit: a backup that has never been restored is unproven. The safest test is a staging site or a local install. Restoring on production “just to see” can overwrite the live site.
6. Write the procedure down. Where the copy lives, which plugin, which Drive or S3 user, how to restore. If only one person in the company knows, that is also a risk.

How to restore (and what usually goes wrong)

Handbook order: files first, database second. If the plugin restores both at once, let it. If you do it by hand, do not import the SQL before themes, plugins, and uploads are in place.

Mistakes we see often:

• Database-only backup. The site “comes back” with no images, no theme, and none of the plugins the content expects.
• Copy only on the server. The incident that takes the site down takes the copy with it.
• Never tested restore. On the day, the file is corrupt, a paid extension blocks import, or the upload limit rejects the archive.
• Plugin left outdated. Backup code runs with high privileges. Being behind here costs more than being behind on a form plugin.
• Two backup plugins. Jobs collide, the disk fills, nobody knows which file to use.
• No backup before an update. The handbook treats this as a rule, not a tip.

If the site is already hacked, restore alone is not enough: the copy may bring the malware back. Follow a cleanup path first, and restore only from a point you know is clean.

The plugin and professional maintenance

The plugin is the owner’s layer: you install, schedule, and test. Hosting and maintenance are another layer. In Amicatek WordPress maintenance, backups are daily, complete (files and database), stored on AWS S3 off the server, with several versions and a tested restore. The site can live on our hosting or on another provider.

The two layers add up. The plugin does not replace the host backup, and the host backup does not replace yours. If the account is suspended, you still have Drive. If the plugin fails, maintenance S3 is still there.

If you want someone watching backup, updates, and restore on your site, request an Amicatek assessment. Each project gets a custom quote.

Sources

• Backing Up Your Database (WordPress Developer Resources, updated 28 Oct 2026)
• UpdraftPlus (WordPress.org Plugin Directory)
• Duplicator (WordPress.org Plugin Directory)
• BackWPup (WordPress.org Plugin Directory)
• WPvivid Backup & Migration (WordPress.org Plugin Directory)
• All-in-One WP Migration (WordPress.org Plugin Directory)