Sign up for our newsletter.

The latest business advice, Behind the Business interviews and members-only discounts, delivered straight to your inbox.
image of wordpress security

Backup Basics: Safeguarding Your WordPress Site

You’ve put countless hours into your site. You did all the right things — created a beautiful theme that reflects your branding, installed plugins to boost your performance, and developed a tonne of amazing content that keeps your audience coming back for more.

But here’s the big question — when is the last time you created a backup?

There are numerous reasons why you could wake up one day to find your website missing, no matter which host you use. Your website could be hacked. Your host could be hacked. An error could occur during an update. You could cause an error yourself. There could be a server crash. While WordPress does backup their clients’ websites, it may be days before they’re able to restore them all in the event of a catastrophic server meltdown.

Accidents happen — when it comes to your professional site, you don’t want that accident to take out your entire site, or even just a section of it. That’s why it’s crucial to regularly create backups. Having a backup is the difference between having a working version of your site back up in minutes, or having to rebuild the entire thing from scratch. I’m pretty sure I know which option you’d choose! And not only are backups useful in the event of a catastrophe, but they also make it easier to switch hosts.

For WordPress, there are a few different ways to backup your site, and a number of reliable plugins that do the job for you — but we’ll get to those a little bit later.

First, I’d like to talk about two important instructions in regard to safety.

image of a safe dial representing security for your wordpress account


Take preventative measures.

No one wants to get hacked, but there are some steps that you can take to lessen your chances. Use strong passwords (no, password123 is not a strong password, even if it does have numbers and letters). The same goes for login names. “Admin” may be a great descriptive title, but you’ll want to put a little more imagination into it. Pairing a unique login name and strong password are a basic line of defence against those who would do your site harm.

Also, keep your themes and plugins updated — you never know when an update will contain a security patch that can save your site. (This also goes for updates and patches on your laptop!)

Don’t put all your backups in one basket.

Technology is great, but it isn’t always reliable. If it were, we wouldn’t need to worry about backups at all!

With this in mind, it’s unwise to keep all of your backup files in only one location. (And this doesn’t just go for your website backups, but all of your important files.) Imagine that you kept all of your files on your laptop, and the laptop were lost or stolen, damaged in a fire or flood, or suffered a technological breakdown of its own. What’s the best way to protect yourself? I like to follow the rule of 3 — 3 different locations for file backup. Personally, I have my laptop, an external hard drive I keep in a secure location, and a cloud-based storage system (like DropBox,, or GoogleDrive). I keep copies of 2-3 of my most recent backups, just to be safe. I know some people who burn DVDs as one of their locations. The point is to make sure that you’re covered in case of a variety of emergencies.

Okay, so with that out of the way, let’s talk about a few different ways to backup your WordPress site.

WordPress backup through WordPress without a plug-in.

While plugins are a great way to easily get a comprehensive backup of your site (and often include automatic backup options), you may want to take a minute to sort through your options before making your selection. In the meantime, WordPress does offer a manual export option from their website that will download your content. Per WordPress, this will include your posts, pages, comments, categories, tags, and references to your site’s images — note that this is not a comprehensive backup and won’t contain your themes, media, or plugins. It’s not a perfect backup, but it’s one that you can do right now just to make sure your content is safe. You can reach this option through My Site → Settings → Export. It’ll give you the option to export all of your content, or just portions of it, like a certain date range or author. This option will email you a link to a zipfile with your export files.

image of an open vault door representing an unsecured wordpress accountIf you want to backup your media as well, you’ll need to download and install WordPress onto your computer (this option is definitely for the more technologically-inclined, and you can find instructions here).


WordPress backup through your host.

There are a number of website hosts that play very well with WordPress, including BlueHost, DreamHost, SiteGround, GreenGeeks, and dozens more. With WordPress being such a popular option, most hosts want to offer their clients ease-of-use, and have introduced features that make it easy to handle your WordPress site through their service. This means that most reputable hosts will offer the ability to perform manual and automatic backups of your WordPress site through their service. Which is great! Do your research, though: Which sections of your site they will be backing up — will it be a comprehensive backup? Can you select what to back up and when? Figure out what your service offers and then be sure to take advantage of it — the peace of mind will be priceless.

WordPress backup plugins.

There are a lot of different options available when it comes to WordPress plugins that back up your data. By all means, I recommend doing your own research and figuring out what works best for you. However, there are a few options I’d like to mention in order to get you started.

BackupBuddy: This plugin has been helping users back up their WordPress sites since 2010. BackupBuddy has a bit of an edge over some other plugins in that it doesn’t just back up your database, but also your themes, plugins, and media library.

UpdraftPlus Backup and Restoration: This is a very popular free option that has received very high ratings from its users. UpdraftPlus is a very convenient option, as it allows you to back up your files to your Dropbox, Rackspace, GoogleDrive, Amazon S3, or server. By upgrading to the premium version, you can upload up to a gigabyte’s worth of file’s to the UpdraftPlus Vault cloud, trigger automatic backups when you change your theme, and send your backup to additional locations.

Duplicator: If you’re a little more on the techy side, this might be an interesting option for you to consider. Per its name, Duplicator actually creates a duplicate or clone of your entire WordPress site, giving you the ability to migrate the site anywhere. It also offers automatic backups to various cloud services and a host of other higher-level technical services. The plugin does come with a disclaimer. Per its website: “This plugin does require some technical knowledge. If you plan to migrate WordPress or backup WordPress please use it at your own risk and don’t forget to back up your files and databases beforehand.” I’d recommend heeding that.

Recovering your site without a backup.

All of the advice I’ve given so far is extremely helpful, but only if you’ve gotten to it before a catastrophic server error or hacking attack. What if your site has already been compromised and you don’t have a backup?

Don’t freak out just yet — there may be hope.

You may be able to restore your site using Google’s (or Bing’s) cache.

1. Search for your website using Google or Bing. If your site is down, there should be an arrow next to the listing of your website. Click it — it will give you the option of “Cache” or “Similar”.
2. Select “Cache”.
3. Copy the source code or content that you need.Note: it may not be the most recent or complete version of your site, but it’s certainly better than starting from scratch. This should be your last resort, however — I highly recommend scrolling back up and putting some real backup procedures in place.

You can thank me later.