WordPress Backup Plugin or Host Backups? How to Choose

Use a WordPress backup plugin and your host’s backups together. They fail in different ways, so neither one alone is a safe answer, and the choice that actually matters is not which plugin but where the copies live and who restores them.

Most articles on this subject are published by companies selling a backup product. This one is written by people who get called after the restore has already gone wrong, so it starts with what a backup has to contain, then covers what plugins and hosts each miss, how to test what you already have, and what it costs to hand the job to someone else.

A backup only counts if it has both halves of your site

A WordPress site is two separate things. The files are the theme, the plugins, the uploaded images and WordPress itself. The database holds every page, post, product, order, comment, user and setting, and it lives in a separate system, usually MySQL or MariaDB.

WordPress’s documentation is direct about this: copying the files does not copy the database, and you need both to fully restore a typical WordPress site. This is the single most common gap we find. Someone has a folder of files from their host, no database export, and no way to turn one into a working website.

The same page advises keeping copies in different locations, such as the hosting server, cloud storage and a local computer, and recommends keeping at least three backups on file. On frequency it says backups should be made once a week for smaller sites with fewer posts, and daily for high-activity sites with a lot of posts, plus always before an upgrade.

Source: the WordPress backup documentation on developer.wordpress.org, last modified October 28, 2026. Checked November 13, 2026.

What a WordPress backup plugin does well, and where it breaks

A backup plugin runs inside WordPress, which is both its advantage and its weakness. The advantage is control: you choose the schedule, you choose whether copies go to Google Drive, Dropbox or Amazon S3, and you can usually restore from the dashboard without touching a server.

The weakness follows from the same fact. If WordPress will not load, the tool you need to fix it will not load either. A fatal PHP error, a database that will not connect, or a hack that locks you out of the admin all disable the plugin at the exact moment you want it. Large sites hit a second problem: the backup job runs inside a PHP process with a time limit, so it can quietly stop halfway and leave a partial archive that looks fine in a list.

Two well-established free options cover most small sites. UpdraftPlus is at version 1.26.14, last updated October 26, 2026, and tested up to WordPress 7.1.4. Duplicator is at version 5.1.1, last updated November 3, 2026, and tested up to the same version. Both back up files and database together and both send copies off-site in their free editions. Check those two figures yourself before installing anything: a backup plugin that has not been updated in a year is a liability, not a safety net.

What your host’s backups actually promise

Host backups survive the failures that kill plugins, because they run outside WordPress. If the site is white-screening, the host snapshot is still there. That is a real advantage and the reason not to turn them off.

The limits are worth reading in your own hosting account rather than assuming. Four questions settle it:

1. How often do they run, and how far back do they go? Daily with seven days of history means your worst case is losing a day of orders and discovering a problem eight days late.
2. Can you restore one file or one table? Many plans restore the whole account or nothing, which is awkward when you want yesterday’s database but today’s uploads.
3. Where are the copies stored? If they sit on the same provider as the site, a suspended or closed account can take the site and its backups together.
4. Is a restore included, or billed? Some plans charge for restores, or only provide them through a support ticket with no stated response time.

That last point is the one that costs money in an emergency. A backup you cannot reach at 2am on a Sunday is a backup that exists for the host’s benefit, not yours.

Test the backup you already have, in about twenty minutes

WordPress’s documentation suggests manually backing up your automated backups now and then to confirm the process is working. We go a step further and restore them, because a file that downloads is not the same as a site that boots.

1. Download the most recent backup to your own computer. If this step fails or the file is far smaller than your site, stop: you have found the problem.
2. Open the archive and confirm it contains both a database file (usually a .sql file) and the wp-content folder with your uploads and theme.
3. Restore it onto a staging copy, never over the live site. Our guide to setting up a WordPress staging site covers the ways to get one.
4. Log in to the restored copy. Check the homepage, one blog post, one form and, if you sell, the cart and checkout.
5. Note the date of the restored content. If it is older than you expected, your schedule is not running as often as you think.
6. Write down how long the whole thing took. That number is your real recovery time, and it is usually the surprise.

From our projects: On our care plans the backups are daily and off-site with 30 days of history, and the Priority plan includes a private staging copy so changes can be tested safely before they reach the live site. We also run website recovery for sites where the backups turned out to be missing, and we check what is recoverable for free before anyone pays, because sometimes the honest answer is that a full restore is not possible.

Plugin, host or care plan: which one fits your site

Your situation	What we would do
Brochure site, a few pages, content changes a few times a year	Host backups plus a free plugin sending a weekly copy to your own cloud storage. Test it twice a year.
Business site with a blog and forms, updated most weeks	Daily off-site backups and someone who checks they ran. This is the point where a care plan starts to pay for itself.
WooCommerce store taking orders daily	Daily is the minimum and real-time database backups are worth the cost. Losing a day means losing orders you cannot reconstruct.
Site with several editors or a developer making changes	Backups plus a staging copy, so changes are tested somewhere other than production.
You have been hacked before	Off-site backups kept well beyond 30 days. Infections are often weeks old by the time anyone notices, so recent copies can be infected too.
Nobody internally would know how to restore	Buy the restore, not the backup. The plugin is free; the person who can use it at 2am is not.

If you are technical, or have someone in-house who is, a free plugin with off-site storage and a diary reminder to test it is a perfectly honest answer. We would rather say that than sell a plan to someone who does not need one.

What backups cost when someone else runs them

Backups on their own are rarely sold as a product by us, because the restore matters more than the file. They sit inside our WordPress care plans, alongside the updates and monitoring that stop most restores being needed.

Plan	Price	What it adds for backups and recovery
Essential	$49 a month	Daily off-site backups with 30-day history, updates tested before release, security monitoring and malware removal, uptime alerts
Business	$99 a month	Everything above, plus layout and content changes done for you and replies within one business day
Priority	$199 a month	Everything above, plus a private staging copy to test changes safely, weekly checkout testing and same-day response for urgent issues

Prices are per website, there is no contract, and if an update ever breaks your site the fix is free. Changes cover updates to your existing site; new features and redesigns are quoted separately. The full list of what sits in each plan is on the pricing page.

Two related costs are worth knowing before you decide how much protection to buy. Cleaning a hacked site through our WordPress malware removal service starts at $99, and most cleanups cost between $99 and $299 depending on the size of the infection. Rebuilding a site that has no usable backup at all starts at $149 for up to 20 pages. Set against those, a monthly plan is usually the cheaper mistake to make.

Backups are one line in a longer list of things a live site needs looking after. We set the rest out in our website maintenance checklist, and if your site is already in trouble, what to do when a website is hacked is the more urgent read. For sites where the backups are already gone, recovering a deleted WordPress site covers what can still be salvaged.

Want someone to own the backups and the restore?

Attors Technologies is a web development agency that builds and maintains WordPress sites for businesses in the US, UK and Europe. Tell us where your site is hosted and what is backing it up now. We will tell you what is missing, test a restore, and give you a fixed monthly price if you want us to keep running it.

Have us check your backups and test a restore