Which WordPress backup plugin should I use? Probably none of them.

“Which backup plugin should I use?” is one of the most common questions I get, and I’ve come to think it’s the wrong one. Not a stupid question. Just the wrong one.

Because the honest answer is: it depends what your host is already doing. And if your host is doing it properly, the answer is usually none of them.

What a backup plugin actually is

Strip away the marketing and a backup plugin is a bit of PHP that runs inside WordPress, on your web server, and zips up your files and database. Then it either leaves that zip sat on the same server (please don’t) or pushes it off to Google Drive, Dropbox or an S3 bucket.

It’s scheduled by WP-Cron, which isn’t a real cron. It’s a pseudo-scheduler that only fires when someone visits your site. Quiet Tuesday? No visitors? No backup. That’s not a bug, that’s how it’s designed.

You can fix that part, at least. Switch WP-Cron off in wp-config.php and have the server’s own scheduler call it every few minutes instead. WordPress documents exactly how in Hooking WP-Cron into the system task scheduler. It’s ten minutes of work, and it means your backups, and everything else WordPress schedules, run on a clock rather than on foot traffic. A decent host does this for you without being asked. If yours doesn’t, that tells you something too.

And it runs under the same PHP memory and execution limits as everything else on your site. Which is fine for a five-page brochure site. It’s rather less fine for a WooCommerce store with 3,000 products and a decade of uploads, where the backup quietly gives up two thirds of the way through and nobody notices because the plugin still says “last backup: today”.

The four ways it lets you down

I’ve seen every one of these on a real site. Usually the day someone actually needed the backup.

It’s on the same server. If the disk dies, the malware spreads, or the host suspends the account, your backup goes with it. A backup stored next to the thing it’s backing up isn’t a backup. It’s a copy.

It only runs when WordPress does. WP-Cron again. Low-traffic sites are exactly the ones that go unnoticed for weeks when something breaks, and exactly the ones whose backups quietly stop running.

It half-finishes. Big sites hit PHP limits. The plugin reports success because the job started, not because it completed. You find out when the restore fails.

Nobody has ever restored it. This is the big one. A backup you’ve never restored is a hypothesis. It’s the failure you only discover on the worst possible day, because that’s the only day anyone tries.

The plugins, honestly

If you’ve read this far and still want one, here’s how I’d rank them.

UpdraftPlus is the default for a reason. The free version does full backups to Drive, Dropbox or S3 and restores from inside WordPress, which is more than most manage. It’s mature and it’s everywhere. The premium tier adds incrementals and migration. Its weakness is the same as all of them: it’s still a plugin, still on your server, still on WP-Cron. Install it, point it off-site, and then actually test a restore. Once. Please.

WPvivid is the leaner newcomer. The free tier does a bit more than UpdraftPlus’s free tier, including migration, and the interface is less cluttered. It’s less battle-tested and the company behind it is smaller. If you’d rather not pay and you’re on a modest site, it’s a fair pick.

BlogVault is the one that’s honest about the problem. It doesn’t run the backup on your server. It pulls your site to its own infrastructure, does incrementals properly, and tests restores automatically. Which is to say: it does what your host should be doing, and charges you for it. If your host isn’t backing you up, this is the closest a plugin gets to doing it right.

Jetpack VaultPress Backup is BlogVault with Automattic’s pricing and Automattic’s habit of bundling twelve other things you didn’t ask for. It works. I just don’t love paying for Jetpack.

Notice the pattern. The plugins that actually solve the problem are the ones that stop being plugins and become a service running somewhere else.

The catch

Here’s what I actually run for every site I host, and what I’d tell you to demand from whoever hosts yours.

Backups happen at the server level, outside WordPress, on a proper cron that fires whether anyone visits or not. They’re full-site, files and database together, so there’s no “restored the files but the database was from Tuesday” situation. They go off-site, to a different provider on different infrastructure, so a dead server or a compromised account doesn’t take the backups down with it. And they’re rolling, so you can go back a week, not just to last night.

None of that is clever. It’s just boring and correct, and it’s what hosting should have included all along.

The bit that matters more than any of it: restores get tested. Regularly. Not “we’re confident it works” tested. Actually restored, to a staging copy, checked that the site loads and the database is intact. A backup that’s never been restored is a hope. A backup that gets restored regularly is a plan.

That’s the catch in the title. The backup plugin conversation is a distraction from three questions you should be asking your host instead:

1. Is the backup stored off this server, with a different provider?
2. Does it run whether or not the site gets visitors?
3. When did you last restore one, and did it work?

If they can answer all three without going quiet, you don’t need a plugin. If they can’t, you need a new host more than you need a plugin.

So when should you install one?

Two cases.

You’re on cheap shared hosting that offers no backups, or “backups” that turn out to be a weekly snapshot they’ll restore for a £30 fee and a support ticket. Then yes, install UpdraftPlus, point it at Google Drive, put WP-Cron on a real server cron as above, and test a restore this week.

Or you want a belt-and-braces copy you control, independent of the host, because you’ve been burned before. Fair enough. Same advice.

In both cases, the plugin is a stopgap for a host that isn’t doing its job. It’s not the job.

Where that leaves you

Stop asking which backup plugin to use. Ask your host the three questions above. Their answer tells you whether you need a plugin at all, and if you do, which of the four above is the least bad fit.

And whatever you end up with, restore it once. Just once. It’ll take twenty minutes and it’s the only way to find out if any of this actually works.