Best Backup Tool for WordPress Websites

Backups are the thing you don’t think about until the day you really need one. And on that day, the only question that matters is whether your backup strategy is as reliable as you believed it was.

This thread was one of the most candid in the series. Gary Sorensen’s reply, “I’m not brave enough to post mine,” drew a laugh of recognition. Adam Wright admitted his setup is “good enough but also have no clue,” and added, “I should do regular testing!” Others described layered systems that would make a sysadmin proud.

This post is a summary of a Tuesday Toolbox discussion inside The Admin Bar community, where agency owners shared their go-to WordPress backup setups: how often they back up, where they store backups, and whether they’ve actually tested a restore.

The Most Mentioned Backup Solutions

These came up repeatedly in the discussion:

• UpdraftPlus
• WP Umbrella
• WPvivid
• BlogVault
• WP Time Capsule
• Server-Level
• Layered Setups

A number of other tools came up as well (we’ll get to those).

Why Agencies Choose These Backup Solutions

UpdraftPlus

The most-mentioned plugin, with real strengths and well-known limits.

UpdraftPlus came up more than any other backup plugin, often as one layer in a larger setup. Foysal Imran’s team at ThemeAtelier uses the free version across their plugin sites and stores everything in Google Drive. They run about 14 database backups and 4 full file backups a week, since the database changes far more often than the files.

“It’s simple, free, and hasn’t let us down so far.”

Foysal Imran

Cheryl Microutsicos runs UpdraftPlus Premium to Google Drive as one of several layers. Norris W Girdy runs it weekly to Google Drive. Christian Strasser sends it via FTP to a separate backup server. Delower Hossain’s answer was a confident “No doubt.”

The limits were just as clear. Vojkan Cvijanovic used the free version without ever seeing it fail, but disliked that it doesn’t back up WordPress core files and that it puts backups from all his sites into a single folder. Markus Raab agreed those drawbacks are real, and added that for restoring an infected site, Updraft may not be the right tool because it only overwrites what’s there, without an easy way to delete files and the database during the restore.

Security came up too. One commenter pointed to a recent compromise at UpdraftPlus. Rob Marlbrough clarified that, as he understands it, only the Pro Central service was affected, which he doesn’t use or recommend, and that the plugin itself is still “rock solid.” Check the current details yourself before deciding.

Best fit: agencies who want a simple, familiar plugin as one layer of backup, ideally paired with a way to restore cleanly.

WP Umbrella

The management-dashboard backup that pairs well with hosting.

WP Umbrella came up from six members, usually as one component alongside hosting backups.

“SiteGround Hosting + WP Umbrella is all I need.”

Marc Hyde

Norris W Girdy runs hosting backups plus WP Umbrella daily and Updraft weekly. Christian Strasser uses it (or Modular DS) as his second layer. Mario Marquez Tagliaferro uses WP Umbrella or Modular DS on most sites. Charles Metzger runs it nightly to their servers, and Irene Koukia runs it daily alongside xCloud backups to pCloud.

Best fit: agencies who want a site-management dashboard with built-in backups, as a layer on top of what their host provides.

WPvivid

The Pro version came up as a workhorse for remote backups and migrations.

Vojkan Cvijanovic uses WPvivid Pro for automated remote backups to Dropbox or pCloud. Josiah Hostetter uses it with Wasabi storage for manual and dev backups. Charles Metzger runs it nightly to pCloud, plus a manual backup to his computer (synced to Backblaze) whenever he logs in to make an edit.

“WP Vivid is also our tool for site migrations. It never fails us.”

Mark Peters

Mark’s team runs WPvivid Pro for weekly full backups to Google Drive on top of xCloud’s own backups.

Best fit: agencies who want automated remote backups to the storage of their choice, and a tool that doubles for migrations.

BlogVault

Backups with built-in extras, via WP Remote or BlogVault directly.

BlogVault, along with its WP Remote product, came up from four members. Melanie Barkdull Adcock summed up why she likes it:

“It just works. Migrations are a breeze. Automatic backups before updates.”

Melanie Barkdull Adcock

Adam Wright pairs BlogVault with his Kinsta hosting backups. Cheryl Microutsicos includes WP Remote backups in her stack. Greg Dietrich uses BlogVault for backup and malware scanning, retained for 90 days, as one layer of his client promise (more on that below).

Best fit: agencies who want automated off-site backups, pre-update snapshots, and malware scanning in one service.

WP Time Capsule

Real-time, incremental, set-and-forget.

WP Time Capsule came up from three members, all for the same reason: incremental backups that just run.

