Every WordPress site claims to have backups. Most of those backups are not really backups. They are folders of compressed files sitting on the same server as the live site, never tested, often incomplete, and quietly destined to fail at the moment they are needed most.
A backup that has never been restored is not a backup, it is a hope. A backup stored on the same machine as the live site is not a backup, it is a copy. After enough horror stories where a business thought they had backups and discovered too late that they did not, the criteria for what counts as a real backup are clearer than ever.
The four traits of a real backup
1. Offsite. Stored somewhere geographically and infrastructurally separate from the live site. If the live server burns down, the backup must survive. “Stored on a different folder on the same host” is not offsite. Stored on S3, Google Cloud, Dropbox, or a separate provider entirely, is offsite.
2. Complete. Includes both the database and the files (uploads, themes, plugins). Database-only backups can restore content but not the visual site. File-only backups can restore the look but not the posts. A real backup contains both, taken at the same moment.
3. Recent. Daily for a site that updates frequently. Weekly is the minimum for a brochure site. A backup from three months ago is technically a backup but means losing every customer interaction since.
4. Tested. The single most-skipped trait. A backup that has never been restored has never proven it works. Test restores quarterly at minimum. Roll the backup into a staging environment and confirm the site comes up correctly. The first time you discover your backup is corrupt should not be the day you need it.
The 3-2-1 rule, applied to WordPress
The IT industry’s 3-2-1 rule for backups applies cleanly to WordPress sites. Three copies of the data (the live site plus two backups). Two different media types (server storage plus cloud storage). One copy offsite (in a different location entirely).
For a typical Australian business WordPress site, this might look like: live site on managed Australian hosting, daily backup to UpdraftPlus storage on Google Drive, weekly backup to Amazon S3 in a different region. Three copies, two providers, one fully offsite.
The most common backup failures
Backup-only-on-the-host. The host’s backup is fine until the host has an outage or your account is suspended. Many businesses discover during a hosting dispute that the backup they thought they had is locked behind an account they cannot access.
Plugin failed silently. The backup plugin’s daily schedule stopped running six months ago. Nobody noticed because nobody was checking. The backup is six months stale before anyone realises.
Database tables missing. A misconfigured backup that excludes WooCommerce tables or custom plugin tables. The backup looks like a backup but is missing the most important data.
Backup is too big to restore. The backup completed, but the file is so large that restoring it through the host’s PHP timeout limits is impossible. The data is preserved but not actually accessible without manual intervention.
What restore actually involves
A real restore test, end to end, takes about 30 minutes. Spin up a fresh WordPress install on a staging URL. Pull the latest backup. Restore it. Walk the site, confirm the homepage loads, check a recent post is there, submit the contact form, try a transaction if there is e-commerce. If all of that works, the backup is real.
The first time most businesses do this, they discover at least one issue with their backup process. The second time, the issues are usually resolved. The fourth time, the team starts trusting the backups, and the trust is earned.
A quarterly habit, not a one-time setup
Backup hygiene is not a one-time project. It is a quarterly habit. Every three months, restore the most recent backup to staging and confirm the site comes up clean. Every six months, audit the backup destinations to make sure storage is not full and credentials have not expired.
This is one of the parts of WordPress maintenance that is least exciting and most important. Defyn’s maintenance plans include quarterly restore testing as a standard checklist item, which is one of the reasons clients on retainer almost never have catastrophic data loss. The backups have been tested. They actually work.
