A backup is useful when it helps you recover a working website. That sounds obvious, but there is a difference between receiving a “backup completed” notification and knowing what to do when an update, accidental deletion or compromised plugin takes the site offline.
Start with what you need to recover
A WordPress website depends on both files and a database. Posts, settings and much application data live in the database; uploaded media, themes and plugins live in files. Your recovery plan needs compatible copies of both, together with the configuration needed to connect them.
For a brochure site, losing a few recent edits may be manageable. For a shop, losing recent orders is a different problem. Choose the backup schedule around how much important data changes, rather than accepting a default without checking it.
Know what the hosting backup includes
When reviewing WordPress hosting, look beyond whether backups appear on the feature list. Ask how frequently they run, where copies are stored, how long they remain available and who can request a restore.
Find out whether you can recover one database or file instead of rolling back the entire account. Check whether restoration costs extra and what happens if the hosting account itself becomes inaccessible.
Keep an independent copy
A copy stored inside the same account can be affected by the same deletion or compromise as the live website. Keep a separate copy with restricted access and protect any personal data it contains.
Retention matters too. If a problem is discovered a week after it began, yesterday’s backup may already contain it. Keep enough history for the way your site is used and reviewed.
Rehearse the restore
Test recovery in an isolated environment before you need it urgently. A short rehearsal should answer four questions:
- Can you obtain and open the backup?
- Can you restore the database and files together?
- Do pages, images and administrator access work?
- How long does the process take, and who can perform it?
Disable live email, scheduled actions and payment operations in the test environment. Record the steps and correct any missing permissions or dependencies.
Recover the cause as well as the content
After a security incident, simply restoring a copy can bring the vulnerable plugin or stolen credentials back with it. Investigate the cause, apply updates and rotate exposed secrets as appropriate before reopening the site.
The official WordPress backup handbook is a useful reference for the underlying components. Your own plan should turn those components into a repeatable process with a named owner.