“Just works. Set and forget.”

Ivan van der Tuuk

Ivan notes the first backup takes a while, but increments finish quickly, and he suggests deleting and reconfiguring the plugin if the database gets much bigger. Josiah Hostetter uses it with Wasabi as his “set-and-forget” option for production. Gerson El still uses it for real-time incremental backups, with xCloud’s server-level backups handling daily database and full backups, saved to Amazon S3.

Best fit: agencies who want real-time incremental backups on production sites, especially those with frequent changes.

Server-Level

Host and platform backups, often the first layer.

Almost every layered setup in the thread starts here. Members mentioned backups from their hosts (SiteGround, Kinsta, DigitalOcean), plus platform tools like xCloud, SpinupWP, and GridPane.

Mark Peters’s team runs xCloud daily incrementals, weekly fulls, and a daily full backup to pCloud. Irene Koukia has xCloud back up to pCloud, with a separate server backup to Vultr, all daily with auto-delete after 30 days. Mario Marquez Tagliaferro uses GridPane with auto backups on a clone VPS and daily backups to Backblaze. Wendell Troy connects GridPane to Wasabi and Backblaze. Jordan Trask uses Snapshooter, and is building his own tool. Ans El is also developing a self-hosted backup system.

Alex Celeste’s detailed setup (below) leans on SpinupWP backups to AWS S3 with a tiered retention schedule.

Best fit: agencies on a managed or platform-based stack who want backups below the WordPress layer, where clients and plugins can’t touch them.

Layered Setups

The agencies that take it most seriously run multiple independent systems.

Several members described three, four, or five layers. The details are worth studying.

Alex Celeste’s three schemes:

1. Weekly full-server backups from DigitalOcean.
2. SpinupWP backups to AWS S3 (files and database), kept daily for 5 days, weekly for 16 days, and monthly for 90 days. After 30 days they move to cheaper storage that’s still instantly retrievable.
3. Nightly database backups per site user, using a cron job and WP-CLI, then a Mac mini in the basement pulls full site users via rsync later each night. The Mac mini connects with a read-only user, so it can’t change the sites it backs up. Access is by SSH keys only, with passwords disabled.

His key design point: “None of these backups have anything visible in the WP dashboard, they’re all below that level,” so clients, the team, and WordPress attackers can’t easily tamper with them from the web.

Greg Dietrich frames it as a promise: “My promise to my client is that I will not lose their data.” His layers are a daily server-level snapshot kept 7 days, a daily remote backup to Backblaze kept 30 days, and BlogVault kept 90 days. He runs 18 servers for roughly 500 sites.

Rob Marlbrough runs ManageWP, separate control panel backups, and VPS backups, then mirrors both using Proxmox Backup Server to a remote 3TB VPS, and mirrors all of that to Backblaze B2. He tests his backups, and recalls a time every level except B2 failed.

Charles Metzger runs host nightly backups (stored in a different data center), WP Umbrella nightly, WPvivid nightly to pCloud, and manual WPvivid backups to his computer, synced to Backblaze.

Cheryl Microutsicos runs cPanel backups, Acronis, UpdraftPlus Premium to Google Drive, and WP Remote. “You can never have too many backups!”

Best fit: agencies who manage many client sites and can’t afford a single point of failure.

The Restore Problem

This was the sharpest conversation in the thread, and it’s worth its own section.

Patrick Gallagher argued that nearly every approach suggested in the thread shares a flaw: there are no checks that the backups even worked. “No verified restore points.” His view is that this is almost worse than not taking backups at all, because it gives you false confidence. Markus Raab noted that MainWP 6.4 may be doing something along these lines with weekly verifications, though he wasn’t sure of the details.

David Innes provided a case study. He’d used BackupBuddy (now sold as Kadence Backups) for almost 15 years, until it started getting inconsistent this year. Needing to upload a site to a server he didn’t have access to, he made a backup through GoDaddy Hub (a free-ish version of ManageWP), tried an UpdraftPlus restore, and it failed and broke the site badly. Restoring from GoDaddy Hub brought the site back online, but as a “Frankenstein version” mixing old and new software. All-in-One Migration finally worked.

His takeaways: backups are only as good as the restoration process, he’s going to lean on other options, and he’s never doing it again without server access unless it’s a true rescue situation.

Rob Marlbrough tests his backups, and has the scar to prove why. Adam Wright admitted he should. Most of the thread didn’t mention testing at all.

