Why and how to backup your WordPress site (the automatic way)

If there is one important thing on a WordPress site that is too often left aside, it is backups. I know that at the beginning, many people are already struggling with themes and plugins, trying to have a functional WP site… However, once your WordPress site/blog is doing more or less what you expect in terms of design and functionality, and you’ve spent time creating content for your readers, you should quickly set up an automatic backup system.

Setting up automatic backups is often postponed because we always have other tasks that seem more important in the to do list… But believe me when I say that backups should be at the top of your to-do list. Just ask yourself this question:

How would you feel if you were to lose your site overnight? How would this affect you?

If in asking yourself these questions you realize that you would be frustrated to lose your site or that you simply couldn’t afford it, then you need to set up backups to cover your ass in case something goes wrong.

Why having backup of your WordPress site is so important?

The news of this beginning of the year 2021 reminded us again brutally (I speak of course about the devastating fire at the OVH datacenter in Strasbourg), if you manage websites, you must always be prepared for the worst! As for me, I had 3 servers on this datacenter including the one hosting this Novo-media blog and if I hadn’t had external backups, I simply wouldn’t have been able to recover my websites since data really went up in smoke…

But that’s just one example of an unfortunate event that could possibly happen to you. Here are a few other scenarios that alone justify setting up backups for your WordPress site:

• Server failures: The OVH datacenter fire is just one example of a problem beyond your control that could potentially cost you your site (and it’s not unique to OVH, many of the best hosting companies have had major problems with their datacenters). A server can go down for many reasons and you should never assume that your host has made backups of your data for you. Of course, many hosting companies offer backup services but it is up to you to make sure that the backups are of good quality (I’ll come back to this below).
• Hacker attacks: Since WordPress is the most widely used platform in the world for publishing content on the internet, it is naturally a prime target for hackers. The type of attacks by hackers can vary greatly (in the last few years, I’ve seen people lose access to their admin, have pages published in Japanese, have spam appear on all their pages)… But if you have multiple backups of your site and you notice the problem in time, you can always restore an old version of your site (be careful that the backups are not infected by the hack though).
• Problem when updating WordPress or a plugin: Good practice would suggest that you always have a development environment (a copy of the site on which you can test stuff) to test updates before deploying them on the production version. However, in practice, I think that 99% of people who have a WordPress site make their updates directly on the production version of their site. Sometimes plugins are incompatible with a new version of WordPress, which can have unexpected and unfortunate consequences when updating. If you have made backups, you can always restore a version of your site from before the update in case of a crash.
• Human error: Even if you have experience with WordPress, never assume that you can’t make a mistake. You could delete the wrong folder via ftp or ssh, make a wrong manipulation in your site’s administration or whatever… if you have backups, you’ll at least have a way to go back.

As you can see, there are a lot of things that could happen. And even if these events are not common, it only takes one time to make you regret not having automatic backups for your WordPress site.

What should I backup on my WordPress site?

In order to be able to completely restore your WP site in case of problem, you actually need to make 2 types of backups:

Backup of all your WordPress site files

By “your WordPress site files” I mean the WordPress core files (i.e. the version of WordPress you are using), the plugins you have installed, the theme you are using, all the media (images, videos, pdfs etc…) you have uploaded to your site etc…

If you are on a shared hosting and you usually access your site files via cpanel or ftp, these files are most of the time located in a folder named public_html/www (this folder is called the web root of your site and can vary depending on the hosting provider). It is the content of this folder that has to be saved.

WordPress database backup

Even if you have a backup of all the files on your site, it is still not enough to restore it in case of problems. You have to back up the WordPress database which contains all the content and settings of your site (posts, pages, categories, settings etc…).

Typically on shared hosting, you can access your site’s database via Cpanel using the phpmyadmin tool.

What are the characteristics of a good WordPress backup?

So you think that you just need to have a copy of your website files and an export of your database somewhere to be able to relax… In reality it’s a bit more complicated than that and a good WordPress backup must have the following characteristics.

The WP backup must be automatic

So if you were thinking of just making a copy on your computer or an external hard drive of your WP files via ftp and exporting the database manually, let me stop you right there. A good backup should be done automatically and not manually.

