The Secret to Secure and Reliable WordPress Backups: Part 1

Everyone knows you need to keep your WordPress sites backed up. You never know when updating your site might break it, or when your web host will go down, or an out of date plugin will result in a security problem.

In this article I’m going to talk about why site backups are important and especially why it is important to store your website backups remotely. I’ll also go through some simple steps you can follow to build a secure and reliable automatic backup system. In part 2 of this article, I’m going to detail some specific steps to follow to make your remote backups extra secure. When you have completed this series you will understand how to create a reliable backup and recovery process that can protect your site even if it is hosted on a budget webhost.

Why Backups?

It’s a fact of life that computers fail and web sites crash. It doesn’t matter how good your hosting provider says they are, there will still be outages. This is why you need a reliable backup and recovery process. As important, you need to keep your backups stored away from your site. You always want the confidence that you can get to your backups, even if your webhost is down, so you can get your site running again.

Everyone knows they are supposed to make backups, but so often backups aren’t run regularly if they are run at all. The truth is, getting backups right is hard to do.  This is hard tech to get automate and face it, it wasn’t the most exciting thing you thought about when you started your website.

I always ask about people’s backup habits when I talk to them about their sites and the responses fit some regular patterns:

My hosting provider / web team takes care of my backups.

The problem here is that your hosting provider might end up being the problem. If your hosting provider goes through an extended outage, you may not be able to get to your backups at all let alone have any way to recover your site.

It’s great if you have a good team that does backups for you. However, I always want to know where my backups are stored and that I have network access to them so that I’m not fully reliant on that team.

There can be a fire or other disaster that takes down your entire data center, or a major security breach, or a key member of your web team has a family emergency and is suddenly not responding to any communication. What can you do?  Unless you have a backup/recovery plan that you can operate yourself and the backups are stored where you can reach them, there isn’t much you can do.

I only backup when I make major changes.

This is why I think automatic backups are critical. If you rely on remembering when to backup then there will come a time when you will forget and then you will have an outage and lose data.

If a client tells me they have a foolproof system to help them remember to backup, then I think they are working too hard. With a truly automatic solution, backups happen on a schedule and you get a notification email when it completes.

I download backups to my laptop. (or worse) I store my backups with my site.

Both of these offer about the same level of safety. If your laptop breaks or the storage at your web host breaks, your backups are toast and you can’t recover.

This is why I always setup remote backup storage. It doesn’t matter how big or small the site is. It used to be expensive and complicated to store backups remotely. Now we have free tools to make the site backups and affordable storage solutions that cost pennies per month.

Automatic Backups

I think by now you can guess that my secrets to a good backup solution are automatic backups and remote storage. My WordPress backup plugin of choice is UpdraftPlus.


UpdraftPlus has both paid and free versions. I use the paid version for it’s site staging and migration services but the free version does all you need for the backups I’m talking about here. I’ll talk more about site staging and site migration below.

UpdraftPlus can backup on an automatic schedule and send out an email to you when the backup is complete. It will let you restore a backup within its plugin UI with a button press. Several other free backup solutions I looked at required a manual restore of the backup which can be tricky. Often you want to keep the last several days of backups for extra protection. UpdraftPlus lets you specify how many old backups to keep before it starts to automatically delete them to save space.

I won’t go into detail about how to setup UpdraftPlus, they provide good installation information on thier plugin page and website.

Remote Backup Storage

Remotely storing your site backups means we are going to use a separate service apart from your web site hosting to store the backups. Ideally we want one that is designed to be highly available and keep your data safe and secure. UpdraftPlus supports a number of storage services and my preference is the Simple Storage Service (S3) by Amazon Web Services (AWS).


AWS S3 is both reliable and affordable which has led it to be used by some large, well known companies like Netflix which uses it for their video storage. AWS S3 is designed to automatically store your data in multiple physically separate data center locations so that even if one data center experiences a disaster, your data is still safe.

To review, UpdraftPlus can store your backups in a number of ways. I recommend that you setup UpdraftPlus to use remote storage and to use AWS S3 for that storage. You will need a separate login account with Amazon Web Services for this to work. That is easy to setup and while it does have a cost, that cost is very low:

  • S3 storage costs are 2.3 cents per Gigabyte (GB) of data per month
  • S3 bandwidth costs 9 cents per GB downloaded (uploads are free).
  • The first GB of data downloaded per month from S3 is also free.

This means that if you have a fairly large wordpress site taking up 1GB of data and you decide to always store the last 5 days of backups, your cost will be about 12 cents per month. There will be no cost to upload the backups. If you need to recover a backup, you will be charged to download the backup and the first one per month will be free, since your backup is 1GB in size. For the reliability of AWS S3, this is a bargain.

I’ll be talking about how to setup all of this in part two of this article.

Staging and Migration

There is one other backup related topic I want to cover which is more of a power user feature than a requirement. When I first came to WordPress, I was surprised that there was no straightforward way to create a staging server. I wanted a way to make changes to my wordpress site like adding a new plugin or making theme or layout change without affecting the live site. I wanted to be able to make changes, test them someplace private where I could review the changes, and then if they worked, make them live. WordPress has no such built in functionality.

Several plugins can do this, including the paid version of UpdraftPlus. The feature is called Migrations and lets me take a backup of my site and restore it under a different domain name. It is important to find a plugin that does this correctly because WordPress embeds the domain name of your site, in this case, into the database. If I were to restore a backup of my site under a different name, like, the site wouldn’t work. Luckily UpdraftPlus Premium does this automatically.

Now I can have a test site for my blog where I can try out different themes, and different plugins without affecting the live site. Once I have verified changes to the test site, I can apply them to the production site.

Ultimately the process is simple enough that there is no excuse not to have a spare web hosting domain setup with a staging instance of your main site when you are doing active development on it or experimenting with new plugins. This is also helpful when I take on maintenance clients who have very badly maintained WordPress installs. I can safely go through upgrade scenarios without risk of breaking their live site.

Concluding Remarks

This is a two part article. In this first part, I went over why you should be running automated remote backups of your WordPress site and discussed tools for accomplishing that affordably.

In part 2 of this series, I will go into detail of how to securely setup remote backups with UpdraftPlus and AWS’ Simple Storage Service (AWS S3). The security setup on AWS S3 can be tricky to get right and it is worth learning how to do it correctly. This is especially true if you are maintaining multiple sites.

One final word of advice. If someone else is performing your backups, make sure the recovery process is simple enough for you to perform it yourself if necessary.

If you have enjoyed this article or have any questions, please leave a comment below and if you would like to recieve notifications when I publish new articles or get announcements of special offers, leave your email address in the box below.