A WordPress backup strategy for agencies that actually holds up

Every agency says its client sites are backed up. The real question is what happens on the day you need one: is it recent enough, is it stored somewhere the problem did not reach, and does it actually restore? This guide sets out a backup strategy you can apply to every client site, from a small brochure site to a busy shop.

Start with the 3-2-1 rule

The classic rule still works: keep three copies of the data, on two different kinds of storage, with one of them off-site. For WordPress that usually means the live site itself, the host’s own backups, and an independent copy stored somewhere else. If the server is hacked, the host has an outage or an account is closed, the off-site copy is the one that saves you.

Backups made by the host are useful, but they live with the same company and often on the same infrastructure as the site. They count as one copy, not as your whole strategy.

How often: match it to how fast the site changes

• Brochure sites that change a few times a month: a nightly backup is plenty.
• Sites with forms, bookings or members: nightly, and always one right before any update.
• Shops: nightly at least, and think about more frequent database backups, because orders arrive all day. Losing a day of orders is a real cost for your client.

Whatever the schedule, take a fresh backup of files and database right before you update anything. That is the copy you will reach for if an update goes wrong.

What to back up

• The database: posts, pages, settings, orders, users. It changes most often and matters most.
• wp-content: uploads, themes and plugins, including premium ones you cannot simply download again.
• Configuration: wp-config.php and server settings such as .htaccess, kept separately and securely, because they contain credentials.

How long to keep backups

Thirty days of daily backups covers most problems: a broken update is usually noticed within days. Some problems surface much later, such as a hack that went unnoticed or content deleted by mistake weeks ago. Keep a few longer-term copies too, for example one from just before a big rebuild. Backups contain personal data such as customer names and orders, so do not keep them forever: agree a retention period, store them encrypted and, for European clients, preferably in the EU.

A backup only counts once you have restored it

The most common backup failure is not a missing backup. It is a backup that turns out to be incomplete, too large to restore on the hosting, or in a format nobody remembers how to use. Restore a backup on purpose, regularly, before you need to:

1. Restore it somewhere that does not touch the live site: a staging copy or a separate folder.
2. Check that every file and database table came back, and that the site loads.
3. Write down how long it took and how much disk space it needed.
4. Repeat every few months, and after big changes to the site.

How Verploy handles backups

Verploy makes a backup of every connected site every night through its connector, without access to the hosting account. Backups are encrypted on the site before they leave it, stored in the EU and kept for 30 days; you can keep up to three per site for a year. You can restore one site in one step, run a restore test next to the live site without touching it, or download any backup as a single file. Before every update goes live, Verploy also takes a snapshot to roll back from. More on WordPress backups for agencies.