Assume your backup isn’t working until you’ve proven otherwise. The ten-minute check below, done monthly, is the difference between “we lost three days of orders” and “we restored everything in twenty minutes”. A backup that has never been restored isn’t a backup, it’s a hope.
Why do backups fail silently?
Backups almost never announce their own failure. The schedule gets cancelled when a host migrates servers. The disk fills up and backups stop writing, quietly. The backup only captures the database, or only the files, so half your site isn’t there when you need it. It’s stored on the same server, so it dies with the server. And retention periods expire, so the working copy you were relying on is already gone. Every one of these is a “works fine until it doesn’t” failure mode.
What a good WordPress backup actually includes
Four things. The complete file set, the database, storage offsite on a different server or provider, and versioning so you can rewind to any recent point. It also needs to be restorable in a practical amount of time. A backup you can’t restore in under an hour isn’t a disaster plan, it’s a post-mortem in waiting.
The 10-minute check
Run this once a month, ideally at the start of the month:
- Open the backup log or your hosting panel and confirm the last backup actually completed (2 minutes).
- Check where it’s stored: if it’s the same server as the site, it doesn’t count as offsite (2 minutes).
- Verify it contains both the files and the database, not just one (2 minutes).
- Download a file from the backup or preview it in the panel to prove it’s readable (2 minutes).
- The gold test: restore the backup to a staging site or subdomain and confirm the site works. First time takes about an hour, after that it’s ten minutes (2 minutes to kick it off, then a cup of coffee).
Step five is the one everyone skips, and it’s the only step that actually proves the backup works. If your backup solution can’t be tested this way, that’s a red flag about the solution itself.
What about “my host backs up my site”?
Host backups are real and worth having, but treat them as a layer, not a plan. They’re usually server snapshots with slow restore times and short retention, and they live on the same provider as your site. If your account is compromised, the attacker can often delete the snapshots too. A good setup is host snapshots plus an offsite backup you control.
How often should backups run?
Daily for active sites. Hourly for anything with a checkout, because you don’t want to tell a customer their order vanished. Keep 30 days of daily backups plus a monthly snapshot for a year. That sounds like a lot until the day you need a specific Thursday at 4pm, and then it’s exactly right.
When will you actually need it?
We’ve restored sites after bot-planted malware, a bad plugin update, a deleted theme folder, a defaced homepage, and a failed migration. The ones with tested backups came back in minutes. The ones without took days, and one never fully came back. The pattern is so consistent we made it a rule: check the backups before you need them, because you won’t feel like checking when you do. Our own care plans include daily offsite backups with one-click restore for exactly this reason.
Quick answers
Is my backup working if it completes successfully?
Not necessarily. Completion just means it ran. The restore test is the only real proof, which is why step five of the check above is the one that matters.
Can I test a restore without breaking my live site?
Yes. Restore to a staging site or a subdomain, check the pages and the admin, then delete it. The live site is never touched.
What is the 3-2-1 rule?
Three copies of your data, on two different kinds of storage, with one copy offsite. It’s the standard safety net for anything you can’t afford to lose.
Do I need a backup plugin if my host already backs up?
Layered is better. Host snapshots alone have slow restores and can be lost with the account. An independent offsite backup you can test is the layer that saves you.
Backups and updates are two thirds of the unholy trinity of WordPress incidents, with hacked sites being the third. Our note on how often to update WordPress covers the second, and if you’d rather have all three handled, talk to us.