The thing is that even if you are very disciplined, there will come a time when you will forget to make your backup. You can also be sure that the day you have a problem, you won’t have made a backup for several weeks and that you will therefore risk losing a lot of work.

To be able to have peace of mind, it is better to automate this process and make frequent backups without having to think about it.

Do the WordPress backup on an external storage

If there is one thing that many OVH customers learned bitterly in March of this year, it is that you should ALWAYS store your backups on an external server that is not in the same location as the website server. In the case of a fire like OVH had, even if you have backups on an external server but it is in the same datacenter, you would lose your site and your backups at the same time!

The easiest way in my opinion is to use external services specialized in data storage like Amazon S3, google drive or Dropbbox to store your backups.

Have multiple copies of backups

Imagine that a hacker has inserted content into all your web pages and you only find out about it after a week. This means that the backups of your site that were made during that week also include the problem and are therefore useless. This is one of the reasons why you should store multiple copies of your backups.

Personally, I make backups of the database every day and I keep a copy of the last 30 backups. For the site files backups (which are in general much bigger especially if you have many photos), I make a backup per week by alternating between 2 locations. This way I have 2 copies of my site files that are not backed up at the same time in case one of the backups is also infected by a hack.

Frequency of WordPress backups

So the frequency of backups will depend on how often your site is modified (or information is added to your database). If you modify your site often, you can easily backup your database every day and your site files once a week for example. As it is the information stored in the database that changes most frequently (the files of your site change mainly when you make updates, install a plugin or add media), it is precisely the database that you should back up the most frequently.

Incremental backups

The size of all your website files can be significant (usually in Gb or even tens or hundreds of Gb). So if every time you make a backup of your site’s files, you create a new copy of these files, it could overload your server, especially if you are on a shared hosting.

In addition, storage solutions like amazon S3 also charge by volume of data transferred. So if you create new backups of your files each time, the costs will be higher.

The solution to this problem is called incremental backups. With this technique, you only back up the difference between the existing backup and the new backup (i.e. files that have not been modified since the last backup are not backed up again). In this way, only the first backup will be really resource-intensive since the following ones will only back up the new files or those that have been modified since the last time.

Know how to restore your WordPress site from backups

This may seem obvious, but you need to know how to reinstall your site using backups. If you use a WordPress plugin for your backups, there is usually a feature to automatically restore backups. If not, you’ll need to know how to do it manually.

The different methods to backup your WordPress site

Let’s see the different possibilities to make backups of your WordPress site

1. Manual backups: It is possible to make manual backups of WP files and the database via ftp. But if you have read what is written above, you should avoid this way of doing and automate this task instead. So don’t do it!
2. Backups through your hosting provider: Most hosts offer automatic backup options. These options vary greatly depending on the host and it is your responsibility to ensure that the backups meet the criteria I outlined above (as in the case of OVH fire). For example, specialized WordPress hosts like Kinsta or WP Engine include quality automatic backups in all their plans.
3. with a WP backup plugin: This is the easiest way to do your backups and there are dozens of backup plugins for WordPress. Below I will show you the plugins that I think are the best for doing your backups.
4. Programmatic backups: If you are a bit tech savvy, you can create a simple script that will take care of your backups automatically. This is the way I have chosen to do it for all my WP sites and I will explain how I do it below.

Make a backup of your WP site with your hosting provider?

As I explained above, if you choose to do your backups through your web host, you need to make sure that your backups meet the criteria mentioned above (i.e. multiple backups that are stored on an external server in a different location). Also make sure you know how to restore your site because even if you have access to a backup, most hosting companies do not offer an option to easily restore your site in 1 click (it will be up to you to find the files of your site in the backup, find the database and restore these files).

However, there are a few hosting companies that specialize in WordPress sites and stand out for the quality of their backups and the ease of use in case of problems:

Kinsta

Kinsta is a premium hosting company specialized in WordPress websites. In addition to offering a lot of interesting features (loading speed, development environment, security…), they offer daily backups of your site on all their plans. These backups can be easily restored in 1 click from the administration. As Kinsta uses Google cloud, your data are backed up in a redundant way (multiple copies in different places) and are safe in case of disaster like OVH.

And if that’s not enough, Kinsta still offers an external backup service to store your backups on Amazon S3 or Google cloud storage.