Notable Mentions

These also came up in the thread:

• Duplicator: Vojkan Cvijanovic uses the free version for quick manual backups, and Asing De Naam uses it with CloudHQ
• ManageWP: Rob Marlbrough uses it for backups, and David Innes made a backup through GoDaddy Hub, which he described as a free-ish version of it
• Modular DS: Christian Strasser and Mario Marquez Tagliaferro use it as a layer alongside or instead of WP Umbrella
• Akeeba Backup: Michael Demopoulos’s pick
• Acronis: Cheryl Microutsicos includes it in her layers
• BackupBuddy / Kadence Backups: David Innes used it for almost 15 years, but says it’s grown inconsistent this year
• All-in-One WP Migration: David Innes used it as his successful restore. Mario Marquez Tagliaferro moved from it to UpdraftPlus after being unhappy with how lifetime license holders were treated.
• Wasabi and Backblaze B2: popular storage destinations for backups (Josiah Hostetter, Wendell Troy, Rob Marlbrough, Greg Dietrich)
• The manual approach: Nate Hoffelder copies each file and downloads the database one table at a time, and declared that “backup solutions are for the weak.” He appears to be joking.

Patterns We Noticed

A few things stood out across the thread:

• Nobody relies on a single backup. The most common pattern was host backups plus at least one plugin or service, often with a third copy somewhere else.
• Where the backup lives matters as much as the tool. Google Drive, pCloud, S3, Wasabi, and Backblaze B2 all appeared. Several members deliberately keep copies in a different data center, provider, or region.
• Untested backups are the biggest weak spot. Patrick’s critique and David’s restore failure were the thread’s loudest warnings. Only a few members said they test restores.
• Backups below the dashboard are safer. Alex’s design principle, keeping backups out of reach of WordPress itself, shows up in the server-level and platform-based setups too.
• Retention schedules are part of the strategy. Greg’s 7/30/90-day tiers and Alex’s daily/weekly/monthly schedule show how much thought goes into how long to keep things.
• Managed platforms are reshaping the stack. xCloud, SpinupWP, and GridPane came up often, with backups to S3, pCloud, Backblaze, and Wasabi built in.
• Plugin trust is shifting. UpdraftPlus is still the default, but its limits (core files, single-folder storage, restore behavior) and a recent security issue came up. WP Umbrella, WPvivid, BlogVault, and WP Time Capsule are all getting more attention as layers.
• Some agencies are building their own. Jordan Trask and Ans El are both developing backup tools, which suggests members don’t feel the problem is fully solved.

How to Choose the Right Backup Solution

These questions can help narrow it down:

• How many independent copies do you have, and are any of them with a different provider or in a different location?
• Are your backups stored somewhere WordPress, clients, or plugins can modify?
• How often does the site change? Does it need real-time or incremental backups, or are daily ones enough?
• What’s your retention schedule, and does it match what you’ve promised clients?
• Have you actually restored from each layer? When did you last test it?
• Will you have server access in an emergency, or only the WordPress admin?
• What will the storage cost at scale, across all your client sites?
• Are backups separated per site, so you can restore just one?

Frequently Asked Questions About WordPress Backups

What is the best backup plugin for WordPress? UpdraftPlus was the most mentioned, usually as one layer. WP Umbrella, WPvivid, BlogVault, and WP Time Capsule also came up repeatedly. Most members use more than one tool.

How often should I back up a WordPress site? It depends on how often the site changes. One team backs up the database about 14 times a week and files 4 times a week, since the database changes more. Others do daily database backups plus weekly full backups, and some use real-time incremental backups for busy sites.

Where should I store WordPress backups? Members use Google Drive, Dropbox, pCloud, Amazon S3, Wasabi, and Backblaze B2, often more than one. Several recommended keeping at least one copy with a different provider or in a different data center or region, and keeping backups outside the host or plugin vendor’s cloud.

Are hosting backups enough? Most members treat them as one layer, not the whole plan. Nearly every layered setup in the thread starts with host backups, then adds at least one independent copy.

How do I know my backups will actually restore? That’s the hard part. Several members said they don’t know, or don’t test. One described a restore that failed badly and another that produced a mixed-up site, before a third tool succeeded. The advice from the thread: test restores, ideally on a regular schedule, and consider tools that verify backups automatically.

How long should I keep backups? It varies. One agency keeps server snapshots for 7 days, remote backups for 30, and BlogVault backups for 90. Another keeps dailies for 5 days, weeklies for 16, and monthlies for 90, with older ones moved to cheaper storage. Choose a schedule that matches what you’ve promised clients.

Should I back up WordPress core files too? One member stopped using UpdraftPlus’s free version because it doesn’t back up core files. If a full-site restore matters to you, check what your tool includes.