UpdraftPlus
UpdraftPlus is the most widely installed WordPress backup plugin, and the free version does the essential job. The part that matters is not which plugin you use — it is whether you have ever restored one.
A backup plugin's only real job is to produce something you can restore. Everything else — schedules, destinations, retention — exists to serve that. UpdraftPlus does the job competently in its free version, and the question worth asking is not whether it is the best plugin but whether you have ever tested what it produces.
Most sites have never restored a backup. Those sites do not have backups; they have files they believe in.
What the free version covers
- Scheduled backups of files and database, separately configurable.
- Remote storage to the common cloud destinations.
- Restore from within the WordPress admin.
- Retention settings, so old backups are pruned.
- Manual backups before a risky change.
That is the essential set, and for a brochure site or a blog it is sufficient without paying anything. The comparison across the category is in backup plugins.
Premium, and what it actually adds
- Incremental backups, which matter on large sites where a full run is expensive.
- More storage destinations, including some business services.
- Migration and cloning, which is genuinely convenient when moving a site — though migrating a WordPress site can be done without it.
- Multisite support — relevant if you run a network.
- Database encryption and more granular scheduling.
Buy it for incremental backups on a large site or for the migration tooling. The core protection is in the free tier.
Remote storage is the setting that matters
If you change one thing after installing it, change this.
A backup stored in the same hosting account is lost alongside the thing it protects: a server failure takes both, an account suspension locks you out of both, and a compromise gives an attacker both. It also inflates your disk usage, which on some plans is what triggers the problem in the first place.
Send backups off the server. Then check, once, that you can actually download one from that destination and open it.
Where PHP-based backups struggle
UpdraftPlus, like every backup plugin, does its work in PHP within your web server's limits. On a small site this is invisible. On a large one it becomes the constraint:
- Execution time limits can end a run mid-archive, producing partial files.
- Memory limits can fail a large database export — how to increase the WordPress memory limit.
- Large uploads folders are the usual cause; media is almost always the bulk.
- Schedules depend on WP-Cron, which on a low-traffic site fires late or not at all. If backups are silently not running, that is the first thing to check — how to disable WP-Cron covers replacing it with a real system cron.
Signs you have outgrown a plugin-based backup: runs that take hours, runs that never complete, or a restore that times out. At that point a server-level or host-level backup is the right tool, and the plugin becomes a secondary copy rather than the primary one.
Restoring is the part to rehearse
A backup you have never restored is a hypothesis. Rehearse it once, deliberately, on a staging copy:
- Take a fresh backup.
- Restore it onto staging, not production.
- Confirm the front page, a post, an image, and a form all work.
- Confirm the database restored — check a recent post exists.
- Time it. Knowing that a restore takes forty minutes changes how you plan an incident.
Do this once a year and after any significant change to the site's size. It takes an hour and it is the difference between having backups and believing you do.
What a backup does not protect against
Worth being explicit, because backups get treated as a general safety net:
- A compromise you did not notice. If a site was backdoored three weeks ago, your backups contain the backdoor. Restoring reinstates it — see how to fix a hacked WordPress site.
- Losing the hosting account, if the backups are inside it.
- A bad update, unless you take a backup immediately before — which is what updating plugins safely is for.
- Content someone deleted a month ago, if retention is two weeks.
Retention is worth a thought rather than a default. Long enough to catch a slow-moving problem, short enough not to fill the destination.
Common mistakes
- Backups stored on the same server. The most common and the most consequential.
- Database-only backups, which restore a site with no images, because uploads live on disk — see the WordPress media library.
- Never testing a restore.
- Schedules that silently stopped because WP-Cron is not firing.
- A retention window shorter than the time it takes to notice a problem.
- Assuming the host's backup is enough, without checking whether you can restore it yourself.
Verify
Open the plugin's log after the next scheduled run and confirm it completed rather than started. Download one archive from the remote destination and open it — confirm it contains both the database dump and wp-content/uploads. Then restore it to staging once.
Those three checks take under an hour and they convert a plugin you have installed into a backup you actually have.
Frequently asked
- For most sites, yes. It backs up files and database on a schedule, sends them to remote storage, and restores from within WordPress. Premium adds incremental backups, more storage destinations, migration tools and multisite support.
- Anywhere except the same hosting account. A backup on the server it is protecting is lost with the server, the account suspension, or the compromise. Remote storage is the single most important setting in the plugin.
- Because the work runs in PHP under a time limit. A large uploads folder can exceed the execution limit mid-run, producing partial archives. Increasing limits helps; on genuinely large sites a server-level backup is the better tool.