Check it out on Kinsta

WP Engine

WP Engine is also a premium host specialized in WordPress websites (it is the first competitor of Kinsta). Just like Kinsta, they offer many interesting features (speed, CDN, dev environment etc…) including an automatic backup service on all their plans. Their backup tool is even more flexible than Kinsta’s with the possibility to make full or partial backups, to restore in 1 click etc… Moreover, backups are stored on Amazon S3 for a total security.

By the way, if you are starting a site from scratch, I have a small preference for WP Engine which also offers access to premium WP themes since their acquisition of Studiopress and Genesis.

Check it out on WP Engine

I’ll admit that these hosting companies are not cheap. But when you take into account all the features they offer. This kind of specialized WordPress hosting is clearly interesting for people who don’t have the technical skills and just want to have a secure and fast WordPress site.

Backup your WordPress site with a WordPress plugin

If you don’t have a premium host like Kinsta or WP Engine, the easiest way to backup your WordPress site is to use a plugin. There are dozens of WordPress backup plugins. So to make it easier for you, I’ve tested a lot of them to select the ones I think are the best. As you can imagine, all these plugins also offer a premium version. I’ve selected below the ones that already allow you to make a quality backup in their free version (automatically save multiple copies on an external server). Obviously by subscribing to the premium versions you will have more options that could be interesting but with these plugins, the minimum is covered for free.

Updraft plus

It’s clearly the plugin that came up the most often in my research and it’s also the one with the most active installations (and excellent reviews). And I must say that after testing it, it leaves up to its reputation!

The plugin is extremely easy to use and offers a lot of features in the free version already:

• automatic backup with flexible scheduling (scheduling can be completely customized in premium version)
• choice of the number of backup copies to store
• backup on an external server with many locations to choose from (amazon S3, Dropbox, Google cloud, Google drive etc…). In premium version you can store your backups on several external locations.
• Possibility to customize the content of the backup even in the free version (include/exclude certain folder)

The main advantages of the premium version for me are

• the ability to schedule backups more accurately
• the option of incremental backup which will save you resources and data transfer costs if you use a service like Amazon S3 to store your backups
• the option to store backups on multiple external servers

To see a full comparison between the free and premium version, you can take a look here.

During my test, it took me literally 2 minutes to connect the plugin to my Amazon S3 account, make a backup on the external server and test to restore the backup. I’ll put some screenshots of the plugin menus below so you can get an idea. But otherwise you can find a complete guide to use this plugin here.

test the free version of Updraft plus 

test the premium version of Updraft plus

WPvivid Backup

Here is another popular plugin to make backups of your WP site (more than 100’000 installations and almost only 5 stars reviews). Again, this is not a coincidence because just like Updraft plus, this plugin is very extensive in free version already and very easy to use.

With the free version you can already:

• schedule automatic backup (for more flexibility, you need the premium version)
• choose the number of backup copies to store
• Define several external storages like Amazon S3, Google drive, Dropbox etc…
• Customize what you want to put in your backup (even if it’s a bit less flexible than Updraft plus in free version)

The main advantages of the premium version are the following in my opinion:

• Schedule multiple automatic backups at different times and to different external storage
• Define exactly what you want to include in your backups
• Enable the incremental backup option to avoid using unnecessary resources

Just like Updraft plus, this plugin is extremely easy to use. Within 3 minutes I had set up my external storage on Amazon S3 and made my 1st backup. The restore function is very easy to use too. For more info I recommend you to read the documentation of the plugin here.

test the free version of WPVivid

test the premium version of WPvivid

Other plugins

Honestly I must have tried a dozen other WP backup plugins and there is none that offers as much functionality in their free versions already as Updraft plus and WPVivid. Most of the other plugins already ask you to pay when you want to connect an external storage like Amazon S3. So I recommend these 2 plugins instead since you can already make a decent backup for free and upgrade to the premium version if you need more advanced features.

I would like to add the WP Backup plugin which is quite new and very promising. It is still under development and for the moment it is not yet possible to connect external storage. But it already has some interesting customization options and it should soon allow to connect to the main external storage providers in its free version. A plugin to keep an eye on 😉

Make a programmatic backup of your WordPress site

Finally, for the more geeky among you, you can also make backups of your WP site programmatically. There is an infinite number of ways to do this but I will detail below how I do the backups of all my sites programmatically.

