The day your site shows a white screen, an update breaks everything, or worse, you discover it's been hacked, only one question matters: do you have a backup that actually works? Many business owners say yes out of habit, without ever having checked. That's exactly the moment they learn they need to restore their WordPress site in an emergency, and that the backup meant to save them is incomplete, too old, or simply missing.
Backing up a WordPress site isn't complicated in itself. What is complicated is doing it correctly, with a reliable method, and knowing how to restore without breaking everything the day it's actually needed. The difference between a backup that saves a business and a useless one often comes down to details nobody checks until they need them.
This guide covers both sides: how to set up a reliable backup, and how to restore a site cleanly when the situation demands it.
A reliable WordPress backup must be automatic, complete (files AND database), stored off the server, and above all regularly tested by restoring it.
What a real backup must contain
A common mistake is backing up only the database, or only the files, assuming one is enough. A complete WordPress site needs both to function.
A complete backup includes:
- the database (posts, pages, settings, comments, users)
- the active theme's files and any customizations
- installed plugins, with their specific settings
- the media folder (uploaded images, documents, videos)
- the wp-config.php file holding the technical configuration
Missing even one of these turns a simple restore into a laborious manual rebuild.
Where to store your backups
Storing a backup on the same server as the site it protects is a classic mistake. If the server goes down, gets hacked, or suffers a hardware failure, the backup disappears along with the site.
Good storage practices:
- Always offload to cloud storage (Google Drive, Dropbox, S3, or similar)
- Keep multiple copies in at least two separate locations for critical sites
- Encrypt backups that contain sensitive or personal data
- Keep a history of several versions, not just the latest one
A history of several versions lets you roll back to a state before an infection if the hack was only detected several days later. Our article on cleaning WordPress malware explains why this history matters so much.
Choosing the right frequency and retention
The ideal frequency depends directly on how active the site is. A blog updated once a month doesn't have the same needs as an online store processing orders every day.
Reasonable benchmarks:
- low-activity showcase site: weekly backup is enough
- site with an active blog or forms: daily backup recommended
- e-commerce: daily backup, or several times a day for orders
- retention: keep 30 to 90 days of history depending on how critical the site is
Our complete WordPress backup guide covers the recommended tools and settings for your setup.
Testing a restore before you actually need one
This is the step almost nobody does, and it's exactly the one that makes all the difference. A backup that has never been restored is a backup whose reliability you don't really know.
A simple restore test consists of:
- Installing WordPress on a test environment or dedicated subdomain
- Restoring the full backup (files and database) to that environment
- Checking the site's display, admin login, and forms
- Documenting how long the whole procedure takes
Running this test at least once a quarter guarantees that when it's actually needed, the restore goes smoothly with no surprises.
Restoring a site after a hack
A hack is the scenario where restoring gets trickiest, because putting the site back online isn't enough: you also need to make sure the flaw that allowed the intrusion is fixed, or the new site will be compromised again within hours.
The steps to follow:
- identify the infection date by examining modified files and available logs
- restore a backup taken before that date, never the most recent one if it's already compromised
- update WordPress, the theme and all plugins immediately after restoring
- change every password (admin, database, FTP, hosting)
Our article on how to recover a hacked WordPress site covers this procedure step by step.
Restoring after a failed update
Another common scenario is a plugin or theme update that breaks the site, with no attack involved. In this case, the restore is simpler, but demands the same rigor.
Worth checking before restoring:
- identify the plugin or theme responsible before blindly restoring everything
- restore only the affected files if possible, to avoid losing recent content
- test on a staging environment before applying the problematic update in production next time
When to call in a professional
Setting up a reliable backup and testing its restore takes technical rigor that few business owners have time to build. Facing a hack or a critical outage, every hour counts, and a poorly handled restore can make things worse rather than better. If your site is your main sales or customer contact channel, or if you've never tested a full restore, calling in a professional removes that risk and guarantees a fast, clean return online.
Frequently asked questions
How often should I really back up my WordPress site? For most small business sites, an automatic daily backup is the right balance between security and storage load. An active e-commerce store justifies a higher frequency so orders are never lost.
How long does a full restore take? For a mid-sized site, budget thirty minutes to two hours depending on data volume and method used. A prior test lets you know this delay precisely before you actually need it.
Is my automatic backup enough if I've never tested it? No, a backup that's never been restored carries a real risk of undetected corruption or incompleteness. The only way to know it works is to restore it at least once in a test environment.
Want a reliable, tested WordPress backup ready for when things go wrong? Relax by Yumea manages your automatic backups and steps in urgently in case of a hack or outage. Request your free diagnosis at /en/relax/ or check our dedicated page on hacked WordPress sites.