Good WordPress backup best practices come down to one idea: a backup is only worth what you can restore from it, when you need it, after the worst has happened. For a business site — where downtime costs money and lost orders cost customers — that means more than a plugin quietly making a copy somewhere. It means backups that are automatic, stored off-site, protected from tampering, and proven to work. Here’s what a proper backup strategy looks like, and the practices that separate a real safety net from a false sense of security.
Why backups are a business decision, not an IT chore
It’s tempting to file backups under “technical stuff I’ll deal with later.” But a backup is the thing that decides whether a bad day is a five-minute fix or a week-long crisis. A failed update, a compromised plugin, a server problem, an accidental deletion — any of these can take a site down, and in every case the fastest, most reliable way back is to restore a known-good version. If the backup is missing, stale, or broken, you don’t have a bad day; you have a rebuild. Treating backups seriously is just treating your business’s continuity seriously.
The best practices that actually matter
1. Automate it — never rely on remembering
Manual backups fail for a human reason: people forget, especially when things are going well and a backup feels unnecessary. Then the one week you skip is the week something breaks. Every backup that matters should run automatically on a schedule, with no human step required to make it happen.
2. Get it off-site
A backup stored on the same server as your live site isn’t really a backup — it’s a copy that shares your site’s fate. If that server is hacked, fails, or gets encrypted by ransomware, the local “backup” goes down with it. At least one copy has to live somewhere physically separate from your site, so the thing that kills your site can’t reach the backup too. This is the heart of the widely followed 3-2-1 backup rule — three copies, two locations, one off-site — and it’s the practice we follow.
3. Lock at least one copy so it can’t be changed or deleted
This is the practice most people have never heard of, and it’s the one that matters most against modern threats. An ordinary off-site backup can still be deleted or overwritten — including by ransomware or by an attacker who has gained access and wants to destroy your ability to recover. A locked backup can’t be altered or deleted for a set period, even by someone with full access. It’s a backup that can’t be sabotaged, which is exactly what you want when the emergency is a deliberate attack rather than an accident.
4. Keep enough history
One backup isn’t enough, because some problems aren’t noticed immediately. A site can be compromised, or a subtle content mistake can slip in, days before anyone spots it. If you only keep the single most recent backup, you may find your newest copy already contains the problem. Keeping a rolling window of backups — several days’ or weeks’ worth — gives you a clean version to reach back to, not just the most recent one.
5. Test your restores
A backup file you’ve never restored is a promise, not a guarantee. Backups can be incomplete (files but no database), corrupt, or misconfigured in ways that only surface when you try to use them. The only way to know a backup works is to restore it and check the result. A serious routine proves, periodically, that it can rebuild a working site — not just produce a file. Our guide on restoring WordPress from a backup covers what a real restore involves and what to verify afterward.
6. Don’t stake everything on one system
Any single backup system can fail — a bug, a misconfiguration, an expired credential, a storage account that quietly stopped accepting writes. The strongest strategy runs two independent backup systems, so that if one silently fails, the other still has a copy. Redundancy at the backup layer is the difference between “we lost a system” and “we lost our recovery.”
A pattern worth knowing: the backup-restore fee
Here’s something to watch for when you’re comparing hosts. As of September 2026, it’s still a common industry pattern for a host to either sell backups as a paid add-on or charge a restore fee — often somewhere in the region of $50 to $150 — to actually bring your site back when you need it. Think about the timing: that’s a bill that lands at the exact moment your site is down and you’re least in a position to say no. A backup you have to pay extra to use isn’t really the safety net it looked like. It’s one of the quieter items in the wider world of managed hosting hidden fees.
How we put these practices into your plan
Rather than leave backups to a plugin, an add-on, or your memory, we build every one of these best practices into the hosting itself:
- Two independent backup systems. Your site is captured by the backups built into our hosting platform and by a separate, second system we run ourselves — so one can cover if the other ever fails.
- A locked, off-site copy. That second system writes to locked cloud storage kept off your server — a copy ransomware can’t encrypt and an attacker can’t delete — plus a local copy for fast restores.
- Monitored, automatically. Backups run on schedule and are watched, so a failed run is noticed by us, not discovered by you mid-emergency.
- No restore fee. Restoring your site is part of the service, not a surprise invoice on your worst day. It’s all included in a flat monthly price that doesn’t spike at renewal.
We’ll be precise about the claim, because honesty is the point: this is two independent backup systems, a locked off-site copy that no one can change or delete, and a local copy, all monitored. That’s a genuinely strong position — and it’s the accurate one.
The bottom line
Backup best practices for a business site aren’t complicated, but they are easy to get half-right in a way that only shows up when it’s too late. Automate it, get it off-site, lock a copy so it can’t be changed or deleted, keep some history, test the restore, and don’t depend on a single system. If you’d rather not assemble and maintain all of that yourself, that’s exactly what managed hosting is for — the whole strategy, built in and monitored, for a flat monthly fee. See what’s covered on our hosting page, and read how often you should back up to match the schedule to your site.