The principle is quite simple, you will need a script that exports a database backup to a folder at regular intervals and keeps the last x copies of the backups. You will also need a script that allows you to copy a folder from your server to an external storage service, in my case Amazon S3. This will be used to copy the folder containing the database backups and the folder containing your site files to Amazon S3.

For your information, I use docker to run all my sites and the scripts below are designed to work with docker. But if you understand the idea, you should be able to adapt them to your own needs.

Let’s start with the bash script that allows you to export backups of the database into a folder and keep the last x copies. The script performs a database dump into the backup folder from the mysql docker container. Then it keeps only the last x backups of the database in the backup folder.

#!/bin/bash
# backup script to dump database from a docker container
# usage :
# scripts/backup.sh /path/to/backup/folder/ docker-container-name password database-name 30

set -e

if [ $# -ne 5 ]; then
    echo "Usage: $0 <backup path> <docker container name> <database password> <database name> <number of backup kept>"
    exit 1
fi

BACKUPPATH=$1
CONTAINERNAME=$2
PASSWORD=$3
DATABASE=$4
BACKUPNBR=$5

docker exec ${CONTAINERNAME} /usr/bin/mysqldump -u root --password=${PASSWORD} ${DATABASE} | gzip > ${BACKUPPATH}db_dump_`date +%Y-%m-%d:%H>

cd ${BACKUPPATH}

# only keep the x latest backups
if [ `ls -l db_dump* | wc -l` -gt ${BACKUPNBR} ]; then
    ls -t db_dump* | sed -e "1,${BACKUPNBR}d" | xargs -d '\n' rm

Then we need a script that allows us to copy the backup folder (which contains our last x database backups) and the folder containing all the files of our site to Amazon S3. Here is an example that makes an incremental backup of any folder on the server to Amazon S3 using docker and the garland/aws-cli-docker image:

#!/bin/bash
# Mount and backup any local folder to amazon S3
# usage :
# scripts/s3-backup.sh /folder/to/mount:/mount /mount/folder/to/backup s3-bucket-name/backup/path

set -e

if [ $# -ne 3 ]; then
    echo "Usage: $0 <mount> <server backup path> <s3 backup path>"
    exit 1
fi

MOUNT=$1
SERVERPATH=$2
S3PATH=$3

docker run \
-d --rm \
--env AWS_ACCESS_KEY_ID=your-access-key \
--env AWS_SECRET_ACCESS_KEY=your-secret-key \
--env AWS_DEFAULT_REGION=amazon-s3-region \
-v ${MOUNT} \
garland/aws-cli-docker \
aws s3 sync ${SERVERPATH} s3://${S3PATH} --delete

Then you just have to add the scripts to the Cron Tab of your server to schedule their execution as you wish. To do this you just need to enter: crontab -e and schedule the execution of the scripts.

# m h  dom mon dow   command
0 0 * * * /path/to/script/backup.sh /path/to/backup/folder/ docker-container-name password database-name 30
0 1 * * * /path/to/script/s3-backup.sh /mount/db-backup/folder:/db-backup /db-backup/path/to/backups s3-bucket-name/backup/path
0 2 1,15 * * /path/to/script/s3-backup.sh /mount/website/folder:/website /website/path/to/files s3-bucket-name/backup/path1
0 2 8,22 * * /path/to/script/s3-backup.sh /mount/website/folder:/website /website/path/to/files s3-bucket-name/backup/path2

What the above lines mean is that every day at midnight, the script that backs up a copy of the database is executed keeping the last 30 backups in the backup folder (1st line). Then every day at 1am, the folder containing the database backups is copied to the Amazon S3 external server (2nd line). Finally, on the 1st and 15th of the month (line 3), the folder containing all the site files are backed up to a folder on Amazon S3. Every 8th and 22nd of the month, the same files are backed up to another location (line 4). In this way we keep 2 copies of all the site files by making an incremental backup every week.

So I hope this blog post has convinced you that you MUST set up an automatic backup system for your WordPress site. Nobody is safe from an accident and to have peace of mind, it’s better to take the time to make backups properly… especially since it’s not that difficult, right?

So you already have backups of your site? What do you use to make your backups on WordPress?